Malicious software classification method and device

Abstract

The invention discloses a malicious software classification method and device, and a specific embodiment of the method comprises the steps: obtaining an initial image feature and an initial text feature of a malicious software file based on the to-be-classified malicious software file; inputting the initial image features and the initial text features into a pre-trained software classification model for information interaction to obtain target image features and target text features; the software classification model obtains a first classification result based on the target image features; and the software classification model obtains a second classification result based on the target text features, and based on the first classification result and the second classification result, obtaining a classification result of the malicious software sample. Therefore, the malicious software classification accuracy is fully improved.

Description

Technical Field

[0001] The present invention belongs to the field of network and software security technology, and in particular relates to a malware classification method and device. Background Art

[0002] Malware refers to various programs that perform malicious tasks on computer systems, including viruses, worms, Trojans, backdoors, ransomware, etc. The purpose of these software is usually to disrupt software processes, implement control, interrupt the normal operation of user devices, or cause harm to them.

[0003] With the rapid development of malware, the task of malware classification is growing exponentially. Currently commonly used detection methods cannot meet the classification requirements in terms of detection accuracy or efficiency, and an urgent solution is needed.

[0004] At present, conventional malware classification methods mainly rely on feature matching. Most of these methods build detection models based on known malware files, aiming to capture similar threat patterns. However, due to their reliance on historical cases, they are unable to obtain good recognition results when faced with malware that is only slightly different from existing samples or is completely new, and their classification effect on unknown types of malware is poor.

[0005] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0006] The present invention provides a malware classification method and device; the method fully improves the accuracy of malware classification.

[0007] To achieve the above-mentioned purpose, according to a first aspect of an embodiment of the present application, a method for classifying malware is provided, the method comprising: based on a malware file to be classified, obtaining initial image features and initial text features of the malware file; Inputting the initial image features and the initial text features into a pre-trained software classification model for information interaction to obtain target image features and target text features; The software classification model obtains a first classification result based on the target image feature; and the software classification model obtains a second classification result based on the target text feature; A classification result of the malware file is obtained based on the first classification result and the second classification result.

[0008] Optionally, obtaining the initial image features and initial text features of the malware file based on the malware file to be classified includes: Based on the bytes file and the asm file of the malware file, obtaining an image expression and a text expression of the malware file; Inputting the image expression into a pre-trained image feature extraction model to obtain the initial image feature; The text expression is input into a pre-trained text feature extraction model to obtain the initial text features.

[0009] Optionally, obtaining the image expression and text expression of the malware file based on the bytes file and the asm file of the malware file includes: Convert the bytes file and the asm file into binary representations respectively to obtain a binary file of the bytes file and a binary file of the asm file; Convert the binary files of the bytes file and the asm file into decimal numbers ranging from 0 to 255, with each byte containing 8 bits of binary numbers; Based on the decimal numbers converted from the bytes file and the asm file, the decimal numbers are expressed as different degrees of image chromaticity, and the image expressions corresponding to the bytes file and the asm file are obtained; Sort the opcodes in the text segment of the asm file by the number of occurrences; Based on the sorting result, selecting a target opcode with the highest number of occurrences of a preset number; Based on the target operation code, the number of occurrences of the target operation code and the prefix prompt, a textual expression of the malware file is obtained.

[0010] Optionally, the image feature extraction model is a visual Transformer model, and the text feature extraction model is a BERT model.

[0011] Optionally, the inputting the initial image features and the initial text features into a pre-trained software classification model for information interaction to obtain target image features and target text features includes: Inputting the initial image features into an image decoder of the software classification model, and inputting the initial text features into a text decoder of the software classification model; The image decoder and the text decoder perform information interaction between the initial image features and the initial text features based on a cross attention mechanism to obtain target image features and target text features.

[0012] Optionally, the image vector output by the image decoder and the text vector output by the text decoder perform information interaction using a cross attention mechanism, including: The image vector output by the image decoder is passed as the Key and Value to the cross-attention layer of the text decoder, and the output of the text decoder is used as the Query vector; the text vector output by the text decoder is passed as the Query vector and Value to the cross-attention layer of the image decoder, and the output of the text decoder is used as the Key.

[0013] Optionally, the software classification model obtains a first classification result based on the target image feature, including: Inputting the target image feature into a first classifier of the software classification model to obtain a first classification result; The software classification model obtains a second classification result based on the target text feature, including: The target text feature is input into the second classifier of the software classification model to obtain a second classification result.

