Malware family classification method and system based on dynamic characteristics and ensemble learning

Abstract

The invention discloses a malicious software family classification method and system based on dynamic features and ensemble learning, and the method comprises the following steps: 1, extracting a dynamic application programming interface API call sequence of each malicious code in malicious software for training, and summarizing the dynamic application programming interface API call sequence as an original feature; 2, constructing a bidirectional long-short-term memory neural network model as a first base classifier; 3, constructing a text convolutional neural network model as a second base classifier; 4, constructing a convolutional neural network + long and short-term memory neural network model as a third base classifier; and 5, completing the construction of an ensemble learning classification model through an extreme gradient lifting algorithm. And 6, performing malicious software family classification on target malicious software through the malicious software family classification model. According to the method, features are extracted through a dynamic analysis method, external interference is avoided, the three base classifiers are arranged to comprehensively learn feature information, and the classification accuracy is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of malware family classification, and in particular to a malware family classification method and system based on dynamic features and integrated learning. Background Art

[0002] In recent years, with the continuous advancement of information and network technology, the number and types of malware have increased dramatically. Its attack targets have gradually evolved from early individual users to enterprises and even countries, and its impact has gradually expanded from traditional personal computers to various networked smart terminals including smartphones. Although some existing research on malicious code detection and classification has made positive progress, the rapid growth in the number of malware variants has greatly affected the classification effect of traditional methods. Malicious code classification research based on artificial intelligence technology has become a new hotspot, and studying efficient malware classification methods has become a very important and challenging task at present.

[0003] Among the newly added malicious codes, most are variants of known malicious codes rather than completely regenerated malicious code files. Among these variants, a large part are family variants of known malicious codes, that is, new malware generated after the evolution of functions or anti-detection technologies. The existing classification work for malware families generally extracts its feature data and code fragments, analyzes their homology with known samples, and then infers the family of suspicious malicious samples. In the existing research, the extraction of features in the intelligent classification work realized by artificial intelligence technology is mainly divided into two categories. One is the static features obtained by static analysis methods, such as the patent named a malicious code detection method based on static features (CN115859290A), which completes the classification through the fully connected layer and the Softmax layer after alternating the first separable convolution and the second separable convolution on the static feature array. However, with the development and application of technologies such as code obfuscation, the role of static features has been greatly limited, and the generalization ability of classifiers based on static features has also dropped sharply. The other is the dynamic features of the program at runtime obtained by dynamic analysis methods. The features extracted by dynamic analysis focus more on characterizing the behavior of the program.

[0004] In addition to the differences in features, most existing work still uses a single model in model construction, focusing on improving its performance and effect. However, since different features perform differently on different classifiers, it is difficult to fully learn the intrinsic information of the features using a single machine learning classification model, which leads to certain limitations in the classification effect. Summary of the invention

[0005] In order to solve the problem that the existing malware family classification model is a single model, it is difficult to comprehensively learn the intrinsic information of the features, and there are certain limitations, the present invention proposes a malware family classification method and system based on dynamic features and ensemble learning. The dynamic feature of the dynamic API call sequence of the malicious code is firstly extracted, and then the extracted dynamic features are learned by setting three base classifiers, namely a bidirectional long short-term memory neural network model, a text convolutional neural network model, and a convolutional neural network + long short-term memory neural network model. After that, the extreme gradient boosting algorithm is used to complete the construction of the ensemble learning model to realize the classification of the malware family.

[0006] In order to achieve the above object, the technical solution of the present invention is:

[0007] The first aspect of the present invention proposes a malware family classification method based on dynamic features and ensemble learning, comprising the following steps:

[0008] Step 1: Extract the dynamic application programming interface API call sequence of each malicious code in the training malware, and summarize the dynamic API call sequence as the original feature;

[0009] Specifically, the dynamic API call sequence is extracted through the sandbox and BSA sandbox analysis tools to facilitate the subsequent study of the implicit information in the dynamic API call sequence.

[0010] Step 2: Build a bidirectional long short-term memory neural network Bi-LSTM model as the first base classifier to make full use of context information;

[0011] Step 3: Build a text convolutional neural network TextCNN model as the second base classifier to facilitate more efficient self-learning and extraction of local features in text through convolution and pooling operations;

[0012] Step 4: Build a convolutional neural network (CNN) + long short-term memory (LSTM) neural network model as the third base classifier to extract the spatial features contained in the dynamic API sequence through the convolution block and capture the long-term dependency information in the dynamic API call sequence through the LSTM layer;

[0013] Step 5: Use the original features as the input of the three base classifiers respectively, and iteratively train the three base classifiers through the extreme gradient boosting algorithm. After the training is completed, an integrated learning classification model is obtained as the malware family classification model;

[0014] Specifically, this step sequentially establishes K classification regression trees, adds the new decision trees in each iterative learning to the integrated model, and performs weighted averaging to improve the overall prediction performance, achieve a higher prediction accuracy, and facilitate the family classification of malicious code;

[0015] Step 6: Classify all malicious codes in the target malware into malware families using the malware family classification model, so as to provide an important basis for controlling and removing the target malware.

