Malicious software classification method based on deep learning
Through deep learning methods, the malicious code is graphically processed and feature fusion is integrated, and the FFSE-BiTCN model is used to identify malware, which solves the problem that traditional methods are difficult to identify complex malicious code variants, and realizes efficient malware classification and detection.
Patent Information
- Application Number
- CN202411166152.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-23
- Publication Date
- 2024-12-13
AI Technical Summary
Traditional malicious code classification methods are difficult to effectively identify complex and extremely fast-updated malicious code variants, and cannot cope with the threat of rapid change.
Using a deep learning-based method, by graphic processing of byte files, the byte feature images are generated, the operation code sequence features of assembly language files are extracted, and the features are fused and classified are achieved using the FFSE-BiTCN model. Efficient identification of malware.
It improves the detection accuracy and classification accuracy of malware, can utilize spatio-temporal data information from multiple angles, effectively identify malicious code and its variants, and enhances the ability to confront.
Smart Images
Figure CN119128884A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of data network security, and in particular relates to a malware classification method based on deep learning. Background Art
[0002] Malicious code refers to code designed by humans to perform malicious operations or attack behaviors in some way. Common malicious codes include Trojans, worms, and computer viruses. Malicious code has a serious impact on users' daily lives and social production, and may also threaten network security. It is necessary to strengthen the detection and crackdown on malicious code to reduce the threats and risks it brings.
[0003] Malicious code classification technology aims to classify malicious code samples into different families or categories based on their common characteristics and behaviors. This classification helps researchers better understand the source, evolution, and propagation of malicious code, and provides guidance to security researchers to help them develop defense measures against specific threat families. Family classification technology usually uses methods such as machine learning and data mining to extract features from malicious code samples and use these features for classification and clustering analysis.
[0004] Traditional malicious code classification methods are based on the idea of feature code matching, which requires manual extraction of malicious code features and comparison with known features. However, with the change of technology, in order to evade detection, malicious code authors will also perform anti-detection operations such as obfuscation and shelling on malicious code, thereby generating variants of malicious code. Moreover, this process is often automated and updated very quickly. Obviously, faced with complex and rapidly updated malicious code, traditional detection methods are no longer able to cope with it. Summary of the invention
[0005] The technical problem to be solved by the present invention is to overcome the above difficulties and efficiently and accurately identify the malicious code and its variants by executing a deep learning malicious code classification algorithm, so as to take targeted measures.
[0006] To achieve the above objectives, the present invention provides a malware classification method based on deep learning, and the technical solution is as follows:
[0007] A malware classification method based on deep learning includes the following steps:
[0008] Step S1: Graphically process the byte file of the software to be identified to generate a byte feature image;
[0009] Based on the assembly language file of the software to be identified, extracting the operation code sequence features of the assembly language file;
[0010] Step S2: Fusing the byte feature image and the operation code sequence features to obtain a feature fusion sequence;
[0011] Step S3: classify the feature fusion sequence to obtain the classification result of the software to be identified.
[0012] Furthermore, in step S1, the process of graphically processing the byte file is specifically: converting the pixels of the grayscale image into a two-dimensional matrix.
[0013] Furthermore, the process of converting the pixels of the grayscale image into a two-dimensional matrix is as follows: taking the byte file as input, cutting the binary sequence in the byte file into 8-bit subsequences, converting each subsequence into a decimal number in the value range [0,255], and converting the formed one-dimensional decimal array into a two-dimensional array.
[0014] Furthermore, in the process of cutting the binary sequence in the byte file into 8-bit subsequences, the strategy of reading by line and discarding the first eight digits is adopted to cut the starting address.
[0015] Furthermore, step S1 also includes normalizing the size of the byte feature image to adjust the byte feature image to a preset size.
[0016] Furthermore, the image size normalization method is a bilinear interpolation method.
[0017] Furthermore, in step S1, an N-grams method is used to extract the operation code sequence features of the assembly language file of the software to be identified, and the text of the operation code sequence is segmented into n consecutive items.
[0018] Further, step S2 includes:
[0019] Step S201: extracting multi-scale first image features from the byte feature image, inputting the first image features into a feature fusion-based compression excitation network model (FFSE model), fusing local features and global features of different scales on the first image features, obtaining second image features, stretching the second image features into a first feature sequence, cropping the first feature sequence, obtaining a second feature sequence, and the second feature sequence is a spatial feature;
[0020] Step S202: Input the second feature sequence and the operation code sequence features into a bidirectional temporal convolutional network model (BiTCN model) for fusion to obtain a feature fusion sequence, where the operation code sequence features are semantic features, and the feature fusion sequence has both spatial features and semantic features.
