Malicious software detection method and device, equipment and storage medium

Abstract

The invention belongs to the technical field of network security, and particularly provides a malicious software detection method, device and equipment and a storage medium, and the method comprises the following steps: collecting malicious software sample data by using a web crawler technology; extracting static features of each malicious software sample to generate a data set, and dividing the data set into a training set and a test set; for each sample in the training set, using the feature vector and a preset model parameter to calculate a conditional probability through a Sigmoid function model to perform model training, and optimizing the model parameter through a minimization loss function to obtain a trained model; the trained model is evaluated through the feature vectors of the samples in the test set, model parameters are adjusted and optimized according to the evaluation result, and a malicious software detection model is obtained; and predicting the probability that the software is malicious software by using the malicious software detection model. The detection accuracy is improved, the false alarm rate and the missing report rate are reduced, and a more reliable safety guarantee is provided for a user.

Description

Background Art

[0002] Network security refers to the technology, methods and processes to protect computer systems and networks from unauthorized access, damage or tampering. Malware refers to software designed to damage users, systems or networks, steal information or perform other illegal acts in computer systems. In today's Internet environment, the threat of malware (such as viruses, Trojans, ransomware, etc.) is becoming increasingly severe, posing a major challenge to personal privacy, corporate data security and even national security. In order to effectively respond to these threats, malware detection technology has emerged.

[0003] Traditional malware detection methods, such as signature-based detection and heuristic detection, are effective to a certain extent, but they face limitations such as lagging signature library updates and difficulty in detecting unknown malware.

[0004] In recent years, machine learning technology has shown great application potential in various fields, especially in the security field. Malware detection methods based on machine learning have gradually become a research hotspot. Such methods can effectively identify known and unknown malware variants by automatically learning the behavior patterns and code features of malware, significantly improving the accuracy and timeliness of detection. However, related malware detection methods based on machine learning still have many shortcomings in feature extraction, model selection and training, such as limited model generalization ability and complex training process. These problems limit their effectiveness in practical applications. Summary of the invention

[0005] In view of the problems existing in the existing malware detection methods, the present invention provides a malware detection method, device, equipment and storage medium.

[0006] In a first aspect, the technical solution of the present invention provides a malware detection method, comprising the following steps: Use web crawler technology to collect malware sample data; Extract static features of each malware sample to generate a dataset, and divide the dataset into a training set and a test set; For each sample in the training set, the conditional probability is calculated using the sigmoid function model using the feature vector and preset model parameters to perform model training, and the model parameters are optimized by minimizing the loss function to obtain the trained model. The trained model is evaluated through the feature vectors of the samples in the test set and the model parameters are tuned according to the evaluation results to obtain the malware detection model; Use malware detection models to predict the probability that a piece of software is malware.

[0007] As a further limitation of the technical solution of the present invention, before the step of extracting static features of each malware sample to generate a data set and dividing the data set into a training set and a test set, the following steps are included: Clean and deduplicate the collected data.

[0008] As a further limitation of the technical solution of the present invention, the steps of extracting static features of each malware sample to generate a data set, and dividing the data set into a training set and a test set include: Extract static features of each malware sample; Label the static malicious samples corresponding to the static features; The labeled data set is divided into a training set and a test set, and each sample in the data set is set with a label.

[0009] As a further limitation of the technical solution of the present invention, the step of extracting the static features of each malware sample to generate a data set and dividing the data set into a training set and a test set includes: Store the cleaned, deduplicated and feature-extracted data in a database or file system.

[0010] As a further limitation of the technical solution of the present invention, in the step of marking the static malicious samples corresponding to the static features, the static features include file hash value, file size, and file type; The annotation content includes malicious type, threat level, and family information.

[0011] As a further limitation of the technical solution of the present invention, for each sample in the training set, the steps of calculating the conditional probability through the Sigmoid function model using the feature vector and the preset model parameters to perform model training, and optimizing the model parameters by minimizing the loss function to obtain the trained model include: For each sample in the training set, the dot product of the feature vector and the preset model parameters is used as the input of the Sigmoid function model to obtain the probability value; For each sample in the training set, its label and feature vector are used to calculate the value of the loss function; the loss function is minimized by the optimization algorithm to update the model parameters to obtain the trained model.

