Malicious code APT classification method and system based on large model hyper-parameter adaptive selection

Abstract

The invention relates to the technical field of computer security, in particular to a malicious code APT classification method and system based on large model hyper-parameter adaptive selection, and the method comprises the steps: collecting malicious code data for APT classification detection, carrying out the preprocessing of the malicious code data, and obtaining the key features of malicious codes; constructing sample data for APT classification detection according to the malicious code key features; constructing an instruction fine tuning prompt template, performing multi-round iterative instruction fine tuning training on the large language model by using the instruction fine tuning prompt template and through a hyper-parameter adaptive selection mechanism to obtain an optimal hyper-parameter combination, and performing fine tuning on the open-source pre-trained large language model by using sample data for APT classification detection based on the optimal hyper-parameter combination to obtain an open-source pre-trained large language model. Obtaining a target model; and inputting the malicious code to be classified and identified into the target model, and obtaining the APT organization category to which the code belongs by utilizing the target model. According to the method, the optimal hyper-parameter combination can be intelligently and accurately selected in a low computing power consumption mode, and the accuracy of the APT classification model is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a malicious code APT classification method and system based on large model hyperparameter adaptive selection. Background Art

[0002] As a key task in the field of network security, the classification of malicious code APT (Advanced Persistent Threat) is essential for protecting network systems and data from advanced persistent threats. However, in the process of achieving efficient and accurate APT classification, the selection of hyperparameters has become a challenging problem. Traditional hyperparameter selection methods often rely on researchers' subjective judgment or time-consuming grid search, which not only leads to inefficiency but also causes huge resource consumption. Especially when dealing with large-scale network data and complex models, the limitations of traditional methods are more prominent.

[0003] To overcome this problem, academia and industry have explored automatic hyperparameter selection methods, aiming to automatically determine the optimal hyperparameter combination through algorithms to improve the performance and generalization ability of the model. However, the application of these methods is limited in special scenarios such as malicious code attribution analysis. The complexity and non-Gaussian distribution characteristics of malicious code make automatic hyperparameter selection methods based on Gaussian priors or other simple assumptions no longer applicable. Malicious code has a variety of behavior patterns, attack methods, and variants, and often exhibits nonlinear and non-stationary characteristics, which makes it difficult for traditional automatic hyperparameter selection methods to accurately capture its internal laws and leads to performance degradation. Therefore, for the hyperparameter selection problem of malicious code APT classification tasks, an innovative adaptive selection scheme that can adapt to the complexity and non-Gaussian distribution characteristics of malicious code is needed to intelligently explore the hyperparameter space and improve the accuracy and efficiency of the classification model. Summary of the invention

[0004] To this end, the present invention provides a malicious code APT classification method and system based on large model hyperparameter adaptive selection, combined with the large model fine-tuning of LORA and P-TUNING technology, through an intelligent adaptive mechanism, it can intelligently and accurately select the best hyperparameter combination in a low computing power consumption manner, so as to significantly improve the accuracy of the APT classification model.

[0005] According to the design scheme provided by the present invention, on the one hand, a malicious code APT classification method based on large model hyperparameter adaptive selection is provided, comprising:

[0006] Collect malicious code data for APT classification detection, preprocess the malicious code data and obtain key features of the malicious code, so as to construct sample data for APT classification detection based on the key features of the malicious code, wherein the preprocessing includes labeling of the organization to which the APT belongs, code disassembly, code feature extraction and feature screening;

[0007] Construct an instruction fine-tuning prompt template, use the instruction fine-tuning prompt template and perform multiple rounds of iterative instruction fine-tuning training on the large language model through a hyperparameter adaptive selection mechanism to obtain the best hyperparameter combination, the instruction fine-tuning prompt template is used to prompt the large language model to generate a prediction representation of the APT organization category to which the malicious code data belongs based on the prefix prompt word, and the hyperparameter adaptive selection mechanism is used to adaptively select the best hyperparameter combination for the malicious code APT classification task in the hyperparameter space, the hyperparameter space is composed of a prefix prompt word length candidate set and a rank value candidate set, and the rank is a fine-tuning parameter set according to the basic model weight matrix;

[0008] Based on the optimal hyperparameter combination, the open source pre-trained large language model is fine-tuned using sample data for APT classification detection. The malicious code to be classified and identified is input into the target model, and the target model is used to obtain the APT organization category to which the malicious code to be classified and identified belongs.