[0021] Furthermore, the FFSE model includes a multi-scale image feature fusion module (FF) and a channel attention module (SE).
[0022] Furthermore, the multi-scale image feature fusion module includes multiple CRB modules.
[0023] Furthermore, each CRB module includes a Conv2d convolutional layer, a ReLU activation function, and a BN layer connected in sequence.
[0024] The Conv2d convolution layer extracts spatial information from the input features through convolution operations and obtains multi-scale features of the image by selecting different convolution kernel sizes;
[0025] The ReLU activation function layer is used to introduce nonlinear transformation and enhance the expressiveness of features;
[0026] The BN layer is used to batch normalize the output of the convolutional layer to speed up the training process and improve the stability of the model.
[0027] Furthermore, the channel attention module implements the channel attention mechanism including two stages: compression and excitation;
[0028] In the compression stage, the feature map of each channel is compressed into a scalar value through global average pooling operation to capture the global information of the channel; in the excitation stage, a feedforward neural network is used to generate the excitation weight of each channel by learning a nonlinear function. The excitation weight of each channel is multiplied by the scalar value obtained by the channel in the compression stage to generate a weighted feature representation of the channel.
[0029] Furthermore, the channel attention module adaptively learns the activation weights of each channel.
[0030] Furthermore, the BiTCN model includes a first TCN module, a second TCN module, a CRD module, a pooling layer and a fully connected layer; wherein:
[0031] The first TCN module and the second TCN module are connected in parallel, and both are temporal convolutional networks;
[0032] The CRD module is connected to the back end of the first TCN module and the second TCN module. The CRD module includes a one-dimensional convolution (conv1d), a ReLU activation function, and a Dropout layer;
[0033] The CRD module, pooling layer and fully connected layer are connected in sequence.
[0034] Furthermore, the feature fusion sequence is input into the first TCN module in a forward manner to obtain a first feature fusion sequence; and is input into the second TCN module in a reverse manner to obtain a second feature fusion sequence; the first feature fusion sequence and the second feature fusion sequence are then fused with the feature fusion sequence itself to obtain a feature fusion sequence after secondary fusion;
[0035] The feature fusion sequence after secondary fusion is pooled and stretched and reduced in dimension through the CRD module.
[0036] Furthermore, the first TCN module and the second TCN module each include a plurality of causal dilated convolutional layers (TB).
[0037] Furthermore, the number of causal dilated convolutional layers (TB) is 4.
[0038] Furthermore, each causal dilated convolutional layer includes two WCCRD layers, and a residual connection is introduced between the two WCCRD layers.
[0039] Furthermore, the WCCRD layer includes a regularization module, a one-dimensional convolution (conv1d), a cropping module, a ReLU activation function, and a Dropout layer, which are connected sequentially.
[0040] Furthermore, in step S3, classification of the feature fusion sequence is performed through a fully connected structure, which includes a first fully connected layer, a first ReLU activation function, a first Dropout layer, a second fully connected layer, a second ReLU activation function, a second Dropout layer, and a third fully connected layer connected in sequence.
[0041] Furthermore, the first Dropout layer sets a first dropout value, and the second Dropout layer sets a second dropout value.
[0042] Compared with the prior art, the present invention has the following beneficial effects:
[0043] 1. The present invention is based on the .bytes file and .asm file generated by disassembling the software to be identified, extracts grayscale image texture features from the .bytes file, extracts N-grams operand subsequence features from the .asm file, and fuses the two-dimensional image and one-dimensional sequence features to generate a feature fusion sequence that can represent the features of the software to be identified from two different angles, thereby improving the detection accuracy of malware / code identification and the classification accuracy of malware;
[0044] 2. The FFSE-BiTCN model fully considers the spatial correlation and temporal correlation characteristics of the image, performs a multi-scale feature fusion operation based on the channel attention mechanism on the grayscale image features, and can fully extract the spatial correlation characteristics of the malicious code. The fusion features of the opcode features and the two-dimensional image features are subjected to a temporal convolution operation. The fusion features of the opcode features and the two-dimensional image features are subjected to a temporal convolution operation, which can fully extract the temporal correlation characteristics of the malicious code and realize the multi-angle utilization of the malicious code information.
