Multilayer perceptron neural network optimization method and system for ransomware detection

Abstract

The invention belongs to the field of computer network security, and relates to a multilayer perceptron neural network optimization method and system for ransomware detection. According to the method, efficient detection and defense of ransomware are realized by optimizing the structure and parameter setting of a multi-layer perceptron neural network (MLP-NN). According to the main technical scheme, the method comprises the steps of designing a multi-layer sensor structure with progressively decreased neurons, and improving the generalization ability and the overfitting prevention ability of a model in combination with a Leaky ReLU activation function and a Dropout regularization technology; features are extracted through static and dynamic analysis, standardization processing is carried out, and dimension reduction is carried out through principal component analysis (PCA), so that the training efficiency of the model is improved; and adversarial training is introduced to enhance the robustness of the model to hostile attacks. The system can be widely applied to real-time ransomware detection of enterprise firewalls, network security equipment and personal computers, and the security protection capability of a network environment is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and in particular to a ransomware detection method and system based on multi-layer perceptron neural network (MLP-NN) optimization. Background Art

[0002] As ransomware attacks become increasingly rampant, traditional detection methods such as signature matching and behavioral analysis have been unable to cope with the complexity of new and variant ransomware. These traditional methods have a good detection effect on known threats, but their effectiveness is significantly reduced when facing unknown threats. The development of deep learning technology has provided a new direction for malware detection, especially multi-layer perceptron neural networks, which have shown great potential in malware detection due to their powerful nonlinear mapping capabilities. However, the current MLP-NN model still faces certain challenges in dealing with resource-constrained environments and complex network attacks in practical applications. Summary of the invention

[0003] This paper proposes a multi-layer perceptron neural network optimization method and system for ransomware detection. This method optimizes the network structure and parameter settings of MLP-NN so that it can still detect ransomware efficiently and accurately in a resource-constrained environment. Specific innovations include the following aspects:

[0004] 1. Network structure optimization: A multilayer perceptron architecture with decreasing neurons was designed. The three hidden layers contain 512, 256, and 128 neurons respectively. Leaky ReLU activation function and 30% Dropout regularization were used to improve generalization ability and reduce overfitting.

[0005] 2. Data preprocessing and feature extraction: Combine static analysis and dynamic analysis methods to extract features from the ransomware's file hash values, API call sequences, etc., and improve model training efficiency through standardization and PCA dimensionality reduction.

[0006] 3. Model training and optimization: Adopt Adam optimizer and cross entropy loss function, cooperate with dynamic learning rate adjustment and early stopping mechanism to optimize training. Introduce adversarial training to improve the robustness of the model against malicious attacks.

[0007] 4. System architecture design: The system includes data collection module, feature extraction module, model prediction module and result display module to achieve real-time ransomware detection and protection, and is suitable for a variety of network environments.

[0008] Through the above optimization methods, the MLP-NN model not only improves the detection ability of unknown ransomware, but also significantly improves the real-time performance and resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 A block diagram showing a multilayer perceptron neural network.

[0010] Figure 2 Flowchart for model training and optimization.

[0011] Figure 3 Shows the adversarial training flowchart.

[0012] Figure 4 A bar chart showing the performance of the MLP model compared to other models.

[0013] Figure 5 ROC curves of different models.

[0014] Figure 6 The confusion matrix for the MLP model is shown.

[0015] Figure 7 A bar chart comparing the performance of the MLP and CNN models.

[0016] Figure 8 A comparison of the ROC curves of the MLP and CNN models is shown.

[0017] Fig. 9 This is a comparison chart of the confusion matrix between the MLP and CNN models.

[0018] Fig.10 The performance comparison bar chart of the MLP model on different data sets.

[0019] Fig.11 The ROC curve comparison of the MLP model under different data sets is shown.

[0020] Fig.12 The confusion matrix of the MLP model under different datasets is shown. DETAILED DESCRIPTION

[0021] The method for implementing the present invention comprises the following steps:

[0022] 1. Dataset construction and feature extraction: Through data cleaning, feature extraction and PCA dimensionality reduction, standardized input feature data is obtained.

[0023] 2. Model design: Initialize the MLP model according to the designed three-layer hidden layer structure, and set appropriate activation functions and regularization parameters.

[0024] 3. Model training: Use the Adam optimizer to train the model, dynamically adjust the learning rate and use the early stopping mechanism to avoid overfitting. Introduce adversarial training to improve the robustness of the model under malicious attacks.

[0025] 4. System deployment: Integrate the trained model into the ransomware detection system and implement the entire process of data input, detection and result display through the API interface.

[0026] The present invention provides a ransomware detection system based on MLP-NN and an optimization method thereof, which effectively improves the accuracy and efficiency of detection and is particularly suitable for security protection in complex network environments.

Claims

1. A multi-layer perceptron neural network optimization method for ransomware detection, characterized in that: The following steps are involved: (1) Data preprocessing: Collect and standardize features such as network traffic, file behavior, and API calls, and use principal component analysis (PCA) to reduce the dimension of feature data; (2) Model initialization: Design a multi-layer perceptron (MLP) neural network, including an input layer, at least three hidden layers, and an output layer. The hidden layer uses the Leaky ReLU activation function, and the output layer uses the Softmax activation function. (3) Model training: Use the Adam optimizer for training, set the initial learning rate, and optimize the training process through the learning rate scheduler and early stopping mechanism; (4) Adversarial training: During the training process, the fast gradient sign method (FGSM) is used to generate adversarial samples, perturb the input data, and add the perturbed samples to the training set for adversarial training; (5) Model validation: The accuracy, precision, recall, and F1 value of the model are evaluated on the validation set to measure the performance of the model; (6) Model optimization: Combine Dropout and L2 regularization techniques to prevent model overfitting and further optimize model performance.

2. The multi-layer perceptron neural network optimization method for ransomware detection according to claim 1, characterized in that: The data preprocessing step includes: (1) Standardize the input features so that the feature values ​​are within the same range; (2) Use principal component analysis (PCA) technique to reduce the dimensionality of the data and retain 95% of the information.

3. The multi-layer perceptron neural network optimization method for ransomware detection according to claim 1, characterized in that: In the model training step, the optimizer used is the Adam optimizer, and the learning rate is dynamically adjusted in the later stage of model training through the learning rate scheduler.

4. A multi-layer perceptron neural network system for ransomware detection, comprising: (1) Data collection module: used to collect data such as network traffic, file behavior, and API calls; (2) Feature extraction module: used to extract features and standardize the collected data; (3) Multilayer perceptron neural network module: including an input layer, at least three hidden layers and an output layer. The hidden layers use the Leaky ReLU activation function, and the output layer uses the Softmax activation function. (4) Adversarial training module: used to generate adversarial samples and add them to the training set for training; (5) Prediction output module: used to output detection results and generate classification probabilities.

5. The multi-layer perceptron neural network system for ransomware detection according to claim 4, characterized in that: The feature extraction module combines static analysis and dynamic analysis to extract file hash values, API call sequences, etc., and performs dimensionality reduction through principal component analysis (PCA) technology.

Images