[0016] Furthermore, in the step 2, an attention layer is introduced into the Bi-LSTM model, and a neural network model of Bi-LSTM and attention mechanism is constructed as the first base classifier;

[0017] Specifically, an attention layer is introduced into the Bi-LSTM model, and the output of the Bi-LSTM layer in the Bi-LSTM model is used as the input of the attention layer. A neural network model of Bi-LSTM and attention mechanism is constructed as the first base classifier to make full use of contextual information and further focus on important information.

[0018] Furthermore, in the step 3, the convolution layer in the TextCNN model includes four convolution kernels of different sizes, and a normalized exponential function softmax layer is added after the fully connected layer;

[0019] Specifically, the convolution layer in the TextCNN model includes four convolution kernels of different sizes to fully abstract the local features of the sequence in different fields of view. A softmax layer is added after the fully connected layer to convert the output vector of the pooling layer into the desired prediction result.

[0020] Furthermore, in the step 4, the third base classifier includes an embedding layer, two groups of convolution blocks, a long short-term memory neural network LSTM layer and a fully connected layer in sequence, wherein each group of convolution blocks includes a convolution layer and a pooling layer, the convolution layer selects a one-dimensional convolution, the pooling layer adopts a maximum pooling operation, and a softmax is added after the fully connected layer for classification;

[0021] Specifically, the embedding layer performs word embedding processing on the dynamic API call sequence of the input malware sample and converts it into a vector representation for learning the family features in the sample file;

[0022] Two sets of convolution blocks are used to reduce the dimensionality of the extracted spatial features;

[0023] The LSTM layer is used to maintain long-term dependency information and capture semantic relationships in the sequence;

[0024] The fully connected layer transforms the output of the previous layers.

[0025] Furthermore, in step five, during training, multivariate classification cross entropy is selected as the loss function, which is easy to calculate and can make the integrated learning classification model have better classification ability.

[0026] Furthermore, in the step five, the ensemble learning classification model is optimized by an optimization algorithm, and the optimization algorithm adopts any one of a stochastic gradient descent optimization algorithm, a momentum optimization algorithm and an adaptive learning rate optimization algorithm, so as to improve the accuracy of classification.

[0027] The second aspect of the present invention proposes a malware family classification system based on dynamic features and ensemble learning, including:

[0028] A feature extraction module is used to extract a dynamic application programming interface (API) call sequence of each malicious code in the malware, and summarize the dynamic API call sequence as an original feature;

[0029] Specifically, the dynamic API call sequence is extracted through the sandbox and BSA sandbox analysis tools to facilitate the subsequent study of the implicit information in the dynamic API call sequence.

[0030] The first base classifier module is used to build a bidirectional long short-term memory neural network Bi-LSTM model as the first base classifier to make full use of context information;

[0031] The second base classifier module is used to build a text convolutional neural network TextCNN model as the second base classifier, which is convenient for more efficient self-learning and extraction of local features in text through convolution and pooling operations;

[0032] The third base classifier module is used to build a convolutional neural network (CNN) + long short-term memory (LSTM) neural network model as the third base classifier, which is convenient for extracting spatial features contained in the dynamic API sequence through the convolution block and capturing long-term dependency information in the dynamic API call sequence through the LSTM layer;

[0033] The ensemble learning classifier module is used to use the original features as the input of the three base classifiers respectively, and iteratively train the three base classifiers through the extreme gradient boosting algorithm. After the training is completed, an ensemble learning classification model is obtained as the malware family classification model;

[0034] Specifically, this step builds three classification and regression trees in sequence, adds the new decision trees in each iterative learning to the integrated model, and performs weighted averaging to improve the overall prediction performance and achieve a higher prediction accuracy, which facilitates the family classification of malicious code;

[0035] The classification module is used to classify all malicious codes in the target malware into malware families through the malware family classification model, so as to provide an important basis for controlling and removing the target malware.

[0036] Furthermore, in the first base classifier module, an attention layer is introduced into the Bi-LSTM model, and a neural network model of Bi-LSTM and attention mechanism is constructed as the first base classifier;

[0037] Specifically, an attention layer is introduced into the Bi-LSTM model, and the output of the Bi-LSTM layer in the Bi-LSTM model is used as the input of the attention layer. A neural network model of Bi-LSTM and attention mechanism is constructed as the first base classifier to make full use of contextual information and further focus on important information.