[0045] 3. The two-dimensional image features are used as the input of the FFSE model for spatial feature extraction, and the one-dimensional image is fused as the input of the bidirectional time domain convolutional network model for training and classification, which improves the detection accuracy of malicious code and enables the model to make full use of the spatiotemporal data information of malicious code;
[0046] 4. A pooling fusion mechanism is introduced to further capture the dependencies within the data. BRIEF DESCRIPTION OF THE DRAWINGS
[0047] Figure 1 Schematic diagram of the overall structure of the FFSE and BiTCN fusion model of an embodiment of the present invention, in which X is a grayscale image, Y is an operation code sequence, FFSE is a compression excitation network based on feature fusion, view is a pull-up operation, crop is a cropping operation, BiTCN is a bidirectional temporal convolutional network, flatten is a flattening operation, and out is the output;
[0048] Figure 2 A schematic diagram of a byte feature image generation process according to an embodiment of the present invention;
[0049] Figure 3 Schematic diagram of the FFSE model structure of an embodiment of the present invention, in which X is a grayscale image, POOL2D represents a two-dimensional pooling layer, MaxPool2d represents a maximized two-dimensional pooling layer, and AvgPool2d represents an average two-dimensional pooling layer;
[0050] Figure 4 Schematic diagram of the FF module of an embodiment of the present invention, in which MAXPOOL is a maximum pooling layer, CRB1, CRB2, and CRB3 are different CRB modules, and Conv2d is a two-dimensional convolution;
[0051] Figure 5 Schematic diagram of an SE module according to an embodiment of the present invention, in which AdaptiveAvgPool2d is an adaptive two-dimensional pooling layer, and FC is a fully connected layer;
[0052] Figure 6 Schematic diagram of a BiTCN model of an embodiment of the present invention, in which Conv1d is a one-dimensional convolution, Pool1d represents a one-dimensional pooling layer, MaxPool1d represents a one-dimensional maximum pooling layer, and AvgPool1d represents an average one-dimensional pooling layer;
[0053] Figure 7 Schematic diagram of a TCN module according to an embodiment of the present invention, in which TB1, TB2, TB3, and TB4 are different causal expansion convolution layers (TB modules);
[0054] Figure 8Schematic diagram of a TB module according to an embodiment of the present invention, in which weight normal represents weight regularization;
[0055] Fig. 9 Schematic diagram of a fully connected structure according to an embodiment of the present invention. DETAILED DESCRIPTION
[0056] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, the following, in combination with the accompanying drawings and preferred embodiments, a malware classification method based on deep learning proposed by the present invention, its specific implementation method, structure, characteristics and effects are described in detail as follows.
[0057] Example 1
[0058] Malicious code visualization refers to converting the files related to malicious code into images in a specific way. Malicious code visualization allows people to identify and classify malicious code through computer vision methods. The images of malicious code are rich in information. The images of malicious code in the same family are similar, while the images of malicious code in different families are obviously different. At the same time, malicious code may cause the global logic of the image to change through means such as packing and obfuscation, but the image of the core code segment will not change. Therefore, the global and local logical relationships of the image need to be effectively extracted. In addition, each calling function in the malicious code has a certain logical relationship between the upper and lower parts during execution. Extracting the text features of the malicious code for training can effectively extract the contextual logical relationship of the semantic vector.
[0059] Based on the above principle, Figure 1-9 As shown, the present invention provides a malware classification method based on deep learning, comprising the following steps:
[0060] Step S1: Based on the byte file of the software to be identified, perform graphical processing to generate a byte feature image;
[0061] Based on the assembly language file of the software to be identified, extracting the operation code sequence features of the assembly language file;
[0062] Step S2: Fusing the byte feature image and the operation code sequence features to obtain a feature fusion sequence;
[0063] Step S3: classify the feature fusion sequence to obtain the classification result of the software to be identified.
[0064] Malicious code / software graphical classification detection takes into account both the global and local features of malicious code images, but it is prone to losing too many contextual details, while text sequence information can provide the missing information.
[0065] In this embodiment, the byte feature image and the operation code sequence feature are fused to improve the accuracy of model classification.
[0066] Example 2
[0067] The difference from Example 1 is that, in this embodiment, the idea of Nataraj vectorization is adopted to realize the malicious code graphics. The advantage of using the Nataraj vectorization method is that there is no need to parse the PE file format, avoiding the risks and hidden dangers brought by dynamic detection, and having good anti-attack capabilities.