[0014] Optionally, the method further comprises: training the software classification model, wherein the training method of the software classification model comprises: Based on the preset malware file, initial sample image features and initial sample text features are obtained; Inputting the initial sample image features and the initial sample text features into the software classification model to be trained for information interaction, thereby obtaining target sample image features and target sample text features; The software classification model to be trained obtains a first sample classification result based on the target sample image feature; and the software classification model obtains a second sample classification result based on the target sample text feature; The software classification model is trained based on the first sample classification result, the second sample classification result and the cross entropy loss function, wherein L2 regularization is added to the cross entropy loss function and an AdamW optimizer is used.

[0015] To achieve the above-mentioned purpose, according to a second aspect of an embodiment of the present application, a malware classification method and device is further provided, the device comprising: a feature extraction module, configured to obtain initial image features and initial text features of the malware file based on the malware file to be classified; An information interaction module, used for inputting the initial image features and the initial text features into a pre-trained software classification model for information interaction, so as to obtain target image features and target text features; A preliminary classification module, used for the software classification model to obtain a first classification result based on the target image feature; and the software classification model to obtain a second classification result based on the target text feature; A result output module is used to obtain a classification result of the malware file based on the first classification result and the second classification result.

[0016] To achieve the above-mentioned purpose, according to a third aspect of an embodiment of the present application, a computer-readable medium is further provided, on which a computer program is stored, and when the program is executed by a processor, the method described in the first aspect is implemented.

[0017] Compared with the prior art, an embodiment of the present invention provides a malware classification method and device, which includes: first, based on the malware file to be classified, obtaining the initial image features and initial text features of the malware file. Secondly, inputting the initial image features and initial text features into a pre-trained software classification model for information interaction to obtain target image features and target text features. Afterwards, the software classification model obtains a first classification result based on the target image features; and the software classification model obtains a second classification result based on the target text features. Finally, based on the first classification result and the second classification result, a classification result of the malware file is obtained. Therefore, by converting the malware file into an image representation form and a text representation form, and performing information interaction between the two expressions during the feature extraction process, the feature information contained in the split is fully considered, and the features of the malware can be learned more comprehensively, thereby improving the accuracy of malware classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Hereinafter, some specific embodiments of the present invention will be described in detail in an exemplary and non-limiting manner with reference to the accompanying drawings. The same reference numerals in the accompanying drawings indicate the same or similar components or parts. It should be understood by those skilled in the art that these drawings are not necessarily drawn to scale. In the accompanying drawings: Figure 1 Schematic diagram of the malware classification method provided for this application Figure 1 ; Figure 2 Schematic diagram of the malware classification method provided for this application Figure 2 ; Figure 3 For this application Figure 2 A flowchart of obtaining the image expression and text expression of the malware file; Figure 4 A structural diagram of an image feature extraction module and a text feature extraction module of the malware classification method provided in this application; Figure 5 Model structure diagram of the malware classification method provided for this application; Figure 6 A schematic diagram of the structure of a malware classification method and device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, features and advantages of the present invention more obvious and easy to understand, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0020] The main solution of the embodiment of the present application is to convert the preset malware file into an image representation form and a text representation form.

[0021] In the process of feature extractor for image representation and text representation, a cross attention mechanism is introduced to interact the image information and text information, so as to obtain the image features and text features after interaction.

[0022] The image features and text features are input into their respective classifiers to obtain their respective classification results.

[0023] Finally, according to the classification results corresponding to the image features and text features, the final classification results of malware classification are obtained.

[0024] With the rapid development of Internet technology, security threats to various network devices are increasing. Malware refers to software that is installed and run on a user's computer or other terminal without explicit notification or permission from the user, thereby infringing on the user's legitimate rights and interests.

[0025] At present, conventional malware detection methods mainly rely on feature matching, behavioral analysis, and heuristic analysis. Most of these methods build detection models based on known malware files, aiming to capture similar threat patterns. However, due to their reliance on historical cases, they are unable to obtain good recognition results when faced with malware that is only slightly different from existing samples or is completely new, and their detection effect on unknown types of malware is poor.

[0026] In summary, this application achieves fast and accurate detection of malware by converting malware into image representation and text representation and using deep learning models of image and text classification. Compared with traditional malware detection models, this application learns the characteristics of malware and then detects malware based on the characteristics of malware, thereby expanding the scope of identification and improving the accuracy of malware classification.

[0027] Figure 1 Schematic diagram of the malware classification method provided for this application Figure 1 ,like Figure 1 As shown, the method includes: S101. Based on the malware file to be classified, initial image features and initial text features of the malware file are obtained.

[0028] Exemplarily, the execution subject of this embodiment may be an electronic device, or a terminal device, or a server, or an apparatus or device that can execute the solution of this embodiment, and there is no limitation on this.

[0029] It can be understood that the initial image features and the initial text features are the conversion of the malware file (executable file) into an image expression form (grayscale image) and a text expression form (understandable text language).