[0012] As a further limitation of the technical solution of the present invention, the step of updating the model parameters to obtain the trained model by minimizing the loss function through the optimization algorithm includes: For each model parameter, its gradient on the loss function is calculated, and the model parameter is updated using the learning rate and the average gradient of all training samples. After reaching the set number of training times, the trained model is obtained.

[0013] In a second aspect, the technical solution of the present invention further provides a malware detection device, including a sample data collection module, a data set generation module, a model training module, a model evaluation module and a detection module; A sample data collection module, used to collect malware sample data using web crawler technology; A data set generation module is used to extract static features of each malware sample to generate a data set, and divide the data set into a training set and a test set; The model training module is used to calculate the conditional probability of each sample in the training set using the feature vector and the preset model parameters through the Sigmoid function model for model training, and optimize the model parameters by minimizing the loss function to obtain the trained model; The model evaluation module is used to evaluate the trained model through the feature vectors of the samples in the test set and to tune the model parameters according to the evaluation results to obtain the malware detection model; A detection module is used to predict the probability that a software is malware using a malware detection model.

[0014] As a further limitation of the technical solution of the present invention, the device also includes a data preprocessing module for cleaning and deduplicating the collected data.

[0015] As a further limitation of the technical solution of the present invention, the data set generation module includes a feature extraction unit, a labeling unit and a data set division unit; A feature extraction unit, used to extract static features of each malware sample; A labeling unit, used to label static malicious samples corresponding to static features; The data set partitioning unit is used to partition the labeled data set into a training set and a test set, and each sample in the data set is set with a label.

[0016] As a further limitation of the technical solution of the present invention, the device also includes a storage module for storing the cleaned, deduplicated and feature-extracted data in a database or a file system.

[0017] As a further limitation of the technical solution of the present invention, the static features include file hash value, file size, and file type; The annotation content includes malicious type, threat level, and family information.

[0018] As a further limitation of the technical solution of the present invention, the model training module includes a probability value calculation unit, a loss function calculation unit and a parameter optimization unit; A probability value calculation unit is used to use the dot product of the feature vector and the preset model parameters as the input of the Sigmoid function model for each sample in the training set to obtain a probability value; A loss function calculation unit, used to calculate the value of the loss function for each sample in the training set using its label and feature vector; The parameter optimization unit is used to update the model parameters by minimizing the loss function through the optimization algorithm to obtain the trained model.

[0019] As a further limitation of the technical solution of the present invention, the parameter optimization unit is specifically used to calculate the gradient of each model parameter on the loss function, and use the learning rate and the gradient average of all training samples to update the model parameter, and obtain the trained model after reaching the set number of training times.

[0020] In a third aspect, the technical solution of the present invention also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; the memory stores computer program instructions executable by the at least one processor, and the computer program instructions are executed by the at least one processor so that the at least one processor can execute the malware detection method as described in the first aspect.

[0021] In a fourth aspect, the technical solution of the present invention further provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions enable the computer to execute the malware detection method as described in the first aspect.

[0022] It can be seen from the above technical solutions that the present invention has the following advantages: the web crawler technology is used to widely collect malware sample data, and the static features of each sample are extracted to ensure the diversity and representativeness of the data set. This comprehensive feature extraction method can more accurately characterize the behavior pattern of malware and lay a solid foundation for subsequent model training. The feature vector and the preset model parameters are directly used to calculate the conditional probability through the Sigmoid function model for model training. The Sigmoid function can quickly converge to the optimal solution due to its simple, efficient and easy-to-implement characteristics, thereby improving the efficiency of model training. At the same time, the model parameters are optimized by minimizing the loss function to ensure that the trained model has excellent classification performance. The trained model is evaluated using samples in the test set, and the model parameters are tuned according to the evaluation results to obtain the optimal malware detection model. This flexible evaluation and tuning mechanism can ensure the accuracy and stability of the model in practical applications. The trained malware detection model can quickly and accurately predict the probability that the software is malware, and effectively respond to various known and unknown malware threats. This method not only improves the accuracy of detection, but also reduces the false alarm rate and the false negative rate, providing users with more reliable security protection.