[0068] Specifically, take the byte file as input, cut the binary sequence in the byte file into 8-bit subsequences, convert each subsequence into a decimal number in the value range [0,255], and convert the formed one-dimensional decimal array into a two-dimensional array, that is, convert the pixels of the grayscale image into a two-dimensional matrix. The process of converting the pixels of the grayscale image into a two-dimensional matrix is as follows: Figure 2 It should be noted that the data in the figure are only examples, not complete data.
[0069] Since the first eight bits of each line of the binary file of the malicious code are the starting address of the line, and the starting address has no meaning for model classification, in some preferred implementation schemes of this embodiment, further, in the process of cutting the binary sequence in the byte file into 8-bit subsequences, the strategy of reading by line and discarding the first eight digits is adopted to cut the starting address.
[0070] Example 3
[0071] The difference from Example 1-2 is that when using a convolutional neural network (CNN) for image processing, the size of the input image is usually fixed. This is because the weights in the convolution layer are associated with the shape of the input image. If the size of the input image is inconsistent, it is necessary to retrain the model or crop / scale the image to adapt to different sizes. In some applications, especially in the case of processing malicious code, the input image may have different sizes and proportions.
[0072] In order to solve this problem, in this embodiment, step S1 also includes normalizing the size of the byte feature image to adjust the byte feature image to a preset size.
[0073] Furthermore, in some preferred implementations of this embodiment, the size normalization processing method is a bilinear interpolation method.
[0074] Bilinear interpolation is a commonly used image processing technique for resizing images while maintaining detailed features in the image. It calculates the value of a new pixel based on linear interpolation between two adjacent pixels. For image scaling, the bilinear interpolation method can generate the value of a new pixel by calculating the weighted average of the four nearest neighboring pixels around the target pixel. During the image size normalization process, the bilinear interpolation method can resize the original image to a size that matches the fixed input size expected by the CNN model. In this way, no matter what the size of the original image is, it can be converted to the input size required by the model in order to effectively classify malicious code or other related tasks. Through image size normalization, the uniformity of the input image can be ensured, so that the model can better learn the characteristics of the malicious code and can better generalize to images of different sizes. This helps to improve the performance and accuracy of the model, and makes the model more robust and able to handle diverse input data.
[0075] Example 4
[0076] The assembly instructions of malicious code are an important text feature with contextual semantic information. When analyzing malicious code, understanding the sequence of these instructions can provide important clues about code execution flow, function calls and potential malicious behavior. Therefore, the present invention selects to extract the opcodes in the .asm file of the malicious code, and uses the N-grams method to capture the sequence characteristics of the malicious code opcodes.
[0077] An opcode is a part of an assembly instruction that represents a specific operation or function. By extracting the opcode of a malicious code, important information about the execution process of the malicious code can be obtained.
[0078] The difference from Examples 1-3 is that in this embodiment, the N-grams method is used to extract the opcode sequence features of the assembly language file, and the text of the opcode sequence is segmented into n consecutive items to capture the correlation and sequence information between the opcodes.
[0079] By using the N-grams method, a series of opcode sequences can be generated, where each sequence consists of n consecutive opcodes. These sequences can be used as feature representations of malicious code for training machine learning models or other analysis tasks. The N-grams method can capture the local dependencies between opcodes and provide more contextual information to the model, thereby improving the recognition and classification performance of malicious code. Examples of opcode sequences are shown in Table 1 (sequence data is only partially intercepted)
[0080] Table 1: Opcode sequence characteristics
[0081]
[0082] Example 5
[0083] The difference from Embodiment 1 is that, in this embodiment, step S2 includes:
[0084] Step S201: extracting multi-scale first image features from the byte feature image, inputting the first image features into the FFSE model, fusing local features and global features of different scales on the first image features to obtain second image features, stretching the second image features into a first feature sequence, cropping the first feature sequence to obtain a second feature sequence, and the second feature sequence is a spatial feature;
[0085] Step S202: Input the second feature sequence and the operation code sequence features into the BiTCN model for fusion to obtain a feature fusion sequence, where the operation code sequence features are semantic features, and the feature fusion sequence has both spatial and semantic features.
[0086] This embodiment adopts the FFSE model and the BiTCN model. The FFSE (Future Fusion-based Squeeze and Excitation) model is used for code graphical processing, and the BiTCN (Bidirectional Time Convolutional Network) model is used for text feature training and extracting contextual logical relationships.