[0038] Furthermore, in the second base classifier module, the convolution layer in the TextCNN model includes four convolution kernels of different sizes, and a normalized exponential function softmax layer is added after the fully connected layer;

[0039] Specifically, the convolution layer in the TextCNN model includes four convolution kernels of different sizes to fully abstract the local features of the sequence in different fields of view. A softmax layer is added after the fully connected layer to convert the output vector of the pooling layer into the desired prediction result.

[0040] Furthermore, in the third base classifier module, the third base classifier includes an embedding layer, two groups of convolution blocks, a long short-term memory neural network LSTM layer and a fully connected layer in sequence, wherein each group of convolution blocks includes a convolution layer and a pooling layer, the convolution layer selects a one-dimensional convolution, the pooling layer adopts a maximum pooling operation, and a softmax is added after the fully connected layer for classification;

[0041] Specifically, the embedding layer performs word embedding processing on the dynamic API call sequence of the input malware sample and converts it into a vector representation for learning the family features in the sample file;

[0042] Two sets of convolution blocks are used to reduce the dimensionality of the extracted spatial features;

[0043] The LSTM layer is used to maintain long-term dependency information and capture semantic relationships in the sequence;

[0044] The fully connected layer transforms the output of the previous layers.

[0045] Furthermore, in the ensemble learning classifier module, during training, multivariate classification cross entropy is selected as the loss function, which is easy to calculate and can make the ensemble learning classification model have better classification ability.

[0046] Furthermore, the ensemble learning classifier module is used to optimize the ensemble learning classification model through an optimization algorithm, and the optimization algorithm adopts any one of a stochastic gradient descent optimization algorithm, a momentum optimization algorithm and an adaptive learning rate optimization algorithm to improve the accuracy of classification.

[0047] Through the above technical solution, the beneficial effects of the present invention are:

[0048] The present invention extracts feature data through a dynamic analysis method, avoiding the influence of code obfuscation and other technologies on feature extraction. The dynamically extracted malware API sequence features are comprehensively learned by setting three base classifiers, namely, the Bi-LSTM model, the TextCNN model and the CNN+LSTM model. The three base classifiers are iteratively trained through the extreme gradient boosting algorithm, and the three base classifiers are merged to complete the construction of the ensemble learning classification model. The malware family is classified through ensemble learning, thereby improving the classification accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a flow chart of the malware family classification method based on dynamic features and ensemble learning of the present invention.

[0050] Figure 2 It is a flowchart of malicious code API sequence extraction of the malware family classification method based on dynamic features and ensemble learning of the present invention.

[0051] Figure 3 It is a schematic diagram of a base classifier structure based on Bi-LSTM+Attention of a malware family classification method based on dynamic features and ensemble learning of the present invention.

[0052] Figure 4 It is a schematic diagram of a base classifier structure based on TextCNN of a malware family classification method based on dynamic features and ensemble learning of the present invention.

[0053] Figure 5 It is a schematic diagram of a base classifier structure based on CNN+LSTM of a malware family classification method based on dynamic features and ensemble learning of the present invention.

[0054] Figure 6 It is a schematic diagram of three algorithm learning curves of the malware family classification method based on dynamic features and ensemble learning of the present invention.

[0055] Figure 7 It is an architecture diagram of the malware family classification system based on dynamic features and integrated learning of the present invention. DETAILED DESCRIPTION

[0056] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments:

[0057] Example 1

[0058] like Figure 1 As shown in the figure, the malware family classification method based on dynamic features and ensemble learning includes the following steps:

[0059] S1: Extract the dynamic application programming interface API call sequence of each malicious code in the training malware, and summarize the dynamic API call sequence as the original feature.

[0060] Specifically, dynamic features generally include registry information, dynamic API and system call information, dynamic opcode sequences, etc. The inventors have found through research that API calls generated during code execution can better reflect its true behavior and intention. Therefore, this embodiment selects the dynamic feature of dynamic API call sequence to characterize malicious code, and achieves classification of malicious code, especially unknown family malicious code, by learning the implicit information contained therein.

[0061] As a feasible implementation method, existing machine learning methods (such as K-Nearest Neighbor (KNN), Support Vector Machine (SVM), Decision Tree (DT) and Random Forests (RF), Naive Bayesian Model (NBM) and Bayesian Network and other machine learning methods) can be used to extract the dynamic API call sequence.

[0062] As another possible implementation method, first use the sandbox and BSA sandbox analysis tools to analyze the malicious code samples, and then use the regularization method to extract the API call sequence of each malicious code from the analysis results and save it in a json file. The extraction process is as follows: Figure 2 As shown, the following steps are included:

[0063] <1> Start the sandbox.