[0030] S102, inputting the initial image features and the initial text features into the information interaction part of the software classification model for information interaction, and obtaining target image features and target text features; It is understandable that there may be ambiguity between the initial image features and the initial text features. For example, a simple image may have multiple interpretations, and the corresponding initial text may also have semantic ambiguity. After obtaining the target features through information interaction, this ambiguity can be reduced. The information interaction between the initial image features and the initial text features can be carried out through the Transformer's cross-attention mechanism (Cross-Attention), that is, the target image features and the target text features are used as the input of the Transformer Decoder model, and the Cross-Attention is used to interact with different modal features, and the classification features with the characteristics of each modality are output. When the initial image features and the initial text features interact, the cross-attention mechanism Cross-Attention can accurately find the correlation between the image and the text. It helps to form a more comprehensive feature representation of the image and text. For the acquisition of target image features and target text features, Cross-Attention does not process image and text features in isolation, but integrates the information of both in the interaction process. The features obtained in this way contain multimodal information, taking into account both the visual information of the image and the semantic information of the text, so that the model has a deeper understanding of the input data.

[0031] S103: Input the target image features and the target text features into the classification part of the software classification model to obtain a first classification result corresponding to the target image features and a second classification result corresponding to the target text features.

[0032] Exemplarily, image features and text features of different modalities are independently classified using fully connected layers and pooling operations.

[0033] By obtaining the first classification result corresponding to the target image feature and the second classification result corresponding to the target text feature, and then obtaining the final classification result based on these two results, this method avoids the one-sidedness of a single result, and can make a trade-off and comprehensive judgment based on the classification results of different features, thereby improving the reliability of classification.

[0034] S104: Obtain a classification result of the malware file based on the first classification result and the second classification result.

[0035] Exemplarily, the first classification result and the second classification result may be preset classification labels or classification scores, and different classification scores correspond to different classification types. The fusion of the first classification result and the second classification result may be achieved through a voting mechanism, weighted average, or a more complex ensemble learning method. For example, if the classifications of the two classification results are consistent, the credibility of the category can be increased; if they are inconsistent, a certain strategy can be adopted to determine the final classification, such as selecting a classification result with a higher confidence.

[0036] In this embodiment, the initial image features and initial text features of the malware file are obtained at the same time, which can comprehensively consider the characteristics of the malware in many aspects. The image features may include visual information such as the global texture features, texture color, shape space, etc. of the software, and the text features may include text information such as the operation code, operation sequence, and comments in the software code. Combining the two can more comprehensively describe the characteristics of the malware and improve the accuracy of classification compared to classification methods that rely only on a single type of feature.

[0037] The initial image features and the initial text features interact with each other to obtain the target image features and the target text features. This process can make the two features complement each other. For example, some patterns in the image features may be associated with specific code segments in the text features. By mining this association through information interaction, the complex behavior patterns of malware can be better identified, making up for the limitations that may exist in a single feature. Different types of malware may have different performances in image features or text features. This method of comprehensively considering the classification results of the two features can better adapt to the diversity of malware. For other malware, the code text may be obfuscated, but the image features have abnormal patterns. By combining the classification results of the two, various malware can be more effectively dealt with.

[0038] The first classification result corresponding to the target image feature and the second classification result corresponding to the target text feature are obtained respectively, and then the final classification result of the malware file is obtained based on these two results. This method of combining multiple classification results can reduce the error of a single classification result. If there is a misjudgment in the image feature classification part, the text feature classification part may provide different results. The overall classification accuracy can be improved through reasonable comprehensive methods (such as voting, weighted average, etc.).

[0039] Figure 2 Schematic diagram of the malware classification method provided for this application Figure 2 ,like Figure 2 As shown, the method includes: S201. Based on the bytes file and the asm file of the malware file, obtain an image expression and a text expression of the malware file.

[0040] Exemplarily, the execution subject of this embodiment may be an electronic device, or a terminal device, or a server, or an apparatus or device that can execute the solution of this embodiment, and there is no limitation on this.

[0041] Understandably, in malware analysis, bytes files usually refer to the binary code files of malware, which contain the machine language instructions of the malware, which are directly executable by the computer processor. Asm files are assembly code files generated during the reverse engineering process, which are human-readable versions of binary codes and help analysts understand the functions and behaviors of malware.

[0042] For example, the contents of bytes files and asm files are not text contents, so they cannot be opened with ordinary text editors. For bytes files and asm files, the frequency of occurrence of each byte value (0 - 255) can be counted. Then, the byte stream is converted into pixel values ​​in a certain order, and these pixels are arranged into an image, and an image that can reflect the characteristics of the file's byte content can be obtained.