[0087] like Figure 3 As shown in the figure, the FFSE model consists of a multi-scale image feature fusion module (FF) and a channel attention module (SE). The purpose of the FFSE model is to fuse features from different scales or different levels to extract feature representations with more representational capabilities and semantic information. In the FFSE model, the byte image feature X is input into the FF module, the image is multi-scale fused, and then the SE module assigns weights to each channel. Finally, the CRB module and the pooling module are used to achieve dimensionality reduction, simplify the data volume, and improve the operation efficiency.
[0088] Further, such as Figure 4 As shown, the multi-scale image feature fusion module (FF) includes multiple CRB modules.
[0089] Further, such as Figure 4 As shown in Figure 1, each CRB module includes a Conv2d convolutional layer, a ReLU activation function, and a BN layer connected in sequence.
[0090] The Conv2d convolution layer extracts spatial information from the input features through convolution operations and obtains multi-scale features of the image by selecting different convolution kernel sizes;
[0091] The ReLU activation function layer is used to introduce nonlinear transformation and enhance the expressiveness of features;
[0092] The BN layer is used to batch normalize the output of the convolutional layer to speed up the training process and improve the stability of the model.
[0093] This fusion of multi-scale features helps to improve the perception and robustness of the model, enabling it to better adapt to objects or image contents of different scales.
[0094] Further, such as Figure 5 As shown, the channel attention module (SE) implements the channel attention mechanism, which includes two stages: compression and excitation;
[0095] In the compression stage, the feature map of each channel is compressed into a scalar value through global average pooling operation to capture the global information of the channel; in the excitation stage, a feedforward neural network is used to generate the excitation weight of each channel by learning a nonlinear function. The excitation weight of each channel is multiplied by the scalar value obtained by the channel in the compression stage to generate a weighted feature representation of the channel.
[0096] Furthermore, the channel attention module adaptively learns the activation weights of each channel.
[0097] Example 6
[0098] The difference from Example 1-5 is that Figure 6 As shown, in this embodiment, the BiTCN model includes a first TCN module, a second TCN module, a CRD module, a pooling layer and a fully connected layer; wherein:
[0099] The first TCN module and the second TCN module are connected in parallel, and both are temporal convolutional networks;
[0100] The CRD module is connected to the back end of the first TCN module and the second TCN module. The CRD module includes a one-dimensional convolution (conv1d), a ReLU activation function, and a Dropout layer;
[0101] The CRD module, pooling layer and fully connected layer are connected in sequence.
[0102] The first TCN module and the second TCN module are used to process time series data. Further, in some preferred implementations of this embodiment, the feature fusion sequence is input into the first TCN module in a forward manner to obtain a first feature fusion sequence; and is input into the second TCN module in a reverse manner to obtain a second feature fusion sequence; the first feature fusion sequence and the second feature fusion sequence are then feature fused with the feature fusion sequence itself to obtain a feature fusion sequence after secondary fusion;
[0103] The feature fusion sequence after secondary fusion is pooled and stretched and reduced in dimension through the CRD module.
[0104] Among them, the forward method refers to inputting the feature ordering naturally formed by the feature fusion sequence, and the reverse method refers to inputting the feature ordering naturally formed in reverse.
[0105] Furthermore, both the first TCN module and the second TCN module include a number of causal dilated convolutional layers (TB), which can capture long-term dependencies and are not prone to gradient vanishing and gradient exploding problems.
[0106] Different dilation coefficients are used in each TB layer in the TCN module to achieve multi-scale feature extraction. A smaller dilation coefficient corresponds to a shorter time scale and is used to capture local detail features; a larger dilation coefficient corresponds to a longer time scale and can capture global contextual information.
[0107] Further, such as Figure 7 As shown, in some preferred implementations of this embodiment, the number of causal dilated convolution layers (TB) is 4, that is, the causal convolution TB of TCN is set to four layers, and the expansion coefficients of each layer are 1, 2, 4 and 8 respectively, to realize the expansion operation.
[0108] Further, such as Figure 8 As shown, each causal dilated convolutional layer (TB) includes two WCCRD layers, and a residual connection is introduced between the two WCCRD layers.
[0109] Furthermore, the WCCRD layer includes a regularization module, a one-dimensional convolution (conv1d), a cropping module, a ReLU activation function, and a Dropout layer, which are connected sequentially.
[0110] Example 7
[0111] The difference from Example 1-6 is that Fig. 9 As shown, in step S3, the feature fusion sequence is classified through a fully connected structure, and the fully connected structure includes a first fully connected layer, a first ReLU activation function, a first Dropout layer, a second fully connected layer, a second ReLU activation function, a second Dropout layer, and a third fully connected layer connected in sequence.
