Adversarial sample generation method of deep learning malicious software detection model

Abstract

The invention discloses an adversarial sample generation method for a deep learning malicious software detection model, and the method comprises the steps: data selection and preprocessing: selecting a representative benign behavior sequence as a state space, and carrying out the standardization, normalization and dimension reduction processing of original behavior sequence data; code sequence modification: aiming at the selected representative benign behavior sequence, searching an optimal malicious behavior insertion position and keeping a malicious function, optimizing a modification strategy by using reinforcement learning, and generating a confrontation sequence; and adversarial samples are generated, quality evaluation is carried out on the generated adversarial sequences, the adversarial sequences are input into a malicious software detection model for detection, and after detection of the detection model is evaded, the sequences are mapped back to source codes to generate new malicious software for subsequent research and training. According to the method, efficient generation and optimization of the resistance sample are realized, the malicious software detection model is helped to be researched and optimized, and the malicious software detection performance and reliability based on adversarial training are helped to be improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and specifically relates to a method for generating adversarial samples of a deep learning malware detection model. Background Art

[0002] With the rapid development of the Internet, network security issues have become increasingly severe, and the threats of malware have become increasingly complex and diverse. Traditional malware detection technologies based on signatures and rules have been unable to cope with attacks from new and variant malware. In order to improve detection efficiency and accuracy, researchers have begun to introduce detection methods based on machine learning and deep learning, especially sequence-based deep learning models, such as recurrent neural networks (RNNs) and long short-term memory networks (LSTMs). With the support of these deep learning models, the accuracy of malware detection has been significantly improved. However, with the development of these advanced technologies, attackers are also constantly exploring and exploiting the vulnerabilities of the models to bypass the detection mechanism. Adversarial attacks are a new type of attack that emerged in this context. Attackers make subtle perturbations to the input data, causing the deep learning model to make incorrect judgments during classification. Specifically in the field of malware detection, attackers can generate adversarial samples so that malware can disguise itself as benign software, thereby successfully evading detection.

[0003] In order to improve the robustness and adaptability of malware detection models, it is necessary to generate corresponding adversarial samples for research and adversarial training of detection models. The generation of adversarial samples usually relies on the modification of behavior sequences. Common methods include deleting key actions in malicious behavior sequences, replacing specific behavior features, or inserting benign operations that are not related to malicious behavior into behavior sequences. Although these methods can effectively interfere with the judgment of classifiers in some cases and cause malware to be misclassified as benign software, they also have obvious limitations. Deleting or replacing key behaviors may destroy the core functions of malware and affect the realization of its malicious intent. Simply inserting benign behaviors may introduce unreasonable behavior sequences, causing adversarial samples to be detected as abnormal. Summary of the invention

[0004] The main purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art and to propose a method, system, device and storage medium for generating adversarial samples of a deep learning malware detection model.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] A method for generating adversarial samples for a deep learning malware detection model includes the following steps:

[0007] Data selection and preprocessing: select representative benign behavior sequences as state space, and standardize, normalize and reduce the dimension of the original behavior sequence data;

[0008] Code sequence modification: for a selected representative benign behavior sequence, find the best location to insert malicious behavior and maintain malicious functions, and use reinforcement learning to optimize the modification strategy until it evades the detection of the malware detection model, thereby generating an adversarial sequence;

[0009] Adversarial sample generation, quality assessment of the generated adversarial sequences, input into the malware detection model for detection, and after evading the detection model, map the sequences back to the source code to generate new malware for subsequent research and training.

[0010] The present invention also includes an adversarial sample generation system for a deep learning malware detection model, the system adopts the adversarial sample generation method provided by the present invention, including a data selection and preprocessing module, a code sequence modification model, and an adversarial sample generation module;

[0011] The data selection and preprocessing module is used to select representative benign behavior sequences as the state space, and standardize, normalize and reduce the dimension of the original behavior sequence data;

[0012] The code sequence modification module is used to find the best location to insert malicious behavior and maintain malicious functions for the selected representative benign behavior sequence, and use reinforcement learning to optimize the modification strategy until it evades the detection of the malware detection model, thereby generating an adversarial sequence;

[0013] The adversarial sample generation module is used to evaluate the quality of the generated adversarial sequences and input them into the malware detection model for detection. After evading the detection model, the sequences are mapped back to the source code to generate new malware for subsequent research and training.