[0064] <2> Start the sandbox analysis tool.

[0065] <3> Run malware in a sandbox.

[0066] <4> Determines whether the sandbox analysis tool has finished analyzing the malware. If not, returns <2> If finished, proceed to the next step.

[0067] <5> Get the analysis results.

[0068] <6> Close the sandbox.

[0069] By running malicious code in Sandbox and analyzing the running process of malicious code with BSA sandbox analysis tool, all API log files of the dynamic execution process of malicious code can be obtained, including API sequence, execution operation, modified file, execution file, etc. This paper selects the API call sequence of malicious code as the original feature input, writes Python script, performs regularized matching on API log files, selects the corresponding API call name, arranges it in the order of calling to form the required sequence, and finally summarizes all API call sequences into json files.

[0070] S2: Build a bidirectional long short-term memory neural network Bi-LSTM model as the first base classifier.

[0071] S3: Build a text convolutional neural network TextCNN model as the second base classifier.

[0072] S4: Construct a convolutional neural network CNN + long short-term memory neural network LSTM model as the third base classifier.

[0073] S5: The original features are used as the input of the three base classifiers respectively. The three base classifiers are iteratively trained through the extreme gradient boosting algorithm. After the training is completed, an integrated learning classification model is obtained as the malware family classification model.

[0074] S6: Classify all malicious codes in the target malware into malware families using the malware family classification model.

[0075] The malware family classification method based on dynamic features and ensemble learning provided in the embodiment of the present invention trains multiple base learners and integrates them according to the extreme gradient boosting algorithm, and finally obtains an ensemble learning model rather than a single model classification method. It can comprehensively learn the intrinsic information of the features, and thus can significantly improve the classification accuracy.

[0076] Example 2

[0077] Based on the above embodiment, the embodiment of the present invention provides a construction process of a first base learner, which is as follows:

[0078] The structure of the first base classifier constructed in the embodiment of the present invention is as follows: Figure 3 As shown, it includes input layer, embedding layer, Bi-LSTM layer, attention layer, fully connected layer and output layer.

[0079] Specifically, the traditional RNN can solve the context association problem in theory, but because the neurons in the model only retain the output of the adjacent level during the specific calculation, the long-term dependency problem in the input data cannot be well represented and learned. Therefore, this embodiment selects the LSTM unit with long-term memory as the hidden layer unit of the recurrent neural network, and in order to make full use of the context information rather than simply the above information association, a bidirectional LSTM network is further selected to learn the features, such as Figure 3 The Bi-LSTM layer in .

[0080] Specifically, Bi-LSTM is an improvement of RNN, which is mainly composed of a forward LSTM and a backward LSTM. Each time step contains an LSTM unit to selectively memorize, forget and output information. Suppose a malware API sequence data X containing T elements is given, which is X = [x1, x2, ..., x T ], i = 1, 2, ..., T, x i is the i-th element in the malware API sequence data, each x i All are transformed into a D-dimensional real vector e through the embedding layer i , we get a vector matrix E consisting of the D-dimensional embedding concatenation of all elements in X, E = [e1, e2, ..., e T ],e i is the i-th element in the sequence. After this T×D-dimensional vector matrix E is input into the Bi-LSTM model, there is a bidirectional hidden state output at time t, where the forward LSTM hidden state output is recorded as The backward LSTM hidden state output is recorded as

[0081]

[0082]

[0083] in, is the forward LSTM hidden state output at time t-1, is the backward LSTM hidden state output at time t+1, e i is a D-dimensional real vector that is converted into the embedding layer.

[0084] The hidden state output of Bi-LSTM at time t is composed of the bidirectional hidden state combination and splicing, denoted as Assuming that the number of nodes in the LSTM hidden layer is n, after the sequence training is completed, a T×2n-dimensional hidden state set H = [h1,h2,...,h T ], i = 1, 2, ..., T, h iis the hidden state output at time i.

[0085] Furthermore, when using Bi-LSTM for data learning, it is often necessary to face a large amount of data, but at different times, only a small amount of individual data is useful and needs attention. Therefore, in order to better learn effective data, the embodiment of the present invention further introduces an attention mechanism into the above-mentioned Bi-LSTM model.

[0086] Specifically, the attention layer is introduced in the first base classifier, and the hidden state set H of the Bi-LSTM is used as input. The attention mechanism is used to calculate the important part of the T hidden states, that is, to assign an attention weight to each of the T hidden states. First, we use the activation function Tanh to perform a nonlinear transformation and complete the dimension transformation; then we use the softmax function to normalize it and obtain the output attention vector α, which is the attention distribution of the query vector on H in the attention mechanism, where each item represents a probability corresponding to an element of the original input, and the sum of all items is 1. The weight matrix obtained by the Attention layer is shown below.