[0112] In some preferred implementations of this embodiment, the byte image features and operation code sequence features of the malicious code are used as input data, and the byte image feature X (3×256×256) is input into the FFSE model. After feature fusion, the image feature (4×51×51) is obtained, which is stretched into a feature sequence (1×10404), and then cropped (cropped) to cut off the redundant part behind it, thereby obtaining a vector space feature sequence (1×9834) to be fused with the operation code feature sequence Y (1×9834). After the feature sequence of the space vector is fused with the operation code feature sequence of the semantic vector, a feature fusion sequence (2×9834) is obtained, and the feature fusion sequence is input into the BiTCN model to obtain a vector containing 104864 neurons, and then fully connected for classification, and step by step from 104862→4096→512→9, and finally divided into 9 categories.
[0113] Furthermore, the first Dropout layer sets a first dropout value P1, and the second Dropout layer sets a second dropout value P2.
[0114] In some preferred implementation schemes of this embodiment, P1=P2=0.5, and the malicious codes are finally divided into 9 categories.
[0115] Example 8
[0116] In order to verify the effectiveness of a malware classification method based on deep learning, this embodiment designs an experiment for verification.
[0117] 1. Experimental Dataset
[0118] New power systems usually use computer control and network connections, which exposes them to security threats from malicious code. Malicious code may disrupt the normal operation of the power system by attacking the control software, network equipment or industrial control system of the power system, and even cause power outages or other serious consequences. Therefore, the data set in this embodiment mainly comes from the public data set provided by the Microsft Malicious Code Classification Challenge (BIG2015) on Kaggle. The BIG2015 challenge provides a pre-divided training set and verification set, in which the labels of the verification set are not public. Therefore, this embodiment only uses the training data set of BIG2015 to evaluate the performance of the model. The data set contains a total of 10,868 labeled malicious code samples, which are divided into nine malicious code families, and the specific classification is shown in Table 2. Each malicious code sample contains two files: a .bytes file represented in hexadecimal and a .asm file obtained by disassembling the malicious code binary file. Each malicious code file has an id (a 20-character hash value used to uniquely identify the file) and a category. In the experiment of this embodiment, 70% of the training set samples provided by the original challenge were divided into the training set of this embodiment, and 30% were divided into the validation set of this embodiment. The divided training set contains 7608 samples, and the validation set contains 3260 samples.
[0119] Table 2 Malware family categories
[0120]
[0121] The distribution of the malware BIG2015 training dataset is unbalanced. This data distribution is very consistent with real life, and sample distribution imbalances occur from time to time. For models used to handle malware classification, performance differences are very important when dealing with various types of malware. Only by using an unbalanced training dataset and combining it with appropriate evaluation metrics can we better evaluate the model's ability to accurately identify rare and common malware samples.
[0122] 2. Evaluation Indicators
[0123] In this embodiment, three indicators, namely accuracy, precision and F1-score, are used to evaluate the performance of the model in the field of malicious code classification. The calculation formulas of these indicators are as follows:
[0124]
[0125] Among them, TP represents positive samples correctly predicted as positive categories, FP represents negative samples incorrectly predicted as positive categories, FN represents positive samples incorrectly predicted as negative categories, and TN represents negative samples correctly predicted as negative categories.
[0126] 3. Experimental Setup
[0127] The experiment uses a 64-bit Windows 10 operating system, an Intel(R) Core(TM) i7-12700 CPU, 12GB of memory, an Nvidia GeForce GTX3060 GPU, a Python 3.7 compilation environment, and a Pytorch 1.10.1+cu111 deep learning framework. In order to verify the performance effectiveness of the model and each module of the model, this embodiment designs four comparative verification experiments.
[0128] (1) Grayscale image size selection
[0129] During data preprocessing, the byte file of the malicious code is converted into a grayscale image to extract its image features. However, the byte file sizes of the malicious code vary, so the size of the converted image is not uniform. The size of the CNN network input image is fixed, so it is necessary to select a suitable size for size normalization. Considering that the increase in image size will require more convolution operations, resulting in an increase in the number of parameters and a large consumption of computer resources, in order to determine the optimal size, a comparative experiment on the selection of input image size is required. Therefore, in this embodiment, seven different sizes of images, 16×16, 32×32, 64×64, 128×128, 256×256, 512×512 and 1024×1024, are selected for comparison (the unit here is pixel px), and the results are shown in Table 3.
