Malicious sample attack behavior analysis method and equipment based on deep feature characterization

Abstract

The present application provides a method and device for analyzing malicious sample attack behaviors based on deep feature characterization. In one example, the method includes: visualizing the sample file to be detected, extracting static features from the sample file to be detected, and fusing the RGB image of the sample to be detected with the static feature information of the sample to be detected, and then inputting the RGB image of the sample to be detected after feature fusion into a trained autoencoder, and determining the classification result of the sample file to be detected based on the deep feature information of the sample to be detected and using a trained classifier. This method can improve the accuracy of malicious sample file detection.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and device for analyzing malicious sample attack behavior based on deep feature characterization. Background Art

[0002] Malicious samples (or malware) are software designed to cause damage to computer systems, steal information, or perform other malicious activities. They are usually executable programs. Such software includes viruses, Trojans, or worms. Malicious samples usually infect computer systems by disguising themselves as legitimate programs and perform malicious operations, such as stealing sensitive information or destroying files.

[0003] How to accurately identify malicious samples has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] In view of this, the present application provides a method and device for analyzing malicious sample attack behavior based on deep feature characterization.

[0005] Specifically, the present application is implemented through the following technical solutions:

[0006] According to a first aspect of an embodiment of the present application, a malicious sample attack behavior analysis based on deep feature characterization is provided, including:

[0007] Performing visualization processing on the sample file to be detected to obtain an RGB image of the sample to be detected corresponding to the sample file to be detected; and

[0008] Extracting static features of the sample file to be detected to obtain static feature information of the sample file to be detected corresponding to the sample file to be detected;

[0009] The RGB image of the sample to be detected is fused with the static feature information of the sample to be detected to obtain the RGB image of the sample to be detected after feature fusion;

[0010] Inputting the feature-fused RGB image of the sample to be detected into a trained autoencoder to obtain deep feature information of the feature-fused RGB image of the sample to be detected;

[0011] According to the deep feature information of the sample to be detected, the classification result of the sample file to be detected is determined by using a trained classifier; wherein the trained classifier is trained by a meta-learning training method.

[0012] According to a second aspect of an embodiment of the present application, a malicious sample attack behavior analysis device based on deep feature characterization is provided, comprising:

[0013] A visualization processing unit, used for performing visualization processing on the sample file to be detected to obtain an RGB image of the sample to be detected corresponding to the sample file to be detected; and

[0014] A static feature extraction unit, used to extract static features from the sample file to be detected, and obtain static feature information of the sample to be detected corresponding to the sample file to be detected;

[0015] A feature fusion unit, used for fusing the RGB image of the sample to be detected with the static feature information of the sample to be detected to obtain a feature-fused RGB image of the sample to be detected;

[0016] A deep feature extraction unit, used for inputting the RGB image of the sample to be detected after the feature fusion into a trained autoencoder to obtain the deep feature information of the sample to be detected after the feature fusion;

[0017] The classification unit is used to determine the classification result of the sample file to be detected based on the deep feature information of the sample to be detected and using the trained classifier; wherein the trained classifier is trained using a meta-learning training method.

[0018] According to a third aspect of an embodiment of the present application, there is provided an electronic device, including a processor and a memory, wherein:

[0019] Memory, used to store computer programs;

[0020] The processor is used to implement the method provided in the first aspect when executing the program stored in the memory.

[0021] According to a fourth aspect of an embodiment of the present application, a computer program product is provided, wherein a computer program is stored in the computer program product, and when the computer program is executed by a processor, the method provided in the first aspect is implemented.

[0022] The malicious sample attack behavior analysis method based on deep feature characterization in the embodiment of the present application performs visualization processing on the sample file to be detected to obtain an RGB image of the sample to be detected corresponding to the sample file to be detected, and performs static feature extraction on the sample file to be detected to obtain static feature information of the sample to be detected corresponding to the sample file to be detected, and fuses the RGB image of the sample to be detected with the static feature information of the sample to be detected to obtain an RGB image of the sample to be detected after feature fusion, and then inputs the RGB image of the sample to be detected after feature fusion into a trained automatic encoder to obtain deep feature information of the sample to be detected after feature fusion, and determines the classification result of the sample file to be detected by using the trained classifier based on the deep feature information of the sample to be detected, and by inputting the sample file to be detected into the RGB image of the sample to be detected after feature fusion, It is converted into an RGB image, and the static feature information corresponding to the RGB image and the sample file to be detected is fused, which enriches the feature information of the sample file to be detected, thereby improving the accuracy of malicious sample file detection; secondly, by using the trained automatic encoder to perform deep feature extraction on the RGB image of the sample to be detected after feature fusion, the sample file to be detected is classified according to the deep features of the sample to be detected, which improves the classification accuracy, and can more accurately detect malicious samples, thereby more effectively defending against attacks launched using malicious samples; in addition, by adopting the meta-learning training method in the training process of the classifier, the trained classifier can have better scene generalization ability, and thus can better adapt to the detection of malicious sample files in different scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A flowchart of a method for analyzing malicious sample attack behaviors based on deep feature characterization is shown as an exemplary embodiment of the present application;