[0014] The present invention also includes a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the adversarial sample generation method provided by the present invention is implemented.

[0015] The present invention also includes a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the adversarial sample generation method provided by the present invention.

[0016] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0017] 1. The present invention can effectively select and insert the most appropriate malicious behavior through the gradient-based insertion strategy and DQN reinforcement learning algorithm, thereby generating adversarial samples that are difficult to be recognized by the detection model. Compared with the traditional simple behavior insertion or replacement method, the adversarial sample generation process of the present invention is more sophisticated and intelligent, which significantly improves the concealment of adversarial samples, enabling them to successfully evade detection without destroying the original malicious functions, and better help researchers optimize malware detection models.

[0018] 2. When disturbing the behavior of malware, the present invention retains the original functions of the malware and ensures that the adversarial samples remain logically consistent through automated code modification and optimization processes. At the same time, the expected malicious operations can still be performed in the target system. Compared with traditional methods, the present invention achieves a better balance between functionality and adversarial nature.

[0019] 3. The present invention not only stays at the theoretical level, but also provides a processing flow for actual malicious code, including code modification at the LLVM IR level, perturbation insertion of system calls, and final generation of executable files. Through these operations, the present invention can generate adversarial samples with practical value in a real environment and enhance the defense capability against malicious code.

[0020] 4. The present invention combines a variety of adversarial technologies, including gradient analysis of behavior sequences, reinforcement learning strategy selection, automated code modification, etc., to form a comprehensive adversarial mechanism. These multi-level adversarial mechanisms work together to greatly improve the diversity and effectiveness of adversarial samples, enabling them to show strong adaptability when facing different types of detectors, helping to improve the performance and reliability of malware detection based on adversarial training. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a schematic diagram of the present invention. DETAILED DESCRIPTION

[0022] The present invention is further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0023] Example

[0024] like Figure 1 As shown, the present invention provides a method for generating adversarial samples of a deep learning malware detection model, comprising the following steps:

[0025] S1. Data selection and preprocessing: select representative benign behavior sequences as state space, and standardize, normalize and reduce the dimension of the original behavior sequence data; specifically:

[0026] Import the malware and benign software datasets into the Cuckoo sandbox for analysis and extract the API call statistics in JSON format;

[0027] In order to construct a feature space with a fixed dimension m, all dynamic API calls are first aggregated into a set, which contains M different API call items and their corresponding behavior sequences;

[0028] Then, the M APIs are one-hot encoded as features and used as training sets. The data of the training sets are classified into two categories using the random forest algorithm, and the features with the largest classification weights of the first m are selected.

[0029] The set of behavior sequences is represented as:

[0030]

[0031] in, represents the i-th behavior feature, i = 1, 2, ..., N; N is the total length of the behavior sequence set; each behavior sequence is represented as:

[0032]

[0033] in, is the jth behavior feature vector, j = 1, 2, …, T; T is the length of the sequence;

[0034] For each behavior sequence Calculate its statistical characteristics, including the mean Standard Deviation Kurtosis and skewness

[0035]

[0036] Construct the statistical characteristics of each sequence into a feature vector, Represents the feature vector of the i-th benign sequence;

[0037] Perform cluster analysis on all feature vectors and use the K-means clustering algorithm to divide the benign sequences into K cluster groups:

[0038] C={C1,C 21 , ...C K}

[0039] Among them C K represents the Kth cluster, containing similar benign sequence features; for each cluster C K , select a set of benign subsequences that best represents the characteristics of this class The selection criterion is the sequence closest to the cluster center, that is:

[0040]

[0041] Among them, c k is cluster C K the center of

[0042] A set of representative subsequences selected from each cluster Select the most suitable benign subsequence S for inserting malicious behavior b , selection was performed based on sequence diversity and uniformity.