[0009] As a malicious code APT classification method based on large model hyperparameter adaptive selection of the present invention, further, the malicious code data is preprocessed and the key features of the malicious code are obtained, including:

[0010] Using a disassembly tool to disassemble the malicious code data and extract code features from the malicious code data, the code features including code software genes, code strings, code import table functions, code metadata, and code functions;

[0011] The score of each code feature is calculated based on the frequency of occurrence of the code feature, the amount of malicious code data where the code feature is located, and the number of APT organizations to which it belongs. The key features of the malicious code are selected based on the code feature score.

[0012] As the malicious code APT classification method based on large model hyperparameter adaptive selection of the present invention, further, the code feature score calculation formula is expressed as: Among them, #apt is the number of APT organizations where the code feature is located, #count is the total number of times the code feature appears in all malicious code data, and #samples is the number of malicious code data where the code feature is located.

[0013] As a malicious code APT classification method based on large model hyperparameter adaptive selection of the present invention, further, using instruction fine-tuning prompt templates and performing multiple rounds of iterative instruction fine-tuning training on the large language model through a hyperparameter adaptive selection mechanism, it includes:

[0014] Using natural language and dynamic data to set the prompt word template for the APT classification detection task, using the APT organization label as the prompt answer, the natural language is used to describe the dynamic data, prompt questions and prompt answers, and the dynamic data uses the same key-value pairs to describe the key features of the same type of malicious code;

[0015] The training set data and evaluation set data are extracted from the sample data for APT classification detection according to a preset ratio, the training set data is input into the prompt word template, a mask is added to the prompt answer and a prefix prompt word with a mask is generated, the large language model is trained for multiple rounds of iterations using the training set data and the prefix prompt word and a hyperparameter adaptive selection mechanism, and the evaluation data set is used to obtain the classification accuracy of the corresponding hyperparameter combination of the large language model, so as to obtain the optimal hyperparameter combination of the large language model.

[0016] As a malicious code APT classification method based on large model hyperparameter adaptive selection of the present invention, further, the hyperparameter combination of the best malicious code APT classification task is adaptively selected in the hyperparameter space, including:

[0017] Generate a prefix cue word length candidate set and a rank value candidate set based on powers of 2, and combine the two candidate sets through a Cartesian product operation to generate different hyperparameter combination schemes, so as to construct a hyperparameter space using the different hyperparameter combination schemes;

[0018] A priority queue is constructed based on the hyperparameter combination scheme. In the priority queue, each hyperparameter combination scheme is used as an element in the queue. The current optimal element is selected from the head of the priority queue with a specified probability for weight calculation, and an element is randomly selected from the priority queue with another specified probability for weight evaluation.

[0019] The training set and evaluation set are randomly extracted in a small ratio from the sample data used for APT classification detection. After iterative training on the training set, the evaluation set is evaluated to obtain the accuracy of the corresponding elements. The element weight is updated according to the accuracy of the element at the current time and the evaluation frequency until the model converges and the optimal hyperparameter combination is determined.

[0020] As the malicious code APT classification method based on large model hyperparameter adaptive selection of the present invention, further, the weight update formula of each element in the queue is expressed as: in,, is the weight of the i-th element at time t, r t is the actual accuracy of the element at time t, ni (t) is the number of times the element is selected for weight evaluation up to time t.

[0021] As a malicious code APT classification method based on large model hyperparameter adaptive selection of the present invention, further, based on the optimal hyperparameter combination, the open source pre-trained large language model is fine-tuned using sample data for APT classification detection, including:

[0022] Use sample data for APT classification detection to fine-tune the large language model under the optimal hyperparameter combination, so that the large language model can learn the reasoning logic of the APT classification detection task;

[0023] The fine-tuned large language model is used as the target model deployed in the specified network, so as to detect and identify malicious code APT using the target model in the specified network.

[0024] On the other hand, the present invention also provides a malicious code APT classification system based on large model hyperparameter adaptive selection, comprising: a sample construction module, a model training module and a target recognition module, wherein:

[0025] A sample construction module is used to collect malicious code data for APT classification detection, preprocess the malicious code data and obtain key features of the malicious code, so as to construct sample data for APT classification detection based on the key features of the malicious code. The preprocessing includes labeling of the organization to which the APT belongs, code disassembly, code feature extraction and feature screening;