[0024] Figure 2 A schematic diagram of an architecture of an automatic encoder and a training system for a classifier is shown as an exemplary embodiment of the present application;

[0025] Figure 3 A schematic diagram of a training process of an automatic encoder and a classifier shown as an exemplary embodiment of the present application;

[0026] Figure 4 A schematic diagram of the structure of a malicious sample attack behavior analysis device based on deep feature characterization is shown as an exemplary embodiment of the present application;

[0027] Figure 5 The figure is a schematic diagram of the hardware structure of an electronic device shown as an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the technical solutions provided by the embodiments of the present application, some technical terms involved in the embodiments of the present application are explained below.

[0029] 1. EfficientNet: EfficientNet is an efficient neural network architecture. Its core idea is to optimize network design through compound scaling method. This architecture is based on the MBConv module of MobileNetV2 and is scaled by the following formula:

[0030]

[0031] in, is a fixed scaling factor, while α, β, and γ are constants determined through experiments, which control the depth, width, and resolution of the input image of the network respectively. EfficientNet balances the different dimensions of the network and achieves efficient allocation of computing resources by adjusting these parameters.

[0032] 2. Generative Adversarial Networks (GANs) is a deep learning framework that consists of two parts: the generator and the discriminator. The core purpose of GANs is to generate new data that is similar to the real data distribution through the adversarial process of these two parts. Among them:

[0033] 2.1. Generator: Its goal is to generate data that is realistic enough to fool the discriminator so that it cannot distinguish between the generated data and the real data.

[0034] 2.2. Discriminator: Its goal is to accurately distinguish between generated data and real data.

[0035] Exemplarily, during the training process, the generator and the discriminator are optimized alternately, and the specific steps are as follows:

[0036] The generator receives random noise as input and tries to generate output that looks like real data samples.

[0037] The discriminator receives samples from the generator and the real dataset and tries to determine whether each sample is generated or real.

[0038] The loss functions of the generator and discriminator are optimized based on the judgment of the discriminator. The loss function of the generator pushes it to generate more realistic samples, while the loss function of the discriminator helps it better distinguish between real and generated samples.

[0039] This process is repeated until the generator is able to generate data that the discriminator cannot identify as fake, that is, the data distribution generated by the generator is close to the real data distribution.

[0040] 3. Meta-learning: Meta-learning is a method that enables a model to quickly learn on new tasks. By training the model on multiple related tasks, the model can learn how to quickly adapt to new tasks. Even with a small amount of data, the model can quickly learn new tasks using previously learned general knowledge.

[0041] 4. Contrastive learning: Contrastive learning is a method of learning representations by comparing positive and negative samples. Effective representations are learned by maximizing the similarity between positive samples (similar samples) and minimizing the similarity between negative samples (dissimilar samples). This method helps the model better understand the relationship between different samples, thereby obtaining better representations in unsupervised or semi-supervised learning.

[0042] 5. Transformer: Transformer is a deep neural network model based on the self-attention mechanism, which was originally designed to process sequence data, such as text in natural language processing. The success of Transformer lies in its ability to capture long-distance dependencies and process all elements in the sequence in parallel.

[0043] For example, the architecture features of Transformer are as follows:

[0044] Self-attention mechanism: The core of Transformer is its self-attention mechanism, which can capture the dependencies between different elements in a sequence.

[0045] Multi-head self-attention: In order to improve the expressiveness of the model, Transformer uses a multi-head self-attention mechanism to divide the input data into multiple subsequences and calculate the attention weight for each subsequence.

[0046] Feedforward Neural Network: After the self-attention mechanism, Transformer uses a feedforward neural network to further transform the features.

[0047] Residual connection: To alleviate the gradient vanishing and gradient exploding problems during training, Transformer uses residual connection to add the input data to the transformed data.

[0048] Layer Normalization: To increase the stability of the model, Transformer uses layer normalization technology in each layer.

[0049] In order to make the above-mentioned purposes, features and advantages of the embodiments of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application are further described in detail below with reference to the accompanying drawings.

[0050] See also Figure 1 , is a flow chart of a malicious sample attack behavior analysis method based on deep feature characterization provided in an embodiment of the present application, such as Figure 1 As shown, the malicious sample attack behavior analysis method based on deep feature characterization may include:

[0051] Step S100: Visualize the sample file to be detected to obtain an RGB image of the sample to be detected corresponding to the sample file to be detected.