[0023] In addition, the invention has a reliable design principle, a simple structure and a very broad application prospect. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 is a schematic flow chart of a method according to an embodiment of the present invention.

[0026] Figure 2 is a schematic block diagram of an apparatus according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] like Figure 1 As shown, an embodiment of the present invention provides a malware detection method, comprising the following steps: Step 1: Collect malware sample data using web crawler technology; In this step, malware sample data is collected from various sources (e.g., malware sample libraries, malicious websites, security forums, etc.) using web crawlers and other technologies.

[0029] Clean and deduplicate the collected data to ensure the quality and uniqueness of the data and remove duplicate samples and bad data.

[0030] Step 2: Extract static features of each malware sample to generate a dataset, and divide the dataset into a training set and a test set; In this step, the static features of each malware sample are obtained through file parsing and feature extraction tools. In some embodiments, the labeled data set is divided into a training set, a validation set, and a test set according to a certain ratio (such as 7:1:2). The training set is used for model training and learning; the validation set is used for model parameter adjustment and performance evaluation; and the test set is used for the final evaluation of the generalization ability and performance of the model. When dividing the data set, ensure that the data distribution and annotation of each subset are as close as possible to the overall data set to avoid bias.

[0031] The cleaned, deduplicated and feature-extracted data is stored in a database or file system to facilitate subsequent model training and data analysis.

[0032] Step 3: For each sample in the training set, the conditional probability is calculated using the sigmoid function model using the feature vector and preset model parameters to perform model training, and the model parameters are optimized by minimizing the loss function to obtain the trained model; Step 4: Evaluate the trained model using the feature vectors of the samples in the test set and tune the model parameters based on the evaluation results to obtain a malware detection model; Step 5: Use the malware detection model to predict the probability that the software is malware.

[0033] In some embodiments, the steps of extracting static features of each malware sample to generate a data set and dividing the data set into a training set and a test set include: Step 21: Extract static features of each malware sample; Step 22: Label the static malicious samples corresponding to the static features; Step 23: Divide the labeled data set into a training set and a test set, and each sample in the data set is assigned a label.

[0034] Static features include file hash value, file size, and file type; The annotation content includes malicious type, threat level, and family information.

[0035] In some embodiments, for each sample in the training set, the steps of calculating the conditional probability using the sigmoid function model to perform model training, and optimizing the model parameters by minimizing the loss function to obtain the trained model include: Step 31: For each sample in the training set, the dot product of the feature vector and the preset model parameters is used as the input of the Sigmoid function model to obtain the probability value; For each malware sample and non-malware sample, extract a feature vector 𝑥. These features may include the file’s metadata (such as file size, creation date, modification date, etc.), the hash value of the file content, the results of static analysis, etc.

[0036] Each sample has a label 𝑦, 𝑦=1 for malware samples and 𝑦=0 for non-malware samples.

[0037] Given the parameter 𝜃 and input feature 𝑥, the Sigmoid function is used to calculate the probability that the sample is a positive example (malware). The formula is as follows: ; The dot product 𝜃𝑇𝑥 of the feature vector 𝑥 and the model parameter 𝜃 is used as the input of the Sigmoid function to obtain the probability value .

[0038] The output of the Sigmoid function is used to represent the probability that a sample is a positive example (malware) or a negative example (non-malware) given feature 𝑥.

[0039] formula: ; For each sample, the conditional probability is calculated using its feature vector 𝑥 and model parameters 𝜃.

[0040] Step 32: For each sample in the training set, use its label and feature vector to calculate the value of the loss function; the loss function is used to measure the accuracy of the model prediction, and the model parameters are optimized by minimizing the loss function.

[0041] ; For each sample in the training set, use its label 𝑦 𝑖 and the eigenvector 𝑥 𝑖 To calculate the value of the loss function.

[0042] Step 33: Update the model parameters by minimizing the loss function through the optimization algorithm to obtain the trained model.

[0043] This loss function is minimized through optimization algorithms (such as gradient descent). Specifically, for each model parameter, its gradient on the loss function is calculated, and the model parameter is updated using the learning rate and the average gradient of all training samples. After reaching the set number of training times, the trained model is obtained.