[0087] M=tanh(H) (3)

[0088] α=softmax(w T M) (4)

[0089] r=Hα T (5)

[0090] h * =tanh(r) (6)

[0091] Among them, H is the hidden state set, M is the result of the hidden state set H after the tanh function transformation, and T corresponds to the input length H∈R of H D×T , D is the dimension of the word vector, α is the output attention vector, α T is the transpose of α, w T is the transpose of the parameter vector obtained through training, r is the vector representation of the API sequence, and its dimension is D, h * It is the representation of the API sequence finally used for classification, with the dimension D.

[0092] When h * Before the output of the attention layer is sent to the fully connected (Dense) layer, a Dropout process is designed to reduce overfitting first, and then it is sent to the fully connected layer. Finally, a softmax classifier is used to detect the detected samples and output the detection results.

[0093] Example 3

[0094] Based on the above embodiments, an embodiment of the present invention provides a process for constructing a second base classifier.

[0095] The most commonly used deep learning models are mainly RNN and CNN. These two models are good at different scenarios in the field of natural language processing. When long-term dependencies need to be processed, such as understanding through long sentences, RNN often performs better than CNN; on the contrary, if local features or key phrases need to be extracted and processed, CNN performs better than RNN.

[0096] Since CNN models are usually more suitable for processing image problems, the second base classifier uses TextCNN, which is specifically designed for text classification. TextCNN is a neural network model based on convolutional neural networks designed specifically for text classification problems. It can more efficiently self-learn and extract local features in text through convolution and pooling operations, and map text representations to classification labels through fully connected layers. Compared with traditional text classification methods, TextCNN can process texts of different lengths and has shown good performance in some text classification tasks.

[0097] The second base classifier structure is as follows Figure 4 As shown in the figure, it mainly includes input layer, convolution layer, pooling layer and fully connected layer. Among them, the task of the input layer is to convert the API sequence into the corresponding vector representation through the word embedding mechanism. In order to fully abstract the local features in different fields of view within the sequence, the convolution layer of the original TextCNN is improved. The convolution kernels with window sizes of 2, 3, 4, and 5 are selected respectively. The vector representation of the API call sequence after word embedding is convoluted to automatically extract the feature vector; the maximum pooling operation is used in the pooling layer, and the different convolution outputs of the convolution layer are processed separately, and further extracted and reduced in dimension. The output of the pooling layer is cascaded and spliced ​​to obtain a 256-dimensional one-dimensional feature vector as the final output of the pooling layer. In order to convert the output vector of the pooling layer into the required prediction result, a softmax layer is added for flattening, and finally the predicted classification label is output. The model contains only one layer of convolution and one layer of pooling, with a simple structure, which helps to improve the training speed and classification performance.

[0098] Specifically, TextCNN is different from graph convolution in that graph convolution is a two-dimensional convolution kernel that slides from left to right and from top to bottom. However, for API sequences, it does not make sense to perform convolution operations on multiple APIs from left to right. Therefore, a one-dimensional convolution is used here to extract features from the sequence. The sequence is uniformly represented as a k-dimensional word vector, and the sequence of length n is represented by the following formula:

[0099] x 1:n =[x1,x2,...,xn ] (7)

[0100] where x 1:n is a sequence of length n, x i ∈R k Represents the i-th API in the sequence.

[0101] Convolution kernel w∈R hk Used to perform convolution operations. Four convolutions are designed in this paper, with window values ​​of 2, 3, 4, and 5 respectively. The general representation of features is as follows:

[0102] c i =f(w·x i:i+h-1 +b) (8)

[0103] Among them, x i:i+h-1 is the convolution window, h is the convolution window size, c i Represented by the convolution window x i:i+h-1 The generated features, b is the bias term, f represents the nonlinear function, w is the convolution kernel and w∈R hk .

[0104] The convolution kernel w with a window size of h performs convolution processing from top to bottom on the sequence vector generated by word embedding. The width of the convolution is consistent with the dimension of the word vector. Such a convolution operation can take into account both semantics and word order.

[0105] The convolution process can be described by the following formula:

[0106] {X 1:h ,X 2:h+1 ,X 3:h+2 ,...,X h+1:n} (9)

[0107] Among them, X h+1:n is the convolution window.

[0108] After such a convolution operation, a feature vector of the following form can be obtained:

[0109] c=[c1,c2,c3,...,c n-h+1 ] (10)

[0110] Among them, c is the feature vector after convolution, c n-h+1 is the n-h+1th element in the eigenvector.