[0052] Step S110: extract static features from the sample file to be detected, and obtain static feature information of the sample to be detected corresponding to the sample file to be detected.

[0053] In the embodiment of the present application, the sample file to be detected may include any sample file that needs to be detected to see if it is a malicious sample file.

[0054] In the process of detecting malicious sample files on the sample files to be detected, on the one hand, the sample files to be detected can be visualized.

[0055] In an embodiment of the present application, in the process of visualizing the sample file to be detected, the sample file to be detected is no longer converted into a grayscale image, but is converted into an RGB (Red, Green, Blue) image (which can be called an RGB image of the sample to be detected).

[0056] Since RGB images usually contain more features than grayscale images, converting the sample files to be detected into RGB images can enrich the features in the malicious sample file detection process and improve the accuracy of malicious sample file detection.

[0057] On the other hand, static feature extraction may be performed on the sample file to be detected to obtain static feature information corresponding to the sample file to be detected (which may be referred to as static feature information of the sample to be detected).

[0058] It should be noted that there is no necessary time sequence relationship between step S100 and step S110. Step S100 may be executed first and then step S110; step S110 may be executed first and then step S100; and step S100 and step S110 may be executed in parallel.

[0059] Step S120: Fusing the RGB image of the sample to be detected with the static feature information of the sample to be detected to obtain a feature-fused RGB image of the sample to be detected.

[0060] In an embodiment of the present application, when an RGB image of a sample to be detected and static feature information of the sample to be detected are obtained, the RGB image of the sample to be detected and the static feature information of the sample to be detected can be fused to obtain a RGB image of the sample to be detected after feature fusion, so as to enrich the features of the RGB image and thus improve the accuracy of malicious sample file detection.

[0061] Step S130: input the RGB image of the sample to be detected after feature fusion into the trained autoencoder to obtain the deep feature information of the sample to be detected after feature fusion.

[0062] Step S140: Determine the classification result of the sample file to be detected based on the deep feature information of the sample to be detected and using the trained classifier; wherein the trained classifier is trained using a meta-learning training method.

[0063] In an embodiment of the present application, when an RGB image of the sample to be detected is obtained after feature fusion, a trained autoencoder can be used to extract deep feature information of the sample to be detected after feature fusion, and based on the deep feature information of the sample to be detected, a trained classifier can be used to determine the classification result of the sample file to be detected.

[0064] Exemplarily, the trained classifier is trained using a meta-learning training method.

[0065] Exemplarily, the classification result of the sample file to be detected may include a category of a non-malicious sample file or a malicious sample file.

[0066] Exemplarily, whether there is malicious attack behavior can be determined based on the classification result of the sample file to be detected, and when it is determined that there is attack behavior, the type of attack behavior can be further determined based on the category of the malicious sample file.

[0067] For example, when the classification result of the sample file to be detected is a non-malicious sample file, it can be determined that there is currently no attack behavior; when the classification result of the sample to be detected is a malicious sample file (any category), it can be determined that there is currently an attack behavior.

[0068] In the case where the classification result of the sample to be detected is a malicious sample file, the type of attack behavior can be further determined based on the category of the malicious sample file.

[0069] Exemplarily, the categories of malicious sample files may include viruses, Trojan horses, or worms.

[0070] Among them, viruses can be used to destroy or damage systems or data; Trojans can be used to steal data; and worms can be used to consume bandwidth, occupy system resources, and cause system overload.

[0071] The attack types of the attack behavior may include Trojan attacks, virus attacks, or worm attacks.

[0072] It can be seen that in Figure 1 In the method flow shown, the sample file to be detected is visualized to obtain an RGB image of the sample to be detected corresponding to the sample file to be detected, and static feature extraction is performed on the sample file to be detected to obtain static feature information of the sample to be detected corresponding to the sample file to be detected, and the RGB image of the sample to be detected and the static feature information of the sample to be detected are fused to obtain the RGB image of the sample to be detected after feature fusion, and then, the RGB image of the sample to be detected after feature fusion is input into the trained automatic encoder to obtain the deep feature information of the sample to be detected after feature fusion, and according to the deep feature information of the sample to be detected, the classification result of the sample file to be detected is determined by using the trained classifier, and the sample file to be detected is converted into an RGB image and The feature fusion of the RGB image and the static feature information corresponding to the sample file to be detected enriches the feature information of the sample file to be detected, thereby improving the accuracy of malicious sample file detection; secondly, by using the trained automatic encoder to perform deep feature extraction on the RGB image of the sample to be detected after feature fusion, the sample file to be detected is classified according to the deep features of the sample to be detected, which improves the classification accuracy and can more accurately detect malicious samples, thereby more effectively defending against attacks launched using malicious samples; in addition, by adopting the meta-learning training method in the training process of the classifier, the trained classifier can have better scene generalization ability, and thus can better adapt to the detection of malicious sample files in different scenarios.