[0043] S2. Code sequence modification: for the selected representative benign behavior sequence, find the best location to insert malicious behavior and maintain malicious functions, and use reinforcement learning to continuously optimize the modification strategy until it evades the detection of the malware detection model, thereby generating an adversarial sequence; specifically:

[0044] After selecting representative benign subsequences, the gradient information of the deep learning model is used to guide the generation of adversarial samples. The optimal position for inserting malicious behavior is determined by calculating the influence of each position in the sequence on the model output, including:

[0045] Original benign behavior sequence in represents the i-th benign behavior feature, i = 1, 2, ..., T; T is the total length of the behavior sequence;

[0046] The pre-trained malware deep learning detection model is denoted as f(·), and its output f(S) represents the probability that the input sequence S is judged as malware. Malicious behavior sequence in represents the i-th malicious behavior feature, i = 1, 2, …, k; k is the total length of the malicious behavior sequence.

[0047] For each position t, calculate the change in the model output after inserting the malicious behavior sequence at that position; first, calculate the original malicious sequence S m The model output f(S m ), where t = 1, 2, …, T;

[0048] For each position t, construct a new sequence S′ t , the malicious behavior sequence S m Insert at position t:

[0049]

[0050] Calculate the new sequence S′ after insertion t The model output f(S′t );

[0051] Gradient change Δf at each insertion position t t It is expressed as:

[0052] Δf t =f(S m )-f(S′ t )

[0053] Where Δf t It represents the change in the model output after the malicious behavior is inserted at position t;

[0054] Choose the gradient change Δf t The maximum position t * As the best insertion position:

[0055] t * = arg max t Δf t

[0056] This position corresponds to the insertion point that has the greatest impact on the model output and is the most likely location for malicious behavior to evade detection. * Insert malicious behavior sequence S m , generate a new adversarial sequence S′:

[0057]

[0058] The insertion strategy based on iterative gradient descent generates effective adversarial samples by sequentially trying the insertion position with the largest gradient until a position is found that successfully deceives the malware detection model; if it fails at all possible insertion points, the malicious behavior sequence or generation strategy is re-evaluated.

[0059] In order to insert the most appropriate malicious behavior at the selected location, the selection problem of the inserted behavior is modeled as a reinforcement learning problem. DQN is used to try to find the behavior sequence insertion action that can best deceive the detection model, including:

[0060] First, the set of available malicious behaviors is represented as in represents a candidate malicious behavior, i = 1, 2, ..., N, N is the number of malicious behaviors; the state of the current behavior sequence s t Defined as the current benign sequence S b and the selected malicious behavior sequence S m Combination of and selection of insertion position t * ,s t It is expressed as:

[0061]

[0062] in, Indicates the malicious behavior sequence currently inserted;

[0063] Action a t Defined as the malicious behavior set A m Select a behavior Insert into the current sequence and update the sequence to S′ t+1 ; The action space is the candidate malicious behavior set A m ;

[0064] Reward function R(s t ,a t ) is used to evaluate the effect of each insertion action. The positive reward in the reward function includes the positive reward R for escaping detection. escape , maintain the positive reward R of malicious function malicious and the positive reward R for behavior concealment stealth ; Negative reward is the detected negative reward R detected ; The calculation formulas are as follows:

[0065] If the inserted sequence S′ successfully evades the malware detection model, a positive reward is given; this reward is calculated based on the inversion value output by the detection model to encourage the model to output the lowest possible malicious probability;

[0066]

[0067] Among them, r escape is a benchmark reward value, f(S′ t ) is the model output (malicious probability) of the inserted sequence, and τ is the detection threshold;

[0068] If the inserted sequence still maintains the malicious behavior function, a positive reward is given; the degree of malicious behavior function preservation is measured by the objective function g(S ′ ) measure, g(S ′ ) The output of the function is 0 or 1, indicating whether the function is successfully maintained;

[0069] R malicious =r malicious ×g(S′)

[0070] Among them, r malicious is the baseline reward value, g(S′) returns 1 to indicate that the function is retained, and returns 0 to indicate that the function is lost;

[0071] The hidden reward is based on the similarity between the insertion behavior and the benign behavior. The higher the similarity, the higher the reward.