[0130] Table 3 Comparative analysis of image sizes
[0131]
[0132] After experimental comparison, it can be seen that when the size of the malicious code image increases from 16px to 256px, the accuracy increases from 97.14% to 98.57%. However, when the image size increases further, the accuracy of the model decreases. There are two possible reasons:
[0133] 1. The number of samples does not increase with the size, and cannot cover the entire data space. The model will overfit some specific details of the training samples instead of the common details.
[0134] 2. The number of model parameters does not increase with the increase of input data dimension. The model is too simple and cannot capture more complex image features. Considering the above factors, 256px is finally selected as the target size for image size normalization.
[0135] (2) N-gram feature selection experiment
[0136] The N-grams algorithm is a language model based on statistics, which can capture contextual information between words and is widely used in tasks related to natural language processing. Therefore, the present invention uses the N-gram algorithm to extract the features of the opcodes in the malicious code, and the N value will also affect the accuracy of the model. For this reason, this embodiment uses the control variable method to compare the accuracy of the model when the N value is 2, 3, 4 and 5, and the experimental results are shown in Table 4.
[0137] Table 4 N value comparison experiment
[0138]
[0139] As can be seen from the table, when N is 4, the model accuracy is the highest; when N is greater than 4, the model accuracy decreases as the value of N increases. There are three reasons for the above phenomenon:
[0140] 1. When the value of N is greater than 4, the number of generated N-grams sequences will increase significantly. But in fact, many N-grams sequences rarely appear, which makes the training samples very sparse and it is difficult for the model to capture the statistical characteristics of rare sequences.
[0141] 2. As the value of N increases, the dimension of the feature space grows exponentially, but the number of samples is limited and cannot cover the entire feature space. The model cannot accurately learn the weights applicable to each N-gram sequence, resulting in overfitting.
[0142] 3. At the same time, a larger N value also limits the scope of the model's capture of contextual information. The model can only observe longer context sequences and cannot utilize shorter context information.
[0143] Experimental results show that when the model is applied to the malicious code classification task, the 4-grams algorithm can better extract the features of malicious code opcodes and achieve the effect of improving the accuracy of the model.
[0144] (3) Experiment on fusion and comparative analysis of image features and image sequence features
[0145] In order to improve the ability to extract information from data, the model uses the N-gram method to extract operand sequence features, uses bytecode to extract grayscale image features of malicious code, and then mixes the two. In order to verify the effectiveness of this method, this embodiment conducts a comparative experiment to compare grayscale image features and mixed features. The experimental results are shown in Table 5.
[0146] Table 5 Comparative analysis of features
[0147]
[0148] As can be seen from the table, compared with using grayscale image features alone, hybrid features have better performance in terms of accuracy, precision, and F1 value. Specifically, hybrid features improve 1.71%, 1.67%, and 1.72% relative to using bytecode features alone.
[0149] These experimental results show that the hybrid feature extraction method can more effectively capture the feature information of malicious code and produce a complementary effect. By combining the operand sequence features and grayscale image features, it is possible to better prevent the influence of malicious code obfuscation and packaging on detection, thereby obtaining better classification results. This confirms the effectiveness of the present invention.
[0150] (4) Performance comparison experiment with previous malicious code classification methods
[0151] The present invention is compared with other malicious code classification models in recent years. The experimental results are shown in Table 6.
[0152] Table 6 Comparison of experimental results of different model performances
[0153] As can be seen from the table, compared with other malicious code classification models, the malicious code classification model in this paper has achieved better results in accuracy, precision, F1 value and other indicators. This result shows that the fusion of the image features of the bytecode and the text sequence features of the .asm file is meaningful. Using only image features for training and classification will lose the contextual information between malicious codes, and using N-grams to extract the sequence features of the .asm file can be used as a supplement to achieve the effect of improving the accuracy of the model.
[0154] Accordingly, the malware classification method based on deep learning provided by the present invention has high reliability and convergence speed, and can improve the accuracy of malicious code family classification.
[0155] The above content describes the basic principles and advantages of the present invention. Practitioners in this industry should understand that the above description is only for the preferred embodiments of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of this application.