[0073] In some embodiments, performing visualization processing on the sample file to be detected to obtain an RGB image of the sample to be detected corresponding to the sample file to be detected may include:

[0074] Convert the sample to be detected into a binary data stream;

[0075] Use hexadecimal mapping technology to convert binary data stream into hexadecimal data stream;

[0076] In a manner where every two hexadecimal characters represent an 8-bit pixel value of a color channel, the hexadecimal data stream is converted into pixel values ​​of the RGB channel, and an RGB image of the sample to be detected corresponding to the sample file to be detected is obtained.

[0077] Exemplarily, in the process of visualizing the sample file to be detected, the sample file to be detected may be converted into a binary data stream, and a hexadecimal mapping technology is used to convert every 8 bits of binary data into a 2-bit hexadecimal string.

[0078] The obtained hexadecimal string can be split into groups of two strings.

[0079] For example, every two hexadecimal characters can represent an 8-bit pixel value of a color channel (R, G or B). The converted pixel value is filled into the R, G, and B channels in sequence to complete the visualization process of converting malicious samples to RGB images.

[0080] In some embodiments, the above-mentioned static feature extraction of the sample file to be detected to obtain the static feature information of the sample to be detected corresponding to the sample file to be detected may include:

[0081] Using a specified static feature analysis tool, extracting static features from the sample file to be detected;

[0082] The static features are numerically processed to obtain the static feature information of the sample to be detected corresponding to the sample file to be detected.

[0083] Exemplarily, the specified static feature analysis tool may include YARA (a tool for identifying and classifying malware) or ClamAV (a tool for detecting and removing malware), etc.

[0084] Since the static features obtained by extracting static features from the sample files to be detected may include non-numerical features, and the neural network model usually requires input in numerical form, the extracted static features can be numerically processed.

[0085] Exemplarily, for static features of string type, the digitization processing method includes converting into an integer using a hash function;

[0086] For Boolean or enumeration data, numerical processing methods include one-hot encoding;

[0087] For numerical data, the numerical processing method includes normalization processing.

[0088] Among them, one-hot encoding is a method of converting categorical variables into numerical form. In this encoding, each category is represented as a vector of length N, where N is the total number of categories. Only one position in the vector is 1 (indicating the category), and all other positions are 0.

[0089] For example, suppose there is a Boolean variable "whether employed", which can be one-hot encoded in the following way:

[0090] In service (True): [1, 0];

[0091] Not employed (False): [0, 1].

[0092] For another example, suppose there is an enumeration variable "color" with values ​​of red, green, and blue:

[0093] Red: [1, 0, 0];

[0094] Green: [0, 1, 0];

[0095] Blue: [0, 0, 1].

[0096] Among them, normalization is to scale the data to a specific range, usually [0, 1] or [-1, 1].

[0097] Exemplarily, the normalization processing method may include but is not limited to minimum-maximum normalization or Z-score normalization.

[0098] In some embodiments, the fusion of the RGB image of the sample to be detected and the static feature information of the sample to be detected to obtain the RGB image after feature fusion may include:

[0099] Encode the static feature information of the sample to be detected into a binary sequence;

[0100] The binary sequence is used to replace the least significant bit of each channel pixel value of the RGB image of the sample to be detected in sequence to obtain the RGB image of the sample to be detected after feature fusion.

[0101] Exemplarily, in the process of fusing the RGB image of the sample to be detected with the static feature information of the sample to be detected, the static feature information of the sample to be detected may be embedded into the RGB image in the form of an invisible watermark.

[0102] Exemplarily, the static feature information of the sample to be detected can be encoded into a binary sequence, and the binary sequence is used to sequentially replace the least significant bit (LSB) of each channel pixel value of the RGB image of the sample to be detected to obtain the RGB image of the sample to be detected after feature fusion.

[0103] The least significant bit is the 0th bit (the rightmost bit) in the binary number.

[0104] Since the above feature fusion method only changes the least significant bit of each pixel channel of the image, it has little effect on the visual effect of the image. Therefore, the fusion of feature information and image can be achieved without significantly changing the visual effect of the image.

[0105] In some embodiments, the autoencoder and classifier are trained by:

[0106] The autoencoder is trained using a contrastive learning training method to obtain a pre-trained autoencoder;

[0107] The cascaded pre-trained autoencoder and classifier are trained using a meta-learning training method to obtain a trained autoencoder and a trained classifier; wherein, in the meta-learning inner loop training stage, the parameters of the pre-trained autoencoder are fixed.

[0108] Exemplarily, during the training process of the autoencoder and the classifier, the autoencoder may be first trained using a contrastive learning training method to obtain a pre-trained autoencoder.

[0109] In the process of training the automatic encoder using the contrastive learning training method, unlabeled sample data can be used for training.