[0044] Use the gradient descent algorithm to update the model parameters 𝜃 to minimize the loss function.

[0045] Parameter update formula:

[0046] For each parameter 𝜃 𝑗 , calculate its gradient on the loss function, and update the parameter using the learning rate 𝛼 and the average of the gradients of all training samples. represents the 𝜃 of the sth iteration 𝑗 value, represents the 𝜃 of the s+1th iteration 𝑗 value, here 𝑥 𝑖 (𝑗) Denotes the 𝑗th eigenvalue of the 𝑖th sample.

[0047] After training is complete, the model is evaluated using a test set or new, unseen examples.

[0048] For each new sample, use its feature vector 𝑥 and the trained model parameters 𝜃 to calculate the probability that it is malware through the Sigmoid function .

[0049] According to the set threshold ( ), determine whether the sample is malware.

[0050] Through the above steps and formulas, we can use the logistic regression model to detect malicious files.

[0051] The trained logistic regression model has five features (the dimension of the feature vector is 5). The model parameters after training and optimization can be expressed as follows:

[0052] Among them, θ 0 is the bias term, θ 1 to θ 5 is the weight corresponding to each feature.

[0053] The parameter values ​​after training are as follows:

[0054] In this example: θ 0 =−0.5 is the bias term; θ 1 =1.2 is the weight of the first feature; θ 2 =−0.8 is the weight of the second feature; θ 3 =0.3 is the weight of the third feature; θ 4 =2.1 is the weight of the fourth feature; θ 5 =−1.7 is the weight of the fifth feature; When using an independent validation set for model validation, assume that the feature matrix of the validation set is and the true label as follows:

[0055]

[0056] Import the necessary libraries: First, the code imports the numpy library for efficient numerical computing, especially array and matrix operations.

[0057] Next, four functions, accuracy_score, precision_score, recall_score, and f1_score, are imported from sklearn.metrics to evaluate the performance of the classification model.

[0058] Define the Sigmoid function: A function called sigmoid is defined, which accepts an input z (usually the output of a linear model) and returns the result calculated by the Sigmoid function. The Sigmoid function compresses any real value into the interval (0, 1) and is often used as an activation function for binary classification problems.

[0059] Prepare the data: The feature matrix X_val of the validation set is defined, which is a two-dimensional array containing multiple features of multiple samples.

[0060] The true label y_val of the validation set is defined, which is a one-dimensional array containing the true category (0 or 1) corresponding to the samples in X_val.

[0061] A one-dimensional array 𝜃 is defined, which contains the parameters of the model, including the bias term and the weights of each feature. These parameters are learned by the model through the training process.

[0062] In order to use the bias term in the model calculation, an array of all 1s is added to the left side of X_val. In this way, the bias term will be taken into account as a feature when the output of the linear model is subsequently calculated.

[0063] Use the np.dot function to calculate the dot product of X_val (including the bias term) and 𝜃 to get the output z of the linear model.

[0064] Pass z as input to the sigmoid function and calculate the predicted probability y_pred_prob that each sample belongs to category 1.

[0065] By comparing y_pred_prob with the threshold 0.5, the predicted probability is converted to a specific category (0 or 1). If the predicted probability is greater than 0.5, the sample is considered to belong to category 1; otherwise, the sample is considered to belong to category 0.

[0066] Use the accuracy_score function to calculate the accuracy of the model prediction, that is, the proportion of correctly predicted samples to the total number of samples.

[0067] Use the precision_score function to calculate the precision, that is, the ratio of the number of samples correctly predicted as category 1 to the number of samples predicted as category 1.

[0068] The recall_score function is used to calculate the recall rate, which is the ratio of the number of samples correctly predicted as category 1 to the number of samples actually in category 1.

[0069] Use the f1_score function to calculate the F1 score, which is the harmonic average of precision and recall and is used to comprehensively evaluate the performance of the model.

[0070] The calculation results are: Accuracy: 0.90 Precision: 0.92 Recall: 0.88 F1-score: 0.90 Finally, the calculated accuracy, precision, recall, and F1 scores are formatted as strings and printed out. These indicators provide quantitative criteria for evaluating the performance of the model.