[0072] R stealth=r stealth ×similarity(a t ,nearby benign behaviors)

[0073] Among them, r stealth is the benchmark reward value, similarity(a t ,nearby benign behaviors) is the similarity score between the insertion behavior and the nearby benign behaviors (normalized to [0,1]);

[0074] If the inserted sequence is identified as malicious by the detection model (i.e., the model output is higher than or equal to the detection threshold τ), a negative reward is given; the negative reward can be weighted by the high value of the model output to penalize sequences with high malicious probability;

[0075]

[0076] Among them, r detected is the baseline penalty value, when f(S′ t ) is much larger than τ, the penalty is greater;

[0077] Combining positive and negative rewards, we get the total reward function R(s t ,a t ):

[0078] R(s t ,a t )=w escape ×R escape +w malicious ×R malicious +w stealth ×R stealth +w detected ×R detected

[0079] Among them, w escape 、w malicious 、w stealth 、w detected It is the weight of each reward or punishment, which controls the influence of each reward in the total reward;

[0080] Use the DQN algorithm to update the Q value function Q(s t ,a t |θ), and use the Q value to guide each step to select the appropriate malicious behavior insertion action:

[0081]

[0082] Among them, α is the learning rate, γ is the discount factor, θ is the parameter of the current policy network, and θ ′ are the parameters of the target network.

[0083] Use the ∈-greedy strategy to select actions, that is, select the action with the largest current Q value with probability 1-∈, and select other actions with probability ∈; repeatedly execute actions until all malicious behaviors in the sequence have been inserted, or the reward function reaches a certain satisfactory threshold and can escape the detection of the detection model and retain its malicious function; after finding the optimal insertion strategy through the DQN algorithm, the generated adversarial sequence S ′ The sequence considered to be the one that can best deceive malware detection models.

[0084] S3, adversarial sample generation, quality assessment of the generated adversarial sequence, input into the malware detection model for detection, after evading the detection model, the sequence is mapped back to the source code to generate new malware for subsequent research and training; specifically:

[0085] After obtaining the adversarial sequence, it is transformed into a new malware executable file, including:

[0086] First, the malicious code is compiled into an LLVM intermediate representation file with debugging information. Then, the strace tool is used to obtain the system call sequence of the malicious code at runtime. These system calls are mapped to specific source code locations through the addr2line tool. The LLVM API is used to automatically insert the predetermined code sequence at these determined code locations. After successful insertion, the LLVM debugging information generation tool is used to ensure that the inserted code does not change the original behavior of the malware or introduce new problems.

[0087] Finally, the modified intermediate representation file is recompiled to generate an executable file, namely the adversarial sample, which is used for subsequent research and adversarial training.

[0088] In another embodiment, an adversarial sample generation system for a deep learning malware detection model is also provided, the system adopts the adversarial sample generation method described in the above embodiment, including a data selection and preprocessing module, a code sequence modification model, and an adversarial sample generation module;

[0089] The data selection and preprocessing module is used to select representative benign behavior sequences as the state space, and standardize, normalize and reduce the dimension of the original behavior sequence data;

[0090] The code sequence modification module is used to find the best location to insert malicious behavior and maintain malicious functions for the selected representative benign behavior sequence, and use reinforcement learning to optimize the modification strategy until it evades the detection of the malware detection model, thereby generating an adversarial sequence;

[0091] The adversarial sample generation module is used to evaluate the quality of the generated adversarial sequences and input them into the malware detection model for detection. After evading the detection model, the sequences are mapped back to the source code to generate new malware for subsequent research and training.

[0092] In another embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the adversarial sample generation method described in the above embodiment is implemented.

[0093] In another embodiment, a computer-readable storage medium is provided, storing a computer program. When the computer program is executed by a processor, the adversarial sample generation method described in the above embodiment is implemented.

[0094] It should also be noted that in this specification, terms such as "comprises", "includes" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of more restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0095] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for generating adversarial samples for a deep learning malware detection model, characterized in that: The following steps are involved: Data selection and preprocessing: select representative benign behavior sequences as state space, and standardize, normalize and reduce the dimension of the original behavior sequence data; Code sequence modification: for a selected representative benign behavior sequence, find the best location to insert malicious behavior and maintain malicious functions, and use reinforcement learning to optimize the modification strategy until it evades the detection of the malware detection model, thereby generating an adversarial sequence; Adversarial sample generation, quality assessment of the generated adversarial sequences, input into the malware detection model for detection, and after evading the detection model, map the sequences back to the source code to generate new malware for subsequent research and training.