Claims
1. A malware classification method based on deep learning, characterized in that: The steps include: Step S1: Graphically process the byte file of the software to be identified, convert the pixel points of the grayscale image into a two-dimensional matrix, and generate a byte feature image; use bilinear interpolation to normalize the size of the byte feature image, and adjust the byte feature image to a preset size; use the N-grams method to extract the operation code sequence features of the assembly language file of the software to be identified, and divide the text of the operation code sequence into n consecutive items; Step S2: extracting multi-scale first image features from the byte feature image, inputting the first image features into a compression excitation network model based on feature fusion, fusing local features and global features of different scales on the first image features once to obtain second image features, stretching the second image features into a first feature sequence, cropping the first feature sequence to obtain a second feature sequence, and the second feature sequence is a spatial feature; The second feature sequence and the operation code sequence features are input into the bidirectional temporal convolutional network model for fusion to obtain a feature fusion sequence, the operation code sequence features are semantic features, and the feature fusion sequence has both spatial features and semantic features; Step S3: According to the feature fusion sequence, the software to be identified is classified through a fully connected structure, where the fully connected structure includes a first fully connected layer, a first ReLU activation function, a first Dropout layer, a second fully connected layer, a second ReLU activation function, a second Dropout layer, and a third fully connected layer connected in sequence, where the first Dropout layer sets a first dropout value, and the second Dropout layer sets a second dropout value.
2. The malware classification method based on deep learning according to claim 1, characterized in that: The process of converting the pixels of a grayscale image into a two-dimensional matrix is as follows: taking a byte file as input, cutting the binary sequence in the byte file into 8-bit subsequences, converting each subsequence into a decimal number in the range [0,255], and converting the formed one-dimensional decimal array into a two-dimensional array.
3. The malware classification method based on deep learning according to claim 2, characterized in that: In the process of cutting the binary sequence in the byte file into 8-bit subsequences, the strategy of reading by line and discarding the first eight digits is adopted to cut the starting address.
4. The malware classification method based on deep learning according to claim 1, characterized in that: The compression excitation network model based on feature fusion includes a multi-scale image feature fusion module and a channel attention module. The multi-scale image feature fusion module includes multiple CRB modules. Each CRB module includes a Conv2d convolution layer, a ReLU activation function and a BN layer connected in sequence. The Conv2d convolution layer extracts spatial information from the input features through convolution operations and obtains multi-scale features of the image by selecting different convolution kernel sizes; The ReLU activation function is used to introduce nonlinear transformation and enhance the expressiveness of features; The BN layer is used to batch normalize the output of the convolutional layer to speed up the training process and improve the stability of the model.
5. The malware classification method based on deep learning according to claim 4, characterized in that: The channel attention module adaptively learns the excitation weight of each channel. The channel attention module implements the channel attention mechanism, which includes two stages: compression and excitation. In the compression stage, the feature map of each channel is compressed into a scalar value through the global average pooling operation to capture the global information of the channel; In the excitation stage, a feedforward neural network is used to generate the excitation weight of each channel by learning a nonlinear function. The excitation weight of each channel is multiplied by the scalar value obtained by the channel in the compression stage to generate the weighted feature of the channel.
6. The malware classification method based on deep learning according to claim 1, characterized in that: The bidirectional temporal convolutional network model includes a first TCN module, a second TCN module, a CRD module, a pooling layer and a fully connected layer; wherein: The first TCN module and the second TCN module are connected in parallel, and both are temporal convolutional networks; The CRD module is connected to the back end of the first TCN module and the second TCN module. The CRD module includes a one-dimensional convolution, a ReLU activation function, and a Dropout layer. The CRD module, pooling layer and fully connected layer are connected in sequence.
7. The malware classification method based on deep learning according to claim 6, characterized in that: The feature fusion sequence is input into the first TCN module in a forward manner to obtain a first feature fusion sequence; Input it into the second TCN module in a reverse manner to obtain the second feature fusion sequence; The first feature fusion sequence and the second feature fusion sequence are then fused with the feature fusion sequence itself to obtain a feature fusion sequence after secondary fusion; The feature fusion sequence after secondary fusion is pooled and stretched and reduced in dimension through the CRD module.
8. The malware classification method based on deep learning according to claim 7, characterized in that: The first TCN module and the second TCN module both include a number of causal dilation convolutional layers.
9. The malware classification method based on deep learning according to claim 8, characterized in that: Each causal dilated convolutional layer consists of two WCCRD layers, and a residual connection is introduced between the two WCCRD layers.
10. The malware classification method based on deep learning according to claim 9, characterized in that: The WCCRD layer consists of a regularization module, a one-dimensional convolution, a cropping module, a ReLU activation function, and a Dropout layer connected sequentially.