[0071] The above steps and parameter value examples show how to validate the trained logistic regression model and calculate evaluation metrics to assess model performance.

[0072] like Figure 2 As shown, an embodiment of the present invention further provides a malware detection device, including a sample data collection module, a data set generation module, a model training module, a model evaluation module and a detection module; A sample data collection module, used to collect malware sample data using web crawler technology; A data set generation module is used to extract static features of each malware sample to generate a data set, and divide the data set into a training set and a test set; The model training module is used to calculate the conditional probability of each sample in the training set using the feature vector and the preset model parameters through the Sigmoid function model for model training, and optimize the model parameters by minimizing the loss function to obtain the trained model; The model evaluation module is used to evaluate the trained model through the feature vectors of the samples in the test set and to tune the model parameters according to the evaluation results to obtain the malware detection model; A detection module is used to predict the probability that a software is malware using a malware detection model.

[0073] In some embodiments, the device also includes a data preprocessing module to clean and deduplicate the collected data.

[0074] In some embodiments, the data set generation module includes a feature extraction unit, a labeling unit, and a data set partitioning unit; A feature extraction unit, used to extract static features of each malware sample; A labeling unit, used to label static malicious samples corresponding to static features; The data set partitioning unit is used to partition the labeled data set into a training set and a test set, and each sample in the data set is set with a label.

[0075] In some embodiments, the device further includes a storage module for storing the cleaned, deduplicated and feature-extracted data in a database or a file system.

[0076] Static features include file hash value, file size, and file type; The annotation content includes malicious type, threat level, and family information.

[0077] In some embodiments, the model training module includes a probability value calculation unit, a loss function calculation unit, and a parameter optimization unit; A probability value calculation unit is used to use the dot product of the feature vector and the preset model parameters as the input of the Sigmoid function model for each sample in the training set to obtain a probability value; A loss function calculation unit, used to calculate the value of the loss function for each sample in the training set using its label and feature vector; The parameter optimization unit is used to update the model parameters by minimizing the loss function through the optimization algorithm to obtain the trained model.

[0078] In some embodiments, the parameter optimization unit is specifically used to calculate the gradient of each model parameter on the loss function, and use the learning rate and the average gradient of all training samples to update the model parameter, and obtain the trained model after reaching a set number of training times.

[0079] The embodiment of the present invention also provides an electronic device, which includes: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus. The communication bus can be used for information transmission between the electronic device and the sensor. The processor can call the logic instructions in the memory to execute the following method: Step 1: Collect malware sample data using web crawler technology; Step 2: Extract the static features of each malware sample to generate a data set, and divide the data set into a training set and a test set; Step 3: For each sample in the training set, use the feature vector and preset model parameters to calculate the conditional probability through the Sigmoid function model to perform model training, and optimize the model parameters by minimizing the loss function to obtain the trained model; Step 4: Evaluate the trained model through the feature vector of the sample in the test set and tune the model parameters according to the evaluation results to obtain a malware detection model; Step 5: Use the malware detection model to predict the probability that the software is malware.

[0080] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program code.

[0081] An embodiment of the present invention provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions enable a computer to execute the method provided by the above method embodiment, for example, including: Step 1: Collect malware sample data using web crawler technology; Step 2: Extract static features of each malware sample to generate a data set, and divide the data set into a training set and a test set; Step 3: For each sample in the training set, use feature vectors and preset model parameters to calculate conditional probability through a Sigmoid function model to perform model training, and optimize the model parameters by minimizing the loss function to obtain the trained model; Step 4: Evaluate the trained model through the feature vectors of the samples in the test set and tune the model parameters according to the evaluation results to obtain a malware detection model; Step 5: Use the malware detection model to predict the probability that the software is malware.

[0082] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0083] The embodiment of the malware detection device provided in the embodiment of the present invention belongs to the same inventive concept as the malware detection method of the above-mentioned embodiments. For details not described in detail in the embodiment of the malware detection device, reference can be made to the embodiment of the above-mentioned malware detection method.