2. The method for generating adversarial samples of a deep learning malware detection model according to claim 1, characterized in that: Data selection, specifically: Import the malware and benign software datasets into the Cuckoo sandbox for analysis and extract the API call statistics in JSON format; Construct a feature space with a fixed dimension m. First, all dynamic API calls are aggregated into a set, which contains M different API call items to represent their corresponding behavior sequences; One-hot encode the M API call items as features and use them as training sets. Use the random forest algorithm to classify the training set data into two categories and select the features with the largest classification weights for the first m items. The set of behavior sequences is represented as: in, represents the i-th behavior sequence, i = 1, 2, ..., N; N is the total length of the behavior sequence set; each behavior sequence is represented as: in, is the jth behavior feature vector, j = 1, 2, …, T; T is the length of the sequence; For each behavior sequence Calculate its statistical characteristics, including the mean Standard Deviation Kurtosis and skewness Construct the statistical characteristics of each sequence into a feature vector, Represents the eigenvector of the i-th benign sequence; Perform cluster analysis on all feature vectors and use the K-means clustering algorithm to divide the benign sequences into K cluster groups: C={C1,C 21 ,...C K } Among them C K represents the Kth cluster, containing similar benign sequence features; for each cluster C K , select a set of benign subsequences that best represents the characteristics of this class The selection criterion is the sequence closest to the cluster center, that is: Among them, c k is cluster C K the center of; A set of representative subsequences selected from each cluster Select the most suitable benign subsequence S for inserting malicious behavior b , selection was performed based on sequence diversity and uniformity.

3. The method for generating adversarial samples of a deep learning malware detection model according to claim 1, characterized in that: The code sequence modification is as follows: After selecting representative benign subsequences, the generation of adversarial samples is guided by the gradient information of the deep learning model. The optimal position for inserting malicious behavior is determined by calculating the influence of each position in the sequence on the model output, including: Original benign behavior sequence in represents the i-th benign behavior feature, i = 1, 2, ..., T; T is the total length of the behavior sequence; The pre-trained malware detection deep learning model is denoted as f(·), and its output f(S) represents the probability that the input sequence S is judged as malware; the malicious behavior sequence in represents the i-th malicious behavior feature, i = 1, 2, ..., k; k is the total length of the malicious behavior sequence; For each position t, the change in the output of the deep learning model after inserting the malicious behavior sequence at that position is calculated, specifically: First, calculate the original malicious sequence S m The model output f(S m ), where t = 1, 2, …, T; For each position t, construct a new sequence S′ t , the malicious behavior sequence S m Insert at position t: Calculate the new sequence S′ after insertion t The model output f(S′ t ); Gradient change Δf at each insertion position t t It is expressed as: Δf t =f(S m )-f(S′ t ) Where Δf t It represents the change in the model output after the malicious behavior is inserted at position t; Choose the gradient change Δf t The maximum position t * As the best insertion position: t * =arg max t Δf t This position corresponds to the insertion point that has the greatest impact on the model output and is the most likely location for malicious behavior to evade detection. * Insert malicious behavior sequence S m , generate a new adversarial sequence S′:

4. The method for generating adversarial samples of a deep learning malware detection model according to claim 3, characterized in that: An insertion strategy based on iterative gradient descent is adopted to generate effective adversarial samples by trying the insertion position with the largest gradient in sequence until a position that can successfully deceive the malware detection model is found; if it fails at all possible insertion points, the malicious behavior sequence or generation strategy is re-evaluated.