[0026] A model training module is used to construct an instruction fine-tuning prompt template, and use the instruction fine-tuning prompt template to perform multiple rounds of iterative instruction fine-tuning training on the large language model through a hyperparameter adaptive selection mechanism to obtain the best hyperparameter combination. The instruction fine-tuning prompt template is used to prompt the large language model to generate a prediction representation of the APT organization category to which the malicious code data belongs based on the prefix prompt word. The hyperparameter adaptive selection mechanism is used to adaptively select the best hyperparameter combination for the malicious code APT classification task in the hyperparameter space. The hyperparameter space is composed of a prefix prompt word length candidate set and a rank value candidate set. The rank is a fine-tuning parameter set according to the basic model weight matrix;

[0027] The target recognition module is used to fine-tune the open source pre-trained large language model based on the optimal hyperparameter combination using sample data for APT classification detection to obtain a target model, input the malicious code to be classified and identified into the target model, and use the target model to obtain the APT organization category to which the malicious code to be classified and identified belongs.

[0028] Beneficial effects of the present invention:

[0029] The present invention combines the LORA (Low-Rank Adaptation of Large Language Models) efficient parameter fine-tuning technology and the P-TUNING prefix prompt word selection strategy, and intelligently and accurately selects the best hyperparameter combination in a low computing power consumption manner, wherein the rank size is crucial to the fine-tuning effect and the computing cost, and the prefix prompt word length hyperparameter of P-TUNNING is also crucial to the performance of the model. The low-rank adaptation method in the LORA technology is used to achieve efficient fine-tuning of the parameters of the large language model, and the prompt word vector is automatically learned by learning using the P-TUNING strategy. The rank parameter of LORA and the prefix prompt word length of P-TUNNING are comprehensively considered, and the hyperparameter combination most suitable for the malicious code attribution analysis task is automatically determined in a low computing power consumption manner, thereby significantly improving the accuracy and efficiency of the classification model, and having good application prospects in the intersection of computer security and artificial intelligence. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a schematic diagram of the malicious code APT classification process based on adaptive selection of large model hyperparameters in the embodiment;

[0031] Figure 2 This is a schematic diagram of the principle of the hyper-parameter adaptive selection algorithm in the embodiment;

[0032] Figure 3 This is a schematic diagram of the malicious code APT classification algorithm principle in the embodiment;

[0033] Figure 4 This is an illustration of the accuracy of hyperparameter training evaluation on a fixed data set in the embodiment. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0035] For the malicious code APT classification task, the embodiment of the present invention, see Figure 1 As shown, a malicious code APT classification method based on adaptive selection of large model hyperparameters is provided, including:

[0036] S101. Collect malicious code data for APT classification detection, preprocess the malicious code data and obtain key features of the malicious code, so as to construct sample data for APT classification detection based on the key features of the malicious code. The preprocessing includes labeling of the organization to which the APT belongs, code disassembly, code feature extraction and feature screening.

[0037] You can collect APT samples through sample analysis platforms such as VirusTotal, check whether the samples are marked as APT organizations through VirusTotal's Community, and obtain samples that have been marked as APT organizations. You can obtain APT organization samples from open source threat intelligence, use traditional hash algorithms to match them with confirmed and marked APT organization samples, complete APT labeling, and expand sample data.

[0038] Specifically, the malicious code data is preprocessed and key features of the malicious code are obtained, which can be designed to include:

[0039] Using a disassembly tool to disassemble the malicious code data and extract code features from the malicious code data, the code features including code software genes, code strings, code import table functions, code metadata, and code functions;

[0040] The score of each code feature is calculated based on the frequency of occurrence of the code feature, the amount of malicious code data where the code feature is located, and the number of APT organizations to which it belongs. The key features of the malicious code are selected based on the code feature score.

[0041] During disassembly, install and configure necessary tools, such as IDA Pro (although it is not completely open source, it is powerful), Ghidra, Radare2, Binary Ninja, etc. Ensure that the system environment (such as operating system, dependent libraries, etc.) meets the operating requirements of the tool; download the pre-stored binary malicious sample data from the FTP server. Before disassembling each binary malicious sample, check and verify it to ensure the integrity and non-tampering of the file. Use the tool's command line interface (CLI) and API to automate the disassembly process. For example, in Ghidra, you can control the disassembly process by writing Python scripts.