[0110] When a pre-trained autoencoder is obtained, a meta-learning training method can be used to train the cascaded pre-trained autoencoder and classifier to obtain a trained autoencoder and a trained classifier.

[0111] Among them, the process of model training using the meta-learning training method can include an inner loop stage (which can be called an inner loop training stage) and an outer loop stage (which can be called an outer loop optimization stage).

[0112] For the inner loop training stage, the parameters of the pre-trained autoencoder can be fixed, and the cascaded pre-trained autoencoder and classifier can be trained.

[0113] For the outer loop optimization stage, the parameters of the pre-trained autoencoder can be released (ie, the parameters of the pre-trained autoencoder are allowed to be updated), and the cascaded pre-trained autoencoder and classifier can be trained.

[0114] In one example, training an autoencoder using a contrastive learning training method to obtain a pre-trained autoencoder may include:

[0115] Obtain malicious sample files for autoencoder training;

[0116] Performing visualization processing on the malicious sample file to obtain a malicious sample RGB image corresponding to the malicious sample file; and,

[0117] Extract static features of malicious sample files to obtain static feature information of malicious samples corresponding to the malicious sample files;

[0118] Perform feature fusion on the malicious sample RGB image and static feature information of the malicious sample to obtain a fused malicious sample RGB image;

[0119] According to the sample numbers of malicious sample files of different categories, the sample number of the fused malicious sample RGB image is enhanced to obtain an enhanced malicious sample RGB image; wherein the sample number enhancement ratio of the category with a small sample number is not lower than the sample data enhancement ratio of the category with a large sample number;

[0120] According to the enhanced malicious sample RGB image, the autoencoder is trained using the contrastive learning training method to obtain a pre-trained autoencoder.

[0121] Exemplarily, during the pre-training process of the autoencoder, a malicious sample file for autoencoder training can be obtained, and on the one hand, the obtained malicious sample file is visualized to obtain a corresponding RGB image (which can be called a malicious sample RGB image), and on the other hand, static feature extraction is performed on the malicious sample file to obtain corresponding static feature information (which can be called malicious sample static feature information). Then, feature fusion can be performed on the obtained malicious sample RGB image and the malicious sample static feature information to obtain a fused malicious sample RGB image.

[0122] Exemplarily, the specific implementation methods of visualizing malicious sample files, extracting static features, and fusing the features of malicious sample RGB images and static feature information of malicious samples can refer to the relevant processing of the sample files to be detected described in the above embodiments, and the embodiments of the present application will not be elaborated here.

[0123] Considering that the number of sample files of different categories in the acquired malicious sample files may vary greatly, in order to alleviate the imbalance of malicious sample file categories and improve the generalization ability of the model, data enhancement can be performed on the malicious sample files.

[0124] Accordingly, when the fused malicious sample RGB image is obtained, the sample quantity of the fused malicious sample RGB image can be enhanced according to the sample quantities of malicious sample files of different categories.

[0125] Exemplarily, the rate at which the sample quantity is enhanced for a category with a small number of samples is not lower than the rate at which the sample data is enhanced for a category with a large number of samples.

[0126] For example, for categories with less than 300 samples, the number of samples is increased by 2 times;

[0127] For categories with a number greater than 300 and less than 600, the number of samples is increased to 1.5 times;

[0128] For categories with more than 600 items, no data augmentation is performed.

[0129] When the enhanced malicious sample RGB image is obtained in the above manner, the autoencoder can be trained using a contrastive learning training method based on the enhanced malicious sample RGB image to obtain a pre-trained autoencoder.

[0130] In one example, the above-mentioned use of the meta-learning training method to train the cascaded pre-trained autoencoder and classifier to obtain the trained autoencoder and the trained classifier may include:

[0131] Divide the labeled training samples into subtasks according to the sample categories; one subtask includes N labeled training samples of different categories; N ≥ 1;

[0132] For any subtask, randomly select K labeled training samples from each category of labeled training samples included in the subtask to construct the support set, and randomly select L labeled training samples from the remaining labeled training samples of each category to construct the query set; where K>L≥1;

[0133] In the inner loop training phase, the cascaded pre-trained autoencoder and classifier are trained using labeled training samples in the support set;

[0134] In the outer loop optimization phase, the cascaded pre-trained autoencoder and classifier are optimized using labeled training samples in the query set.

[0135] Exemplarily, in the process of training the cascaded pre-trained autoencoder and classifier using the meta-learning training method, it is necessary to obtain labeled samples for training.

[0136] Exemplarily, the label of the sample may be a category of a malicious sample file.

[0137] During the training process, the labeled training samples can be divided into subtasks according to the sample categories, wherein one subtask can include N labeled training samples of different categories.