[0043] In one example, if Figure 3 As shown, the above step S201 may include: S301, convert the binary files of the bytes file and the asm file into decimal numbers ranging from 0 to 255, with each byte containing 8 bits of binary numbers; The malware file is first converted into a hexadecimal bytes file and an asm file is obtained by disassembling, and then the converted bytes file and asm file are converted into binary representations respectively to obtain a binary file of the bytes file and a binary file of the asm file; S302, based on the decimal numbers obtained by converting the bytes file and the asm file respectively, representing different degrees of image chromaticity, obtaining image expressions corresponding to the bytes file and the asm file respectively; The bytes file and the asm file are converted into picture expressions respectively, that is, the picture expressions of two files are obtained in this step, the picture expression corresponding to the bytes file and the picture expression corresponding to the asm file.

[0044] S303, sorting the operation codes in the text segment in the asm file according to the number of occurrences; The operation codes may be arranged in ascending order according to the number of occurrences or in descending order according to the number of occurrences of the operation codes.

[0045] S304, based on the sorting result, selecting the target operation code with the highest number of occurrences of a preset number; Among them, if the operation codes are arranged in ascending order according to the number of occurrences, a preset number of operation codes are selected from the end of the queue to the front as the target operation codes; similarly, if the operation codes are arranged in descending order according to the number of occurrences, a preset number of operation codes are selected from the beginning of the queue to the back as the target operation codes; S305: Obtain a textual expression of the malware file based on the target operation code, the number of occurrences of the target operation code, and the prefix prompt.

[0046] Among them, according to the target opcode, the number of occurrences of the target opcode and the prefix prompt, the opcode is translated into an understandable text language according to the full English name of the assembly instruction, and a complete and understandable text language is output in combination with the number of opcodes and the prefix prompt.

[0047] In this embodiment, the assembly language instruction library can be used to match the opcode and the number of opcode occurrences of the code segment of each text segment in the asm folder, and the opcodes of the asm file can be arranged in descending order according to the number of opcode occurrences. The opcodes and the number of opcode occurrences in the preset number (K) of asm files are intercepted, and the opcodes are translated into understandable text language according to the full English name of the assembly instruction, and the complete and understandable text language is output in combination with the number of opcodes and the prefix prompt. Convert the bytes file and the asm file into binary representation, convert it into a decimal number from 0 to 255 with a byte containing 8 bits of binary numbers, express it as different degrees of image chromaticity, and output grayscale images of fixed length and width respectively. The assembly instructions in the asm file are directly sorted in the original order, and unnecessary comments and blank lines are removed to obtain a concise assembly instruction sequence text. This text can reflect the operation logic of the malware at the assembly level. In this way, the asm file can be semantically analyzed, key operation information can be extracted, and then this information can be expressed in an understandable text form.

[0048] S202: Input the image expression into a pre-trained image feature extraction model to obtain initial image features.

[0049] For example, the image feature extraction model can be a visual Transformer model, which applies the Transformer architecture originally used for natural language processing (NLP) to the field of computer vision. ViT regards images as a series of sequence data and uses a self-attention mechanism to process the dependencies between pixels.

[0050] S203: Input the text expression into a pre-trained text feature extraction model to obtain initial text features.

[0051] Exemplarily, the text feature extraction model can be a BERT model. The BERT model uses the Transformer encoder structure and can capture the bidirectional contextual information of words in the text. This means that the model can consider both the previous and following words when predicting a word, thereby understanding the semantics of the word more accurately.

[0052] S204, inputting the initial image features into the image decoder of the software classification model, and inputting the initial text features into the text decoder of the software classification model; S205, the image decoder and the text decoder perform information interaction between the initial image features and the initial text features based on the cross attention mechanism to obtain the target image features and the target text features.

[0053] Among them, the initial image features and initial text image features can be cleaned and standardized before being input into the image decoder and the text decoder. For example, the image features are normalized, the image representation (grayscale image) is scaled to 224*224 in length and width, and the text length is fixed to 200. For the text features, operations such as stem extraction and stop word removal are performed to reduce unnecessary text information and improve processing efficiency.

[0054] It is understandable that the image decoder and text decoder are the Transformer Decoder modules divided into an image decoder (Image-Decoder) specifically for images and a text decoder (Text-Decoder) specifically for texts. This design allows the model to focus more on the characteristics of each modality, while achieving cross-modal information interaction through the cross-attention mechanism.