[0042] In feature extraction, software genes are regarded as binary fragments that carry functions or information in software codes. Software genes form an available basic unit sequence by connecting multiple basic logic units or code blocks in sequence. The extraction process includes: initializing an empty gene output sequence, traversing the basic blocks of the program, and appending the assembly code of each basic block to the gene output sequence in sequence. If the length of the gene output sequence exceeds the predetermined code token number threshold, a complete software gene is generated, and the starting basic block of the next gene is determined by overlapping coverage until all basic blocks are covered. Gene vectors are obtained by inputting software genes into the pre-trained BERT model, and each gene block is mapped to an 8-bit character string through clustering and hashing algorithms, thereby completing the extraction of gene information. The string extraction of automated binary samples is implemented through Ghidra's Python scripting engine. First, the binary program currently being analyzed is obtained, and all defined data segments in the program are traversed by calling Ghidra's API function. For each data segment, check whether its data type is a string, and extract the corresponding string and its memory address. All extracted strings and their corresponding addresses will be stored or output for subsequent analysis and processing. The import table function names in the binary sample are automatically obtained through Ghidra's Python script engine. First, the symbol table of the program is obtained using Ghidra's API, all the symbols in it are traversed, and functions marked as external symbols are filtered out. For each external symbol, its function name and corresponding memory address are extracted and stored or output. This method realizes the automatic extraction of import table function names, and can provide accurate import table information for reverse analysis and static analysis of binary programs. When the Ghidra tool can be used to analyze binary programs, a variety of metadata information can be automatically extracted, including file format, compiler type and version, compilation time, target architecture, programming language, entry point, segment information, symbol table, and other security-related metadata. A function consists of one or more software genes, so a set of software gene information can be used to express the information of a function, and these sets are defined as the gene information of function blocks.

[0043] In the feature screening process, the feature criticality calculation process is used to measure the criticality score of the malicious code feature. The calculation equation consists of two parts: one is to calculate the independence of the feature, that is, the derivative of the number of times the feature appears in each APT organization; the other is to calculate the frequency logarithm ratio, that is, the logarithm of the ratio of the total number of occurrences of the feature to the number of samples of the APT organization containing the feature. By adding these two parts, the measure of the feature criticality is obtained. The higher the score, the stronger the criticality of the feature.

[0044] In actual experimental comparisons, the accuracy of APT attribution analysis using the feat_score_ns3 algorithm is significantly better than traditional selection algorithms based on feature frequency and distribution statistics, such as TF-IDF or Entropy feature selection algorithms. The formula for the feat_score_ns3 algorithm calculation equation is as follows:

[0045]

[0046] Among them, #apt refers to the number of APT organizations in which the feature appears, #count refers to the total number of times the feature appears in all samples, and #samples refers to the number of samples in which the feature appears. The score of each feature is calculated through this equation. The higher the score, the better the effect of the feature on APT classification. By retaining the top K features of each category in the sample after sorting, feature screening is effectively achieved.

[0047] S102, constructing an instruction fine-tuning prompt template, using the instruction fine-tuning prompt template and a hyperparameter adaptive selection mechanism to perform multiple rounds of iterative instruction fine-tuning training on the large language model to obtain the best hyperparameter combination, wherein the instruction fine-tuning prompt template is used to prompt the large language model based on prefix prompt words to generate a prediction representation of the APT organization category to which the malicious code data belongs, and the hyperparameter adaptive selection mechanism is used to adaptively select the best hyperparameter combination for the malicious code APT classification task in the hyperparameter space, wherein the hyperparameter space is composed of a prefix prompt word length candidate set and a rank value candidate set, and the rank is a fine-tuning parameter set according to the basic model weight matrix.

[0048] For a malicious sample, four sets of features can be obtained, namely: string information, import table function information, metadata, and gene information of function blocks. Among them, the software gene information features are incorporated into the gene information features of function blocks. These features can be expressed in the form of strings. Therefore, the instruction fine-tuning template can be used to fine-tune the large language model to fit the final APT classification task.

[0049] Specifically, the instruction fine-tuning prompt template is used and the instruction fine-tuning training of the large language model is performed for multiple rounds through the hyperparameter adaptive selection mechanism, which can be designed to include:

[0050] Using natural language and dynamic data to set the prompt word template for the APT classification detection task, using the APT organization label as the prompt answer, the natural language is used to describe the dynamic data, prompt questions and prompt answers, and the dynamic data uses the same key-value pairs to describe the key features of the same type of malicious code;

[0051] The training set data and evaluation set data are extracted from the sample data for APT classification detection according to a preset ratio, the training set data is input into the prompt word template, a mask is added to the prompt answer and a prefix prompt word with a mask is generated, the large language model is trained for multiple rounds of iterations using the training set data and prefix prompt words and a hyperparameter adaptive selection mechanism, and the evaluation data set is used to obtain the classification accuracy of the corresponding hyperparameter combination of the large language model to obtain the optimal hyperparameter combination of the large language model.