[0138] For any subtask, K labeled training samples can be randomly selected from the labeled samples of each category included in the subtask to construct a support set, and L labeled samples can be randomly selected from the remaining labeled samples of each category to construct a query set.

[0139] In the inner loop training stage, the parameters of the pre-trained autoencoder can be fixed, and the cascaded pre-trained autoencoder and classifier can be trained in turn using the support set constructed by each subtask, and the parameters of the classifier can be trained and updated.

[0140] In the outer loop optimization stage, the parameters of the pre-trained autoencoder are no longer fixed, and the query sets constructed by each subtask are used in turn to train the cascaded pre-trained autoencoder and classifier, and the parameters of the pre-trained autoencoder and the classifier are optimized and updated.

[0141] In order to enable those skilled in the art to better understand the technical solutions provided in the embodiments of the present application, the technical solutions provided in the embodiments of the present application are described below with reference to specific examples.

[0142] The following first describes the training process of the automatic encoder and classifier in the embodiment of the present application.

[0143] In the training process of the autoencoder and classifier, the system architecture can be as follows Figure 2 As shown, the system architecture may include: a visualizer, a static feature extractor, a data enhancer, an autoencoder, and a classifier. Among them:

[0144] 1) Visualizer: used to visualize the acquired malicious sample files and convert them into RGB images (i.e. the malicious sample RGB images mentioned above).

[0145] 2) Static feature extractor: used to extract static features from the acquired malicious sample files to obtain static feature information of the malicious sample files (i.e., the above-mentioned static feature information of the malicious samples).

[0146] 3) Data enhancer: It is used to perform data enhancement on the fused malicious sample RGB image obtained by the visualizer and the static feature information obtained by the static feature extractor, increase the diversity and quantity of training data, alleviate the imbalance of data categories, enhance the balance of data, and help improve the generalization ability of the model.

[0147] 4) Autoencoder: used to learn different categories of malicious sample files (unlabeled samples) and extract deep feature information of the input malicious sample files; different results can be output for different categories of input malicious sample files.

[0148] Exemplarily, the autoencoder can adopt the EfficientNet model architecture.

[0149] 5) Classifier: It is used to classify malicious sample files according to the deep feature information of malicious sample files output by the automatic encoder to obtain the classification results of malicious sample files.

[0150] Exemplarily, the classifier may adopt a Transformer model architecture, through which the Transformer model may additionally capture semantic and temporal information, thereby obtaining better classification performance and the ability to process sequences in parallel.

[0151] For example, during the training of the classifier, a small number of labeled samples may be used for meta-learning.

[0152] based on Figure 2 The system architecture shown in Figure 3 As shown, the training process of the autoencoder and classifier can include:

[0153] 1. Data preprocessing.

[0154] 1.1、Visual processing of malicious sample files;

[0155] 1.2. Static feature extraction;

[0156] 1.3, RGB image and static feature fusion;

[0157] 1.4. Data enhancement of fused RGB image.

[0158] 2. Contrastive learning to train the autoencoder.

[0159] 3. Meta-learning to train the classifier.

[0160] 4. Testing.

[0161] The following is an explanation of some details of the training process.

[0162] 1.1. Visualization of malicious sample files (converted into RGB images).

[0163] Considering that RGB images (color images) often contain more features than grayscale images, in order to enrich the features of malicious sample files, the malicious sample files can be converted into RGB images during the visualization process of the malicious sample files.

[0164] For example, the acquired malicious samples may be converted into a 01 binary stream, and a hexadecimal mapping technique may be used to convert every 8 bits of binary data into 2 bits of hexadecimal data.

[0165] For the obtained hexadecimal string, the hexadecimal string can be divided into groups of 2 characters. Each 2 hexadecimal characters can represent an 8-bit pixel value of a color channel (R, G or B). The converted pixel value is filled into the R, G, and B channels in turn to complete the visualization process of converting malicious samples to RGB images.

[0166] 1.2. Static feature extraction.

[0167] Exemplarily, the YARA static feature analysis tool may be used to extract static features of malicious sample files.

[0168] Exemplarily, static features may include, but are not limited to, part or all of file header information, character strings, imported libraries and functions, byte sequences, code entropy values, and other information.

[0169] For example, the extracted static features can be numerically processed:

[0170] 1) For string features, use a hash function to convert them into integers;

[0171] 2) For byte sequences, the original value can be used directly;

[0172] 3) For Boolean or enumeration data, one-hot unique encoding can be used;

[0173] 4) For numerical data, normalization is used.

[0174] 1.3. Fusion of RGB image and static features.

[0175] Exemplarily, the static features of the malicious sample file may be fused with the visualized RGB image of the malicious sample file, and embedded in the RGB image in the form of an invisible watermark.

[0176] Exemplarily, the static features may be encoded into a binary sequence, and the binary sequence of the static features may be used to sequentially replace the LSB of each channel pixel value, and then a new RGB image may be regenerated.