[0055] like Figure 4 As shown, Figure 4 The structure of the image feature extraction module and the text feature extraction module of the malware classification method provided in this application. The image decoder and the text decoder include the following basic components: LayerNormalization layer: used to standardize the output of each sub-layer, which helps the stability of model training and accelerates convergence. Self-Attention layer: In the decoder, the Self-Attention layer usually contains a masking mechanism (Masked Self-Attention) to prevent the model from paying attention to the parts that have not appeared too early when generating sequences. Forward propagation layer (Feed-Forward Neural Network): further nonlinear transformation of the output of the Self-Attention layer. Residual connection: adding the input of each sub-layer directly to the output helps the smooth propagation of the gradient and alleviates the gradient disappearance problem in deep networks.

[0056] In this step, the image decoder and the text decoder use the cross-attention mechanism to allow the initial image features and the initial text features to interact with each other. The cross-attention mechanism enables the image decoder to pay attention to the relevant information in the text features when processing the image features, and the text decoder to pay attention to the relevant information in the image features when processing the text features. Through this information interaction, the target image features and target text features are finally obtained. These two target features may better reflect the relationship between the image and the text, which helps the software classification model to perform more accurate classification and other subsequent operations.

[0057] In an example, the above step S205 may include: The image vector output by the image decoder is passed to the cross-attention layer of the text decoder as the Key and Value, and the output of the text decoder is used as the Query vector; the text vector output by the text decoder is passed to the cross-attention layer of the image decoder as the Query vector and Value, and the output of the text decoder is used as the Key.

[0058] Among them, in the attention mechanism of Transformer, the Key is used together with the Query vector to calculate the attention score. The Key can be regarded as a set of feature vectors used to represent certain features or semantic information at different positions in the input sequence. For example, when processing the encoding of a sentence, the encoded representation of each word can be used as the Key, and these Keys will be dot-producted with the Query vector to determine the relevance of each word to the current query. Once the attention score is calculated by the Query vector and the Key, these scores will be used to weight the sum of the Value. For example, the Value may contain the actual semantic information or feature representation of each position in the input sequence. After calculating the attention weight, the Value will be combined according to the weight to obtain the final attention output, which will integrate the information in the input sequence related to the current query. The Query vector is used to interact with the Key. For example, when the decoder generates the output, the Query vector may represent the information that the model is currently querying, and by calculating the relevance with the Key output of the encoder, the appropriate information can be obtained from the Value to generate the next word or sequence element.

[0059] In this example, the image decoder uses image features as keys and text features as query vectors, while the text decoder uses text features as keys and image features as query vectors. In this way, the influence of position encoding on Query and Key can be utilized in the Attention mechanism while maintaining the semantic purity of Value. Position encoding is performed in the form of Query vectors and Keys of each modality in Attention, while abandoning Value for position encoding. This increases learnable position training parameters, learns independent position information, and releases the potential of absolute position encoding in multimodality.

[0060] S206, inputting the target image feature into the first classifier of the software classification model to obtain a first classification result; inputting the target text feature into the second classifier of the software classification model to obtain a second classification result.

[0061] Among them, by processing the target image features and the target text features respectively, the software classification model can integrate information from different modalities (image and text). This multimodal processing method can classify software more comprehensively. The first classifier specializes in processing image features, and the second classifier specializes in processing text features. This design allows each classifier to be optimized for its own input data type. For example, the first classifier can use a convolutional neural network structure suitable for image feature extraction and classification, while the second classifier can use a recurrent neural network or Transformer structure suitable for text processing, thereby improving the accuracy of classification.

[0062] S207: Obtain a classification result of the malware file based on the first classification result and the second classification result.

[0063] Exemplarily, this step refers to the above step S104 and will not be described in detail.

[0064] like Figure 5 As shown, Figure 5 The model structure diagram of the malware classification method provided in this application, the malware classification process includes: feature extraction stage, information interaction stage and malware classification stage. In the feature extraction stage, the ViT model and the BERT model are used to extract the initial image features and the initial text features respectively. In the information interaction stage, the Transformer structure based on Cross-Attention performs information interaction on different modal features, and outputs the target image features with text features and the target text features with image features respectively. In the software classification stage, the features of each modality are input into their respective classifiers to obtain the final classification results.