[0052] In order to distinguish the four groups of features, a JSON structure can be designed to put similar features into the same key-value pair. The following is an example of a JSON template (where import corresponds to the imported table function information, string_cleaned corresponds to the string information, funchash corresponds to the gene information of the function block, and info corresponds to the metadata):

[0053]

[0054]

[0055] By adding appropriate prompt words before and after this dynamically synthesized JSON structure, filling in the corresponding APT organization name at the end of the prompt word, and letting the large model instruction fine-tuning task learn to predict the name of this APT organization, a prompt word template for large model instruction fine-tuning can be generated. The following is an example of this prompt word template:

[0056] This is a json content of features extracted from an executable file:```json{

[0057] / / JSON content dynamically synthesized in the above steps

[0058] }```which APT group does this executable file belong to? APT37

[0059] In this prompt word template, natural language and dynamic JSON data are used to characterize samples, and the answer APT37 is used as a learning task so that the large model can fine-tune instructions.

[0060] After the large model is fine-tuned by instructions, it can perform APT classification reasoning on new samples. The working principle of its classification reasoning can be described as follows: extract and filter the input samples, synthesize JSON data, feed the JSON data into the prompt word template, and add a mask (MASK) in the answer part to force the large model to predict the token corresponding to the mask. If the correct APT organization name is output, the prediction is successful. The following is an example of a prompt word template with a mask added:

[0061] This is a json content of features extracted from an executable file:```json{

[0062] / / JSON content dynamically synthesized in the above steps

[0063] }```which APT group does this executable file belong to? __MASK__

[0064] At the end of the above prompt word template, a mask token, namely __MASK__, is added. By fixing the token before the mask, the large model can predict what the mask token is, which is equivalent to predicting the APT organization to which the sample belongs.

[0065] During model fine-tuning, the best hyperparameter combination for the malicious code APT classification task is adaptively selected in the hyperparameter space, which can be designed to include the following:

[0066] Generate a prefix cue word length candidate set and a rank value candidate set based on powers of 2, and combine the two candidate sets through a Cartesian product operation to generate different hyperparameter combination schemes, so as to construct a hyperparameter space using the different hyperparameter combination schemes;

[0067] A priority queue is constructed based on the hyperparameter combination scheme. In the priority queue, each hyperparameter combination scheme is used as an element in the queue. The current optimal element is selected from the head of the priority queue with a specified probability for weight calculation, and an element is randomly selected from the priority queue with another specified probability for weight evaluation.

[0068] The training set and evaluation set are randomly extracted in a small proportion from the sample data used for APT classification detection. After iterative training on the training set, the evaluation set is evaluated to obtain the accuracy of the corresponding element. The element weight is updated according to the accuracy of the element at the current time and the evaluation frequency until the model converges and the optimal hyperparameter combination is determined.

[0069] like Figure 2As shown in the figure, in the design of the hyperparameter candidate set, candidate sequences are set for the prefix hint word length of the P-TUNING strategy and the rank parameter of the LORA technology. For P-TUNING, [2,4,8,16,32,64,128,256] can be selected as the candidate set of prefix word length. This design covers a variety of lengths from shorter to longer, and these lengths are all powers of 2, aiming to save the subsequent exploration cost by covering the hyperparameter space. At the same time, for the LORA technology, [2,4,8,16,32,64,128] can be set as the candidate set of rank. These rank values ​​are also selected based on powers of 2, aiming to balance the fine-tuning effect and computational cost, ensuring that the consumption of computing resources is effectively controlled while maintaining model performance.

[0070] Through the Cartesian product operation, the prefix word length and the candidate set of rank are combined to generate 56 different hyperparameter combinations. This combination method can systematically explore all possible hyperparameter configurations, ensure that no potential optimization solutions are missed, and provide a comprehensive foundation for subsequent exploration. By covering the hyperparameter space by powers of 2, the subsequent exploration cost is saved; through detailed length division and rank value setting, the impact of different hyperparameters on model performance can be more comprehensively explored, and a solid foundation can be provided for finding the optimal hyperparameter configuration.

[0071] Hyperparameter combinations can be explored and evaluated more efficiently through a management method based on a priority queue mechanism. Specifically, each hyperparameter combination is considered as an element in a priority queue and is assigned a dynamically calculated weight value. This weight value comprehensively considers the actual accuracy of the element at the current time t and the frequency with which it is evaluated to achieve a balance between exploration and utilization.