[0177] 1.4. RGB image data enhancement.

[0178] For example, different categories of malicious samples may have different numbers of samples, and there is a large imbalance between them. In order to alleviate the data imbalance, the fused RGB image can be enhanced to increase the diversity and quantity of training data and help improve the generalization ability of the model.

[0179] For example, in order to alleviate the data imbalance, the data enhancement rules are as follows:

[0180] Different enhancement strategies are selected according to the number of samples in different categories.

[0181] For example, for categories with a number less than 300, the number of samples is increased to 2 times;

[0182] For categories with a number greater than 300 and less than 600, the number of samples is increased to 1.5 times;

[0183] For categories with more than 600 items, no data augmentation is performed.

[0184] Exemplarily, methods of performing data augmentation on RGB images may include, but are not limited to: one or more of rotation, cropping, scaling, and generative adversarial networks (GANs).

[0185] The following is a brief description of various data enhancement methods.

[0186] 1) Rotation: Rotation data augmentation involves rotating the image at a certain angle to generate new training samples.

[0187] For example, a fixed angle rotation may be used. For example, a fixed angle such as 90 degrees, 180 degrees, or 270 degrees may be selected for rotation. Alternatively, a random angle rotation may be used. For example, an angle may be randomly selected within a certain range (e.g., -30 degrees to 30 degrees) for rotation.

[0188] 2) Cropping: Cropping data augmentation generates new training samples by removing parts of the original image.

[0189] Exemplarily, a random cropping method may be used. For example, a region is randomly selected in the image for cropping. Alternatively, a center cropping method may be used. For example, a sub-image of a certain size is cropped from the center region of the image. Alternatively, a top-bottom-left-right cropping method may be used. For example, a sub-image is cropped from the top, bottom, left, and right of the image, respectively.

[0190] 3) Scaling: Scaling data augmentation involves changing the size of an image, either enlarging or reducing it to generate new training samples.

[0191] For example, random scaling may be used. For example, a ratio is randomly selected within a certain ratio range (for example, 0.5 times to 1.5 times) for scaling. Alternatively, fixed ratio scaling may be used. For example, scaling is performed according to a preset ratio (for example, 0.5 times, 2 times, etc.).

[0192] 4) Generative Adversarial Network: Generative adversarial network can be used to generate new samples with similar distribution to the initial training samples.

[0193] 2. Contrastive learning to train the autoencoder.

[0194] For example, an autoencoder adopts the EfficientNet model architecture as an example. The autoencoder is used to accept and process mixed features.

[0195] For example, after data enhancement, a large amount of unlabeled data is fed to the autoencoder for contrastive learning training, and the loss function value of contrastive learning is calculated for the final output of the autoencoder. As the training progresses, the contrastive learning loss value of the encoder output result gradually decreases, and the training is completed when the contrastive learning loss value is less than a preset threshold.

[0196] 3. Meta-learning to train the classifier.

[0197] For example, a model-agnostic meta-learning (MAML) training method may be used to train the classifier. The training process may include:

[0198] 3.1. Inner loop training phase.

[0199] 3.1.1 Task sampling and data division.

[0200] 1) Divide the task of training a small amount of labeled data into different subtasks, where each subtask can train labeled data of a single category, and divide the small amount of labeled data set according to the subtask.

[0201] 2) Sample support sets and query sets from the dataset of each subtask. The support set is used to quickly learn task features for the classifier, and the query set is used to reflect whether the knowledge learned by the model from the support set can be successfully applied to unknown data.

[0202] For example, the "N-way K-shot" classification method can be used to implement support set and query set sampling. Among them, N represents the number of categories in the subtask, and K represents the number of samples. That is, a subtask includes N labeled training samples of different categories (i.e., the above-mentioned labeled data); for any category of labeled data, K samples are sampled as the support set.

[0203] For example, 10% to 30% of the total number of samples may be sampled to construct a support set.

[0204] When the support set is constructed by sampling, L samples can be randomly sampled from the remaining samples of each category to construct the query set.

[0205] 3.1.2. Adapt quickly.

[0206] 1) Use the autoencoder to perform deep feature extraction on the samples in the support set and feed the obtained features into the classifier.

[0207] For example, for any sample of the support set, on the one hand, it can be converted into an RGB image; on the other hand, static features can be extracted, and the RGB image and the static features can be fused, and the fused features can be input into the autoencoder, and the autoencoder can be used for deep feature mining.

[0208] 2) The classifier calculates the cross entropy loss based on the features and labels output by the autoencoder, and updates the classifier parameters through back propagation (during this stage, the relevant parameters of the encoder are fixed and the parameters of the classifier are updated).

[0209] 3.2. Outer loop optimization phase.