[0065] In this embodiment, by obtaining image expressions and text expressions from bytes files and asm files of malware files, multiple feature forms of malware can be comprehensively utilized. This multimodal information utilization method avoids the information limitations caused by relying only on a single type of feature (such as text only or image only), thereby more comprehensively characterizing the characteristics of malware. The information contained in the image expression and the text expression is complementary. For example, the image expression may more intuitively reflect the structural pattern of the malware, while the text expression may contain semantic information of a specific operation code. The combination of the two can complement each other's missing information and improve the understanding and classification accuracy of malware. Using pre-trained image feature extraction models and text feature extraction models, the knowledge obtained by pre-training these models on a large amount of data can be utilized. This helps to effectively extract representative initial image features and initial text features in the case of limited malware file data, reducing the need to train feature extraction models from scratch for large-scale malware files. The image decoder and the text decoder interact with each other based on the cross-attention mechanism, and can dynamically focus on the relevant parts between image features and text features. This mechanism can effectively integrate the initial image features and the initial text features to obtain the target image features and the target text features, so that the classification model can better utilize the correlation information between the two modal features for classification. The first classification result is obtained by inputting the target image features into the first classifier, and the second classification result is obtained by inputting the target text features into the second classifier, and then the two are combined to obtain the final classification result. This dual classifier setting can classify malware from different angles, and when the final results are combined, they can verify and complement each other, thereby improving the reliability of the classification results.

[0066] In one example, the malware classification method provided by the present application further includes: training a software classification model, wherein the training method of the software classification model may include the following process: Based on the preset malware file, initial sample image features and initial sample text features are obtained; Inputting the initial sample image features and the initial sample text features into the software classification model to be trained for information interaction, thereby obtaining the target sample image features and the target sample text features; The software classification model to be trained obtains a first sample classification result based on the target sample image feature; and the software classification model obtains a second sample classification result based on the target sample text feature; Based on the first sample classification result, the second sample classification result and the preset classification loss function, the software classification model is trained, wherein L2 regularization is added to both the image classification loss function and the text classification loss function, and the AdamW optimizer is used.

[0067] Exemplarily, the malware file can use the train in the BIG2015 dataset as experimental data, and use the cross validation method to re-divide the train into training data and test data. The BIG2015 dataset is a dataset of the malware classification challenge held by Microsoft, which contains samples of multiple malware families. Each sample in the dataset usually includes a hexadecimal representation file of binary content (.bytes) and a disassembled file (.asm). Leave-Pair-Out Cross-Validation is a cross-validation technique that divides the dataset into k pairs of samples, each pair of samples contains a training sample and a test sample. In this validation method, each sample is used exactly once for training and once for testing.

[0068] In this example, two multi-classification cross entropy losses are used in the training phase to reduce the difference between the predicted results and the true labels of different modal data. The image multi-classification loss function And text multi-classification loss function For image multi-classification problems, the cross entropy loss function measures the difference between the model's predicted probability distribution and the true label probability distribution. In image classification tasks, the cross entropy loss function can effectively encourage the model to learn the correct classification. The cross entropy loss function is also applicable in text multi-classification.

[0069] Adding L2 regularization to the loss function helps prevent model overfitting in image multi-classification tasks, so that the model weights will not be too large. For example, when a convolutional neural network (CNN) is used for image classification, regularization can prevent the weights of the convolutional layer and the fully connected layer from becoming too large, resulting in overfitting of the training data. Adding L2 regularization to text multi-classification helps prevent model overfitting. A text classification model may contain a word embedding layer, a recurrent neural network (RNN) layer, or a Transformer layer. L2 regularization can control the size of the weights in these layers to prevent the model from overfitting to noise in the training data.

[0070] AdamW is an improvement on the Adam optimizer. The Adam optimizer combines the advantages of the adaptive gradient algorithm (Adagrad) and momentum (Momentum), and can adaptively adjust the learning rate. AdamW adds weight decay (Weight Decay) on the basis of Adam, which helps to further prevent model overfitting and accelerate model convergence. In the text multi-classification task, the AdamW optimizer can also take advantage of its adaptive adjustment of learning rate and weight decay. That is to say, L2 regularization is used to prevent model overfitting, and the optimizer uses AdamW weight decay to accelerate model convergence. The final loss function is expressed as: .

[0071] It is worth noting that when training the software classification model to be trained, the parameters of the image feature extraction model and the text feature extraction model are fixed until the software classification model converges.

[0072] In this example, after the software classification model is trained, the performance of the trained software classification model is evaluated using test data. Accuracy and F1 (Macro-F1) are used as evaluation indicators to measure model performance. Accuracy refers to the proportion of samples correctly predicted by the model to the total number of samples. It is an intuitive and easy-to-interpret performance indicator, especially suitable for data sets with relatively balanced category distribution. The F1 score is the harmonic mean of precision and recall, which comprehensively considers the accuracy and completeness of the model. The value range of the F1 score ranges from 0 to 1, where 1 represents perfect precision and recall. In machine learning, the F1 score is an important performance indicator, especially when dealing with data sets with imbalanced positive and negative samples, it can balance the accuracy and recall of the model and avoid over-focusing on one indicator. Accuracy and F1 scores (especially Macro-F1) are important evaluation indicators for measuring model performance, which can reflect the prediction ability of the model from different angles. Especially when dealing with category imbalance problems, the F1 score provides a more comprehensive performance evaluation.