[0072] The system selects an element from the head of the queue with a probability of P (e.g. 0.9) each time, and uniformly randomly selects elements from the entire queue with a probability of 1-P (e.g. 0.1). This probability-based selection method ensures the use of high-quality elements while not forgetting to explore other potential elements.

[0073] For the selected element, the system will sample the entire data set once, and sample the training and evaluation sets at a very small ratio (for example, 1%). The large model to be fine-tuned is configured according to the hyperparameters of the selected element, and the rank size of LORA and the length parameter of P-TUNNING are configured respectively. After the configuration is completed, it is randomly trained on the sampled data set until convergence, and evaluated on the evaluation set to obtain the APT classification accuracy at time t. The accuracy calculation formula is as follows:

[0074]

[0075] Among them, #Correct is the number of samples for which the model predicts APT correctly on the evaluation set, and #Error is the number of samples for which the model predicts APT incorrectly on the evaluation machine.

[0076] Then the accuracy of the element at time t is updated to its weight. The specific update formula is as follows:

[0077]

[0078] in is the weight of the i-th element at time t, r t is the actual accuracy of the element at time t, n i (t) is the number of times the element is selected for weight evaluation until time t. This formula balances the exploitation and exploration mechanisms, that is, if n i If (t) is large, it means that the element has been explored many times, thus reducing its update rate. i (t) is small, it means that the element has not been fully explored, and its benefit (i.e. ) will amplify its influence on its weight and accelerate convergence.

[0079] After the weight of the selected element is updated, it is put back into the priority queue and its position in the priority queue is adjusted according to the weight. This round of iteration ends.

[0080] The convergence conditions of the entire iteration include two points: 1) the predefined number of convergence rounds, which can be defined as 500 rounds in the present invention. If the total number of iterations exceeds 500, the iteration is stopped. 2) Monitor the update of element weights in the priority queue. If the number of updates of all weights exceeds the threshold T, and the order of the entire queue does not change within K rounds, the iteration is stopped.

[0081] After the iteration stops, the first element in the queue is selected as the optimal solution. The LORA rank parameter and P-TUNNING length parameter in this element are the hyperparameters of the final model.

[0082] When the hyperparameter iteration based on the priority queue is completed, the element at the head of the queue will be used as the final element, and its hyperparameter will be used to train the final model. And it will be evaluated on 10% of the data set. Through ablation experiments, it can be found that the large model trained by this method is 0.8 percentage points more accurate than the large model using only LORA on the evaluation set.

[0083] The large language model under the optimal hyperparameter combination is fine-tuned using sample data for APT classification detection, so that the large language model can learn the reasoning logic of the APT classification detection task; the fine-tuned large language model is used as the target model deployed in the specified network, so that the target model can be used to detect and identify malicious code APT in the specified network.

[0084] S103. Based on the optimal hyperparameter combination, the open source pre-trained large language model is fine-tuned using sample data for APT classification detection, the malicious code to be classified and identified is input into the target model, and the target model is used to obtain the APT organization category to which the malicious code to be classified and identified belongs.

[0085] The large language model under the optimal hyperparameter combination is fine-tuned using sample data for APT classification detection, so that the large language model can learn the reasoning logic of the APT classification detection task; the fine-tuned large language model is used as the target model deployed in the specified network, so that the target model can be used to detect and identify malicious code APT in the specified network.

[0086] Furthermore, based on the above method, an embodiment of the present invention also provides a malicious code APT classification system based on large model hyperparameter adaptive selection, comprising: a sample construction module, a model training module and a target recognition module, wherein:

[0087] A sample construction module is used to collect malicious code data for APT classification detection, preprocess the malicious code data and obtain key features of the malicious code, so as to construct sample data for APT classification detection based on the key features of the malicious code. The preprocessing includes labeling of the organization to which the APT belongs, code disassembly, code feature extraction and feature screening;

[0088] A model training module is used to construct an instruction fine-tuning prompt template, and use the instruction fine-tuning prompt template to perform multiple rounds of iterative instruction fine-tuning training on the large language model through a hyperparameter adaptive selection mechanism to obtain the best hyperparameter combination. The instruction fine-tuning prompt template is used to prompt the large language model to generate a prediction representation of the APT organization category to which the malicious code data belongs based on the prefix prompt word. The hyperparameter adaptive selection mechanism is used to adaptively select the best hyperparameter combination for the malicious code APT classification task in the hyperparameter space. The hyperparameter space is composed of a prefix prompt word length candidate set and a rank value candidate set. The rank is a fine-tuning parameter set according to the basic model weight matrix;

[0089] The target recognition module is used to fine-tune the open source pre-trained large language model based on the optimal hyperparameter combination using sample data for APT classification detection, input the malicious code to be classified and identified into the target model, and use the target model to obtain the APT organization category to which the malicious code to be classified and identified belongs.