[0111] The pooling layer uses the maximum pooling operation. Through the 1-Max-pooling operation, each convolution feature vector is pooled into one value. After the pooling is completed, all the pooled values ​​are concatenated to obtain the final output of the pooling layer. To prevent overfitting, two dropouts with different ratios are added to sparse the fully connected layer. Finally, the fully connected layer outputs the classification label.

[0112] Example 4

[0113] Based on the above embodiments, an embodiment of the present invention provides a process for constructing a third base classifier.

[0114] The third base classifier did not select a ready-made model, but combined the CNN and LSTM neural network models to build a malware family classification model based on CNN+LSTM to achieve family classification of malware samples. According to task requirements, the model designed multiple layers with different functions, including embedding layer, convolution layer, pooling layer, LSTM layer and fully connected layer, and used Softmax for classification. The structure of the third base classifier is as follows: Figure 5 shown.

[0115] Among them, the embedding layer performs word embedding processing on the dynamic API call sequence of the input malware sample and converts it into a vector representation for learning the family features in the sample file; the convolution layer and maximum pooling are used to extract the spatial features contained in the dynamic API sequence. Two sets of such processing are designed for the base classifier, using convolution kernels of different sizes to better capture features of different sizes and achieve dimensionality reduction of the extracted spatial features; the LSTM layer is used to capture the long-term dependency information in the dynamic API call sequence to learn the temporal features and semantic information contained in the sample; the fully connected layer maps the LSTM layer output to the target category (i.e., the malware family) and uses Softmax for classification.

[0116] Word embedding is chosen here instead of One-Hot Encoding which is commonly used in existing methods because all words have equal status in One-Hot Encoding, which will cause the dependency relationship between words to be ignored, which is very important information in the dynamically collected API call sequence. Therefore, choosing One-Hot Encoding will cause feature loss in the preprocessing stage, which will inevitably affect the classification results. On the other hand, the encoding mechanism of One-Hot Encoding will cause the dimension of the input vector to be very large, and too many zero values ​​will make the features too sparse and redundant, thus affecting the final classification effect.

[0117] The convolution layer in the base classifier selects one-dimensional convolution because the feature here is a sequence rather than an image. One-dimensional convolution is a convolution operation specifically used to process sequence data. Unlike two-dimensional convolution, one-dimensional convolution only performs convolution operations in one direction and is usually used to extract local features in a sequence. Here, the behavior order relationship reflected by the API sequence is extracted. The range of continuous operations of interest can be adjusted according to the size of the convolution kernel. The LSTM layer selected for the recurrent neural network layer can effectively maintain long-term dependency information and capture the semantic relationship in the sequence. Here, the corresponding extraction is the long-term dependency call relationship of the API sequence, which can reflect the behavior association logic of the sample to a certain extent.

[0118] The pooling layer chooses to use maximum pooling because it retains the most significant original feature information while reducing the dimension, which can make the model more robust and able to adapt to changes such as slight offsets and noise in the input data.

[0119] The fully connected layer linearly combines the outputs of the previous layers and performs nonlinear transformations through activation functions. The principle is to expand the input data into a one-dimensional vector, perform linear transformations through a weight matrix, and then use the activation function to process the final output. Softmax was selected as the activation function of the base classifier because it is more suitable for multi-category classification tasks and meets the research needs of malware family classification. The principle of Softmax is to first calculate the score of each category (that is, the original output in exponential form), and then normalize all scores to obtain a probability estimate for each category. Specifically, for a multi-classification problem with n categories, Softmax outputs an n-dimensional vector, where each element represents the probability estimate of the corresponding category, and the sum of all elements is 1. Its specific definition is shown in the following formula:

[0120]

[0121] where x i is the output value of the ith node, C is the number of output nodes, that is, the number of classification categories, For c The Softmax function can be used to convert the output values ​​of multiple categories into a probability distribution ranging from [0, 1] and 1.

[0122] Example 5

[0123] Based on the above embodiments, an embodiment of the present invention provides a model integration optimization method based on XGBoost.

[0124] XGBoost is an improved tree boosting machine learning algorithm. It is an improvement on the gradient boosting decision tree (GBDT). It uses optimization techniques such as sparse matrices and cache blocks to further improve model performance. It is an efficient integrated learning method.