[0073] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0074] like Figure 6 FIG. 6 is a schematic diagram of a malware classification method and apparatus according to an embodiment of the present invention. A malware classification method and apparatus, the apparatus 600 comprises: A feature extraction module 601 is used to obtain initial image features and initial text features of the malware file based on the malware file to be classified; An information interaction module 602 is used to input the initial image features and the initial text features into the information interaction part of the software classification model to perform information interaction, so as to obtain target image features and target text features; A preliminary classification module 603 is used to input the target image features and the target text features into the classification part of the software classification model to obtain a first classification result corresponding to the target image features and a second classification result corresponding to the target text features; The result output module 604 is used to obtain a classification result of the malware file based on the first classification result and the second classification result.

[0075] In a preferred embodiment, the feature extraction module includes: a file conversion module, an image feature extraction module and a text feature extraction module. The file conversion module is used to determine the bytes file and the asm file of the malware file; obtain the image expression of the malware file based on the bytes file; and obtain the text expression of the malware file based on the asm file. The image feature extraction module is used to input the image expression into a pre-trained image feature extraction model to obtain initial image features. The text feature extraction module is used to input the text expression into a pre-trained text feature extraction model to obtain initial text features.

[0076] In a preferred embodiment, the file conversion module is used to sort the opcodes in the text segment of the asm file according to the number of occurrences; based on the sorting result, select the target opcode with the highest number of occurrences of a preset number; based on the target opcode, the number of occurrences of the target opcode and the prefix prompt, obtain the text expression of the malware file.

[0077] In a preferred embodiment, the image feature extraction module is used to input the image expression into a pre-trained visual Transformer model to obtain initial image features. The text feature extraction module is used to input the image expression into a pre-trained BERT model to obtain initial text features.

[0078] In a preferred embodiment, the information interaction module includes an image decoder and a text decoder; the information interaction module is used to input the initial image features into the image decoder and the initial text features into the text decoder; the image vector output by the image decoder and the text vector output by the text decoder use a cross-attention mechanism to interact with each other to obtain target image features and target text features.

[0079] In a preferred embodiment, the information interaction module is used to pass the image vector output by the image decoder as the Key and Value to the cross-attention layer of the text decoder, and the output of the text decoder is used as the Query vector; the text vector output by the text decoder is passed as the Query vector and Value to the cross-attention layer of the image decoder, and the output of the text decoder is used as the Key.

[0080] In a preferred embodiment, the preliminary classification module includes a first classification module and a second classification module. The first classification module is used to input the target image features into the first classifier of the software classification model to obtain a first classification result; the second classification module is used to input the target text features into the second classifier of the software classification model to obtain a second classification result.

[0081] In a preferred embodiment, the device also includes a training module, which is used to train a software classification model, wherein the training method of the software classification model includes: based on a preset malware file, obtaining initial sample image features and initial sample text features of the malware file; inputting the initial sample image features and the initial sample text features into the information interaction part of the software classification model for information interaction to obtain target sample image features and target sample text features; inputting the target sample image features and the target sample text features into the classification part of the software classification model to obtain a first sample classification result corresponding to the sample target image feature and a second sample classification result corresponding to the target text feature; based on the first sample classification result, the first sample classification result and a preset classification loss function, the software classification model is trained.

[0082] In a preferred embodiment, the preset classification loss function includes an image classification loss function and a text classification loss function. During the software classification model training process, the training module is used to add L2 regularization to both the image classification loss function and the text classification loss function, and use the AdamW optimizer.

[0083] The above device can execute the malware classification method provided by an embodiment of the present invention, and has the function modules and beneficial effects corresponding to the malware classification method. For technical details not described in detail in this embodiment, please refer to the malware classification method provided by an embodiment of the present invention.

[0084] The present invention also provides an electronic device, comprising: a processor; a memory for storing executable instructions of the processor; the processor is used to read the executable instructions from the memory and execute the instructions to implement the malware classification method described in the present invention.

[0085] In addition to the above-mentioned methods and devices, an embodiment of the present application may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the method according to various embodiments of the present application described in the above-mentioned "Exemplary Method" section of this specification.

[0086] The computer program product may be written in any combination of one or more programming languages ​​to write program codes for performing the operations of the embodiments of the present application, including object-oriented programming languages, such as Java, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0087] In addition, an embodiment of the present application may also be a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor executes the steps of the method according to the following embodiments of the present application described in the above "Exemplary Method" section of this specification.

[0088] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0089] The basic principles of the present application are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present application are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present application. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, not for limitation, and the above details do not limit the present application to being implemented by adopting the above specific details.