[0090] like Figure 3 In the overall algorithm shown, first, malicious samples are obtained and annotated, that is, sample data annotated with APT organizations are collected using the sample analysis platform VirusTotal, and APT organization samples are obtained and annotated through 15 open source threat intelligence sources, and a total of 15,000 samples belonging to APT organizations are collected. The APT sample data set prepared for attribution analysis training and verification contains approximately 15,000 APT samples, which are related to 200 APT organizations. The APT sample data set is used for large language model sample training and testing. APT organizations include but are not limited to: APT32, APT33, BITTER, AridViper, BuhTrap, etc. The collected sample data is finally stored in the FTP server. Next, the sample data in the FTP server is disassembled using a disassembly tool, and the key features of the malicious code are obtained through feature extraction and screening. Then, according to the sample characteristics, a prompt word template for fine-tuning the large model instruction was constructed, and the APT classification reasoning was performed on the new sample through the fine-tuned large model. In the fine-tuning of the large model, an adaptive hyperparameter selection algorithm was used to select hyperparameters efficiently and with high performance. Specifically, 500 rounds of iterative updates were performed, and the full amount of data was sampled at a ratio of 1% to reduce the computational cost while maintaining the accuracy of the evaluation. After a total of 2 and a half days, the algorithm gradually converged and finally determined the optimal hyperparameter combination, that is, the length of P-TUNING was 16 and the rank of LORA was 32.

[0091] like Figure 4 As shown in the figure, all (56 groups) of hyperparameters are trained and evaluated on a fixed data set, proving that the optimal solution selected by the hyperparameter selection scheme in this case shows the highest accuracy, and the hyperparameter selection scheme takes less than 1 / 15 of the time to find the best hyperparameter combination. This verification result further proves the stability and reliability of the hyperparameter combination selected by the scheme in this case.

[0092] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0093] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0094] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0095] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0096] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A malicious code APT classification method based on large model hyperparameter adaptive selection, characterized in that: Include: Collect malicious code data for APT classification detection, preprocess the malicious code data and obtain key features of the malicious code, so as to construct sample data for APT classification detection based on the key features of the malicious code, wherein the preprocessing includes labeling of the organization to which the APT belongs, code disassembly, code feature extraction and feature screening; Construct an instruction fine-tuning prompt template, use the instruction fine-tuning prompt template and perform multiple rounds of iterative instruction fine-tuning training on the large language model through a hyperparameter adaptive selection mechanism to obtain the best hyperparameter combination, the instruction fine-tuning prompt template is used to prompt the large language model to generate a prediction representation of the APT organization category to which the malicious code data belongs based on the prefix prompt word, and the hyperparameter adaptive selection mechanism is used to adaptively select the best hyperparameter combination for the malicious code APT classification task in the hyperparameter space, the hyperparameter space is composed of a prefix prompt word length candidate set and a rank value candidate set, and the rank is a fine-tuning parameter set according to the basic model weight matrix; Based on the optimal hyperparameter combination, the open source pre-trained large language model is fine-tuned using sample data for APT classification detection to obtain the target model. The malicious code to be classified and identified is input into the target model to use the target model to obtain the APT organization category to which the malicious code to be classified and identified belongs.

2. The malicious code APT classification method based on large model hyperparameter adaptive selection according to claim 1 is characterized in that: Preprocess the malicious code data and obtain the key features of the malicious code, including: Using a disassembly tool to disassemble the malicious code data and extract code features from the malicious code data, the code features including code software genes, code strings, code import table functions, code metadata, and code functions; The score of each code feature is calculated based on the frequency of occurrence of the code feature, the amount of malicious code data where the code feature is located, and the number of APT organizations to which it belongs. The key features of the malicious code are selected based on the code feature score.

3. The malicious code APT classification method based on large model hyperparameter adaptive selection according to claim 2 is characterized in that: The code feature score calculation formula is expressed as: Among them, #apt is the number of APT organizations where the code feature is located, #count is the total number of times the code feature appears in all malicious code data, and #samples is the number of malicious code data where the code feature is located.