5. The method for generating adversarial samples of a deep learning malware detection model according to claim 3, characterized in that: In order to insert the most appropriate malicious behavior at the selected location, the selection problem of the inserted behavior is modeled as a reinforcement learning problem. The DQN model is used to find the behavior sequence insertion action that can best deceive the detection model, including: First, the set of available malicious behaviors is represented as in represents a candidate malicious behavior, i = 1, 2, ..., N, N is the number of malicious behaviors; the state of the current behavior sequence s t Defined as the current benign sequence S b and the selected malicious behavior sequence S m Combination of and selection of insertion position t * ;s t It is expressed as: in, Indicates the malicious behavior sequence currently inserted; Action a t Defined as the malicious behavior set A m Select a behavior Insert into the current sequence and update the sequence to S′ t+1 ; The action space is the candidate malicious behavior set A m ; Reward function R(s t ,a t ) is used to evaluate the effect of each insertion action. The positive reward in the reward function includes the positive reward R for escaping detection. escape , maintain the positive reward R of malicious function malicious and the positive reward R for behavior concealment stealth ; Negative reward is the detected negative reward R detected ; The calculation formulas are as follows: If the inserted sequence S′ successfully evades the detection of the malware detection model, a positive reward is given; this reward is calculated based on the inversion value output by the detection model, expressed as; Among them, r escape is a benchmark reward value, f(S′ t ) is the model output of the inserted adversarial sample sequence, i.e., malicious probability, and τ is the detection threshold; If the inserted sequence still maintains the malicious behavior function, a positive reward is given; the degree of malicious behavior function preservation is measured by the objective function g(S′), and the output of the g(S′) function is 0 or 1, indicating whether the function is successfully maintained; R malicious =r malicious ×g(S′) Among them, r malicious is the baseline reward value, g(S′) returns 1 to indicate that the malicious function is retained, and returns 0 to indicate that the malicious function is lost; The hidden reward is based on the similarity between the insertion behavior and the benign behavior. The higher the similarity, the higher the reward. R stealth =r stealth ×similarity(a t ,nearby benign behaviors) Among them, r stealth is the benchmark reward value, similarity(a t ,nearby benign behaviors) is the similarity score between the insertion behavior and the nearby benign behaviors; If the inserted sequence is identified as malicious by the detection model, a negative reward is given; the negative reward is weighted by the high value output by the model to penalize sequences with high malicious probability; Among them, r detected is the baseline penalty value, when f(S′ t ) is much larger than τ, the penalty is greater; Combining positive and negative rewards, we get the total reward function R(s t ,a t ): R(s t ,a t )=w escape ×R escape +w malicious ×R malicious +w stealth ×R stealth +w detected ×R detected Among them, w escape 、w malicious 、w stealth 、w detected It is the weight of each reward or punishment, which controls the influence of each reward in the total reward; Use the DQN algorithm to update the Q value function Q(s t ,a t |θ), and use the Q value to guide each step to select the appropriate malicious behavior insertion action: Among them, α is the learning rate, γ is the discount factor, θ is the parameter of the current policy network, and θ ′ are the parameters of the target network.

6. The method for generating adversarial samples of a deep learning malware detection model according to claim 5, characterized in that: Use the ∈-greedy strategy to select actions, that is, select the action with the largest current Q value with probability 1-∈, and select other actions with probability ∈; repeatedly execute actions until all malicious behaviors in the sequence have been inserted, or the reward function reaches the preset threshold and can escape the detection of the detection model and retain its malicious function; after finding the optimal insertion strategy through DQN, the generated adversarial sequence S ′ The sequence considered to be the one that can best deceive malware detection models.

7. The method for generating adversarial samples of a deep learning malware detection model according to claim 1, characterized in that: The specific generation of adversarial samples is as follows: After obtaining the adversarial sequence, it is transformed into a new malware executable file, including: First, the malicious code is compiled into an LLVM intermediate representation file with debugging information. Then, the strace tool is used to obtain the system call sequence of the malicious code at runtime. These system calls are mapped to specific source code locations through the addr2line tool. The LLVM API is used to automatically insert the predetermined code sequence at these determined code locations. After successful insertion, the LLVM debugging information generation tool is used to ensure that the inserted code does not change the original behavior of the malware or introduce new problems. Finally, the modified intermediate representation file is recompiled to generate an executable file, namely the adversarial sample, which is used for subsequent research and adversarial training.

8. A system for generating adversarial samples for a deep learning malware detection model, characterized in that: The system adopts the adversarial sample generation method according to any one of claims 1 to 7, including a data selection and preprocessing module, a code sequence modification model, and an adversarial sample generation module; The data selection and preprocessing module is used to select representative benign behavior sequences as the state space, and standardize, normalize and reduce the dimension of the original behavior sequence data; The code sequence modification module is used to find the best location to insert malicious behavior and maintain malicious functions for the selected representative benign behavior sequence, and use reinforcement learning to optimize the modification strategy until it evades the detection of the malware detection model, thereby generating an adversarial sequence; The adversarial sample generation module is used to evaluate the quality of the generated adversarial sequences and input them into the malware detection model for detection. After evading the detection model, the sequences are mapped back to the source code to generate new malware for subsequent research and training.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images