[0125] XGBoost uses the gradient boosting algorithm to improve the performance of the ensemble model. By sequentially building K classification and regression trees, the prediction results are as close to the true value as possible and have the greatest generalization ability. The gradient boosting algorithm iteratively trains the base classifiers to minimize the error between the prediction results of each base classifier and the true label, so as to build a new ensemble learning classifier with relatively stronger performance through training. Unlike the voting method, the integration of XGBoost is serial. Each base classifier learns the error between the result of the previous base classifier and the actual value. In each iterative learning process, the new decision tree will be added to the ensemble model and weighted averaged to improve the overall prediction performance. Through the learning of multiple models, the error between the model value and the actual value can be continuously reduced, that is, the predicted value is closer to the actual value, achieving a higher prediction accuracy. By training one base classifier after another, new trees are continuously generated, and the final output is shown in the following formula, that is, the results of all trees are accumulated to obtain the predicted value of a sample.

[0126] The working principle of XGBoost can be expressed by the following formula:

[0127]

[0128]

[0129]

[0130]

[0131] in, is the model prediction result after the nth round of iterative learning, yi is the actual value, and f k (x i ) is the prediction result of the kth base classifier.

[0132] Each step of the selection and generation of trees in the above training process is guided by its specific objective function. XGBoost consists of three parts: objective function, regularization term, and decision tree structure. The objective function is used to define the optimization goal of the model, including loss function and regularization term. The decision tree structure can search for the best split point through a greedy algorithm and output a predicted value at each leaf node. XGBoost upgrades the loss function from first-order to second-order Taylor expansion based on GBDT, so it converges faster; introducing regularization terms in the loss function to limit the complexity of the tree also helps to avoid overfitting.

[0133] To obtain a better model for XGBoost ensemble learning, we must first select the loss function and optimizer according to the training objectives. The present invention selects multivariate classification cross entropy as the loss function and selects softmax as the activation function to achieve the optimization of the malware family classification model.

[0134] The optimization algorithms for the model mainly include stochastic gradient descent optimization algorithm, momentum optimization algorithm, and adaptive learning rate optimization algorithm. This article selects the most appropriate optimization method to optimize the model based on the training accuracy value.

[0135] Among them, gradient descent is the most basic and most commonly used optimization algorithm. Its core idea is to update the parameters in the direction of the negative gradient in each iteration to minimize the loss function. Specifically, the gradient descent algorithm can be expressed as follows:

[0136]

[0137] Among them, L(θ t ) is the current loss function, θ t Indicates that the tth iteration is the parameter of the loss function, is the gradient of the loss function and α is the learning rate.

[0138] The momentum optimization algorithm is an improvement on the gradient descent algorithm. Its main idea is to introduce the influence of historical gradients when updating parameters to accelerate convergence and improve model generalization performance. Specifically, the momentum optimization algorithm can be expressed according to the following formula:

[0139]

[0140] in, is the gradient of the loss function, α is the learning rate, β is the momentum decay coefficient, and v t is the momentum at the tth iteration.

[0141] Adaptive learning rate optimization algorithms are also optimization algorithms that adaptively adjust the learning rate based on gradient information. Common ones include AdaGrad, RMSProp, and Adam. These algorithms adaptively adjust the learning rate in different ways to better adapt to the characteristics of different parameters and the training process at different stages. This paper selects three optimization algorithms, RMSprop, Adam, and SGD, for training respectively to select the most suitable optimization algorithm to optimize the integrated model. The learning curve is as follows: Figure 6 shown.

[0142] Through comparative experiments, we finally selected the most stable RMSProp optimizer in the corresponding dataset samples of this paper. Figure 6 From the training results, we can see that the RMSProp optimizer has higher accuracy and better stability than the other two optimizers. Therefore, in the optimization of the integrated model, the RMSProp optimization algorithm is selected to optimize the integrated learning classification model.

[0143] Example 6

[0144] Corresponding to the above method, such as Figure 7 As shown, an embodiment of the present invention provides a malware family classification system based on dynamic features and ensemble learning, including:

[0145] The feature extraction module is used to extract the dynamic application programming interface API call sequence of each malicious code in the training malware, and summarize the dynamic API call sequence as the original feature.

[0146] The first base classifier module is used to build a bidirectional long short-term memory neural network Bi-LSTM model as the first base classifier.

[0147] The second base classifier module is used to build a text convolutional neural network TextCNN model as the second base classification.

[0148] The third base classifier module is used to build a convolutional neural network CNN + long short-term memory neural network LSTM model as the third base classifier.

[0149] The ensemble learning classifier module is used to use the original features as the input of three base classifiers respectively, and iteratively train the three base classifiers through the extreme gradient boosting algorithm. After the training is completed, an ensemble learning classification model is obtained as the malware family classification model.

[0150] The classification module is used to classify all malicious codes in the target malware into malware families using the malware family classification model.

[0151] It should be noted that the malware family classification system based on dynamic features and ensemble learning provided in the embodiment of the present invention is to implement the above-mentioned malware family classification method based on dynamic features and ensemble learning. Its specific functions can be referred to the above-mentioned method embodiments, which will not be repeated here.