4. The malicious code APT classification method based on large model hyperparameter adaptive selection according to claim 1 is characterized in that: Using the instruction fine-tuning prompt template and the hyperparameter adaptive selection mechanism, the large language model is trained through multiple rounds of instruction fine-tuning, including: Using natural language and dynamic data to set the prompt word template for the APT classification detection task, using the APT organization label as the prompt answer, the natural language is used to describe the dynamic data, prompt questions and prompt answers, and the dynamic data uses the same key-value pairs to describe the key features of the same type of malicious code; The training set data and evaluation set data are extracted from the sample data for APT classification detection according to a preset ratio, the training set data is input into the prompt word template, a mask is added to the prompt answer and a prefix prompt word with a mask is generated, the large language model is trained for multiple rounds of iterations using the training set data and prefix prompt words and a hyperparameter adaptive selection mechanism, and the evaluation data set is used to obtain the classification accuracy of the corresponding hyperparameter combination of the large language model to obtain the optimal hyperparameter combination of the large language model.

5. The malicious code APT classification method based on large model hyperparameter adaptive selection according to claim 1 or 4 is characterized in that: Adaptively select the best hyperparameter combination for the malicious code APT classification task in the hyperparameter space, including: Generate a prefix cue word length candidate set and a rank value candidate set based on powers of 2, and combine the two candidate sets through a Cartesian product operation to generate different hyperparameter combination schemes, so as to construct a hyperparameter space using the different hyperparameter combination schemes; A priority queue is constructed based on the hyperparameter combination scheme. In the priority queue, each hyperparameter combination scheme is used as an element in the queue. The current optimal element is selected from the head of the priority queue with a specified probability for weight calculation, and an element is randomly selected from the priority queue with another specified probability for weight evaluation. The training set and evaluation set are randomly extracted from the sample data for APT classification detection in a specified ratio, and iterative training is performed on the training set. The large language model after iterative training is evaluated on the evaluation set to obtain the accuracy of the corresponding elements. The element weights are updated according to the accuracy of the elements at the current time and the evaluation frequency until the model converges and the optimal hyperparameter combination is determined.

6. The malicious code APT classification method based on large model hyperparameter adaptive selection according to claim 5 is characterized in that: The weight update formula for each element in the queue is expressed as: in, is the weight of the i-th element at time t, r t is the actual accuracy of the element at time t, n i (t) is the number of times the element is selected for weight evaluation up to time t.

7. The malicious code APT classification method based on large model hyperparameter adaptive selection according to claim 4 is characterized in that: Based on the optimal hyperparameter combination, the open source pre-trained large language model is fine-tuned using sample data for APT classification detection, including: Use sample data for APT classification detection to fine-tune the large language model under the optimal hyperparameter combination, so that the large language model can learn the reasoning logic of the APT classification detection task; The fine-tuned large language model is used as the target model deployed in the specified network, so as to detect and identify malicious code APT using the target model in the specified network.

8. A malicious code APT classification system based on large model hyperparameter adaptive selection, characterized in that: Contains: sample construction module, model training module and target recognition module, among which, A sample construction module is used to collect malicious code data for APT classification detection, preprocess the malicious code data and obtain key features of the malicious code, so as to construct sample data for APT classification detection based on the key features of the malicious code. The preprocessing includes labeling of the organization to which the APT belongs, code disassembly, code feature extraction and feature screening; A model training module is used to construct an instruction fine-tuning prompt template, and use the instruction fine-tuning prompt template to perform multiple rounds of iterative instruction fine-tuning training on the large language model through a hyperparameter adaptive selection mechanism to obtain the best hyperparameter combination. The instruction fine-tuning prompt template is used to prompt the large language model to generate a prediction representation of the APT organization category to which the malicious code data belongs based on the prefix prompt word. The hyperparameter adaptive selection mechanism is used to adaptively select the best hyperparameter combination for the malicious code APT classification task in the hyperparameter space. The hyperparameter space is composed of a prefix prompt word length candidate set and a rank value candidate set. The rank is a fine-tuning parameter set according to the basic model weight matrix; The target recognition module is used to fine-tune the open source pre-trained large language model based on the optimal hyperparameter combination using sample data for APT classification detection to obtain a target model, input the malicious code to be classified and identified into the target model, and use the target model to obtain the APT organization category to which the malicious code to be classified and identified belongs.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images