[0084] The malware detection device is a unit and algorithm step of each example described in combination with the embodiments disclosed in this document, and can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0085] Those skilled in the art will appreciate that various aspects of the malware detection method can be implemented as a system, method or program product. Therefore, various aspects of the present disclosure can be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which can be collectively referred to as "circuits", "modules" or "systems".

[0086] Although the present invention has been described in detail with reference to the accompanying drawings and in combination with the preferred embodiments, the present invention is not limited thereto. Without departing from the spirit and essence of the present invention, a person of ordinary skill in the art may make various equivalent modifications or substitutions to the embodiments of the present invention, and these modifications or substitutions shall be within the scope of the present invention. Any person of ordinary skill in the art may easily think of changes or substitutions within the technical scope disclosed by the present invention, and these shall be within the scope of protection of the present invention.

Claims

1. A malware detection method, characterized in that: The steps include: Use web crawler technology to collect malware sample data; Extract static features of each malware sample to generate a dataset, and divide the dataset into a training set and a test set; For each sample in the training set, the conditional probability is calculated using the sigmoid function model using the feature vector and preset model parameters to perform model training, and the model parameters are optimized by minimizing the loss function to obtain the trained model. The trained model is evaluated by the feature vectors of the samples in the test set and the model parameters are tuned according to the evaluation results to obtain the malware detection model; Use malware detection models to predict the probability that a piece of software is malware.

2. The malware detection method according to claim 1, characterized in that: The steps of extracting static features of each malware sample to generate a dataset and dividing the dataset into a training set and a test set include: Clean and deduplicate the collected data.

3. The malware detection method according to claim 2, characterized in that: The steps of extracting static features of each malware sample to generate a dataset and dividing the dataset into a training set and a test set include: Extract static features of each malware sample; Label the static malicious samples corresponding to the static features; The labeled data set is divided into a training set and a test set, and each sample in the data set is set with a label.

4. The malware detection method according to claim 3, characterized in that: The steps of extracting static features of each malware sample to generate a dataset and dividing the dataset into a training set and a test set include: Store the cleaned, deduplicated and feature-extracted data in a database or file system.

5. The malware detection method according to claim 4, characterized in that: In the step of marking the static malicious samples corresponding to the static features, the static features include file hash value, file size, and file type; The annotation content includes malicious type, threat level, and family information.

6. The malware detection method according to claim 5, characterized in that: For each sample in the training set, the steps of calculating the conditional probability using the sigmoid function model using the feature vector and the preset model parameters to train the model, and optimizing the model parameters by minimizing the loss function to obtain the trained model include: For each sample in the training set, the dot product of the feature vector and the preset model parameters is used as the input of the Sigmoid function model to obtain the probability value; For each sample in the training set, its label and feature vector are used to calculate the value of the loss function; the loss function is minimized by the optimization algorithm to update the model parameters to obtain the trained model.

7. The malware detection method according to claim 6, characterized in that: The steps of updating the model parameters to obtain the trained model by minimizing the loss function through the optimization algorithm include: For each model parameter, its gradient on the loss function is calculated, and the model parameter is updated using the learning rate and the average gradient of all training samples. After reaching the set number of training times, the trained model is obtained.

8. A malware detection device, characterized in that: It includes sample data collection module, data set generation module, model training module, model evaluation module and detection module; A sample data collection module, used to collect malware sample data using web crawler technology; A data set generation module is used to extract static features of each malware sample to generate a data set, and divide the data set into a training set and a test set; The model training module is used to calculate the conditional probability of each sample in the training set using the feature vector and the preset model parameters through the Sigmoid function model for model training, and optimize the model parameters by minimizing the loss function to obtain the trained model; The model evaluation module is used to evaluate the trained model through the feature vectors of the samples in the test set and to tune the model parameters according to the evaluation results to obtain the malware detection model; A detection module is used to predict the probability that a software is malware using a malware detection model.

9. An electronic device, characterized in that: The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; the memory stores computer program instructions that can be executed by the at least one processor, and the computer program instructions are executed by the at least one processor so that the at least one processor can execute the malware detection method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions enable the computer to execute the malware detection method according to any one of claims 1 to 7.

Images