[0090] The block diagrams of the devices, apparatuses, equipment, and systems involved in this application are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagram. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including", "comprising", "having", etc. are open words, referring to "including but not limited to", and can be used interchangeably with them. The words "or" and "and" used here refer to the words "and / or" and can be used interchangeably with them, unless the context clearly indicates otherwise. The words "such as" used here refer to the phrase "such as but not limited to", and can be used interchangeably with them.

[0091] It should also be noted that in the apparatus, device and method of the present application, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present application.

[0092] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present application. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present application. Therefore, the present application is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0093] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present application to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

[0094] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0095] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0096] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A malware classification method, characterized in that: The method comprises: Based on the malware file to be classified, obtaining initial image features and initial text features of the malware file; Inputting the initial image features and the initial text features into a pre-trained software classification model for information interaction to obtain target image features and target text features; The software classification model obtains a first classification result based on the target image feature; and the software classification model obtains a second classification result based on the target text feature; A classification result of the malware file is obtained based on the first classification result and the second classification result.

2. The method according to claim 1, characterized in that The step of obtaining the initial image features and the initial text features of the malware file based on the malware file to be classified includes: Based on the bytes file and the asm file of the malware file, obtaining an image expression and a text expression of the malware file; Inputting the image expression into a pre-trained image feature extraction model to obtain the initial image feature; The text expression is input into a pre-trained text feature extraction model to obtain the initial text features.

3. The method according to claim 2, characterized in that The step of obtaining the image expression and text expression of the malware file based on the bytes file and the asm file of the malware file includes: Convert the bytes file and the asm file into binary representations respectively to obtain a binary file of the bytes file and a binary file of the asm file; Convert the binary files of the bytes file and the asm file into decimal numbers ranging from 0 to 255, with each byte containing 8 bits of binary numbers; Based on the decimal numbers converted from the bytes file and the asm file, the decimal numbers are expressed as different degrees of image chromaticity, and the image expressions corresponding to the bytes file and the asm file are obtained; Sort the opcodes in the text segment of the asm file by the number of occurrences; Based on the sorting result, selecting a target opcode with the highest number of occurrences of a preset number; Based on the target operation code, the number of occurrences of the target operation code and the prefix prompt, a textual expression of the malware file is obtained.

4. The method according to claim 2, characterized in that: The image feature extraction model is a visual Transformer model, and the text feature extraction model is a BERT model.

5. The method according to claim 1, characterized in that The step of inputting the initial image features and the initial text features into a pre-trained software classification model for information interaction to obtain target image features and target text features includes: Inputting the initial image features into an image decoder of the software classification model, and inputting the initial text features into a text decoder of the software classification model; The image decoder and the text decoder perform information interaction between the initial image features and the initial text features based on a cross attention mechanism to obtain target image features and target text features.

6. The method according to claim 5, characterized in that The image vector output by the image decoder and the text vector output by the text decoder use a cross attention mechanism to perform information interaction, including: The image vector output by the image decoder is passed as the Key and Value to the cross-attention layer of the text decoder, and the output of the text decoder is used as the Query vector; the text vector output by the text decoder is passed as the Query vector and Value to the cross-attention layer of the image decoder, and the output of the text decoder is used as the Key.

7. The method according to claim 1, characterized in that The software classification model obtains a first classification result based on the target image feature, including: Inputting the target image feature into a first classifier of the software classification model to obtain a first classification result; The software classification model obtains a second classification result based on the target text feature, including: The target text feature is input into the second classifier of the software classification model to obtain a second classification result.

8. The method according to claim 1, characterized in that The method further comprises: training the software classification model, wherein the training method of the software classification model comprises: Based on the preset malware file, initial sample image features and initial sample text features are obtained; Inputting the initial sample image features and the initial sample text features into the software classification model to be trained for information interaction, thereby obtaining target sample image features and target sample text features; The software classification model to be trained obtains a first sample classification result based on the target sample image feature; and the software classification model obtains a second sample classification result based on the target sample text feature; The software classification model is trained based on the first sample classification result, the second sample classification result and the cross entropy loss function, wherein L2 regularization is added to the cross entropy loss function and an AdamW optimizer is used.

9. A malware classification device, characterized in that: The device comprises: A feature extraction module, used for obtaining initial image features and initial text features of the malware file based on the malware file to be classified; An information interaction module, used for inputting the initial image features and the initial text features into a pre-trained software classification model for information interaction, so as to obtain target image features and target text features; A preliminary classification module, used for the software classification model to obtain a first classification result based on the target image feature; and the software classification model to obtain a second classification result based on the target text feature; A result output module is used to obtain a classification result of the malware file based on the first classification result and the second classification result.

10. A computer readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method according to any one of claims 1 to 8.

Images