[0152] In summary, the present invention extracts feature data through a dynamic analysis method, avoiding the influence of code obfuscation and other technologies on feature extraction. The dynamically extracted malware API sequence features are comprehensively learned by setting three base classifiers: Bi-LSTM model, TextCNN model and CNN+LSTM model. The three base classifiers are iteratively trained through the extreme gradient boosting algorithm, and the three base classifiers are merged to complete the construction of the ensemble learning classification model. The malware family is classified through ensemble learning, which improves the classification accuracy.

Claims

1. Malware family classification method based on dynamic features and ensemble learning, characterized by: The following steps are involved: Step 1: Extract the dynamic application programming interface API call sequence of each malicious code in the training malware, and summarize the dynamic API call sequence as the original feature; Step 2: Build a bidirectional long short-term memory neural network Bi-LSTM model as the first base classifier; Step 3: Build a text convolutional neural network TextCNN model as the second base classifier; Step 4: Build a convolutional neural network CNN + long short-term memory neural network LSTM model as the third base classifier; Step 5: Use the original features as the input of the three base classifiers respectively, and iteratively train the three base classifiers through the extreme gradient boosting algorithm. After the training is completed, an integrated learning classification model is obtained as the malware family classification model; Step 6: Classify all malicious codes in the target malware into malware families using the malware family classification model.

2. The method and system for malware family classification based on dynamic features and ensemble learning according to claim 1, characterized in that: In the step 2, an attention layer is introduced into the Bi-LSTM model, and a neural network model of Bi-LSTM and attention mechanism is constructed as the first base classifier.

3. The malware family classification method based on dynamic features and ensemble learning according to claim 1 is characterized in that: In the step 3, the convolution layer in the TextCNN model includes four convolution kernels of different sizes, and a normalized exponential function softmax layer is added after the fully connected layer.

4. The malware family classification method based on dynamic features and ensemble learning according to claim 1 is characterized in that: In the step 4, the third base classifier includes an embedding layer, two groups of convolution blocks, a long short-term memory neural network LSTM layer and a fully connected layer in sequence, wherein each group of convolution blocks includes a convolution layer and a pooling layer, the convolution layer selects one-dimensional convolution, the pooling layer adopts a maximum pooling operation, and a normalized exponential function softmax layer is added after the fully connected layer for classification.

5. The malware family classification method based on dynamic features and ensemble learning according to claim 1 is characterized in that: In the step 5, during training, multi-classification cross entropy is selected as the loss function.

6. The malware family classification method based on dynamic features and ensemble learning according to claim 1 is characterized in that: In the step five, the ensemble learning classification model is optimized by an optimization algorithm, and the optimization algorithm adopts any one of a stochastic gradient descent optimization algorithm, a momentum optimization algorithm, and an adaptive learning rate optimization algorithm.

7. Malware family classification system based on dynamic features and ensemble learning, characterized by: include: A feature extraction module is used to extract a dynamic application programming interface (API) call sequence of each malicious code in the malware, and summarize the dynamic API call sequence as an original feature; The first base classifier module is used to build a bidirectional long short-term memory neural network Bi-LSTM model as the first base classifier; The second base classifier module is used to build a text convolutional neural network TextCNN model as the second base classifier; The third base classifier module is used to build a convolutional neural network CNN + long short-term memory neural network LSTM model as the third base classifier; The ensemble learning classifier module is used to use the original features as the input of the three base classifiers respectively, and iteratively train the three base classifiers through the extreme gradient boosting algorithm. After the training is completed, an ensemble learning classification model is obtained as the malware family classification model; The classification module is used to classify all malicious codes in the target malware into malware families using the malware family classification model.

8. The malware family classification system based on dynamic features and ensemble learning according to claim 7, characterized in that: In the first base classifier module, an attention layer is introduced into the Bi-LSTM model, and a neural network model of Bi-LSTM and attention mechanism is constructed as the first base classifier.

9. The malware family classification system based on dynamic features and ensemble learning according to claim 7, characterized in that: In the second base classifier module, the convolution layer in the TextCNN model includes four convolution kernels of different sizes, and a normalized exponential function softmax layer is added after the fully connected layer.

10. The malware family classification system based on dynamic features and ensemble learning according to claim 7, characterized in that: In the third base classifier module, the third base classifier includes an embedding layer, two groups of convolution blocks, an LSTM layer and a fully connected layer in sequence, wherein each group of convolution blocks includes a convolution layer and a pooling layer, the convolution layer selects one-dimensional convolution, the pooling layer adopts the maximum pooling operation, and a normalized exponential function softmax layer is added after the fully connected layer for classification.

Images