[0210] For example, when fast adaptation is completed, the relevant parameters of the autoencoder may no longer be fixed, and the query set is used to evaluate the performance of the classifier and calculate the cross entropy loss. Then, the parameters of the entire model (including the encoder and the classifier) ​​are updated by gradient descent.

[0211] In this stage, the parameters of the encoder and classifier are updated.

[0212] 4. Testing.

[0213] Exemplarily, when the training of the autoencoder and the classifier is completed, the parameters of the autoencoder and the classifier can be fixed, and the classification performance test can be performed on the test data as a whole.

[0214] Exemplarily, when an autoencoder and a classifier whose classification performance test results meet the requirements are obtained in the above manner, the trained autoencoder and classifier can be used to classify malicious sample files. The specific implementation process can refer to the relevant description in the above embodiment.

[0215] The method provided by the present application is described above. The device provided by the present application is described below:

[0216] See also Figure 4 , is a schematic diagram of the structure of a malicious sample attack behavior analysis device based on deep feature characterization provided in an embodiment of the present application, such as Figure 4 As shown, the malicious sample attack behavior analysis device based on deep feature characterization may include:

[0217] A visualization processing unit 410 is used to perform visualization processing on the sample file to be detected to obtain an RGB image of the sample to be detected corresponding to the sample file to be detected; and

[0218] The static feature extraction unit 420 is used to extract static features from the sample file to be detected, and obtain static feature information of the sample to be detected corresponding to the sample file to be detected;

[0219] A feature fusion unit 430 is used to fuse the RGB image of the sample to be detected with the static feature information of the sample to be detected to obtain a feature-fused RGB image of the sample to be detected;

[0220] A deep feature extraction unit 440 is used to input the RGB image of the sample to be detected after the feature fusion into a trained automatic encoder to obtain deep feature information of the sample to be detected after the feature fusion;

[0221] The classification unit 450 is used to determine the classification result of the sample file to be detected based on the deep feature information of the sample to be detected using a trained classifier; wherein the trained classifier is trained using a meta-learning training method.

[0222] In some embodiments, the visualization processing unit 410 performs visualization processing on the sample file to be detected to obtain an RGB image of the sample to be detected corresponding to the sample file to be detected, including:

[0223] Converting the sample to be detected into a binary data stream;

[0224] Using hexadecimal mapping technology to convert the binary data stream into a hexadecimal data stream;

[0225] The hexadecimal data stream is converted into pixel values ​​of RGB channels in a manner that every two hexadecimal characters represent an 8-bit pixel value of a color channel, so as to obtain an RGB image of the sample to be detected corresponding to the sample file to be detected.

[0226] In some embodiments, the static feature extraction unit 420 extracts static features from the sample file to be detected to obtain static feature information of the sample file to be detected corresponding to the sample file to be detected, including:

[0227] Using a specified static feature analysis tool, extract static features from the sample file to be detected; wherein the static features include part or all of file header information, character strings, imported libraries and functions, byte sequences, and code entropy values;

[0228] Numerically processing the static features to obtain static feature information of the sample to be detected corresponding to the sample file to be detected;

[0229] Among them, for static features of string type, the numerical processing method includes converting them into integers using a hash function;

[0230] For Boolean or enumeration data, numerical processing methods include one-hot encoding;

[0231] For numerical data, the numerical processing method includes normalization processing.

[0232] In some embodiments, the feature fusion unit 430 fuses the RGB image of the sample to be detected with the static feature information of the sample to be detected to obtain a feature-fused RGB image, including:

[0233] Encoding the static feature information of the sample to be detected into a binary sequence;

[0234] The binary sequence is used to sequentially replace the least significant bit of each channel pixel value of the RGB image of the sample to be detected, so as to obtain the RGB image of the sample to be detected after feature fusion.

[0235] In some embodiments, the autoencoder and the classifier are trained in the following manner:

[0236] The autoencoder is trained using a contrastive learning training method to obtain a pre-trained autoencoder;

[0237] The cascaded pre-trained autoencoder and the classifier are trained using a meta-learning training method to obtain a trained autoencoder and a trained classifier; wherein, in the meta-learning inner loop training stage, the parameters of the pre-trained autoencoder are fixed.

[0238] In some embodiments, the method of training the autoencoder using a contrastive learning training method to obtain a pre-trained autoencoder includes:

[0239] Obtain malicious sample files for autoencoder training;

[0240] Performing visualization processing on the malicious sample file to obtain a malicious sample RGB image corresponding to the malicious sample file; and,

[0241] Extracting static features of the malicious sample file to obtain static feature information of the malicious sample corresponding to the malicious sample file;

[0242] Performing feature fusion on the malicious sample RGB image and the static feature information of the malicious sample to obtain a fused malicious sample RGB image;

[0243] According to the sample numbers of malicious sample files of different categories, the sample number of the fused malicious sample RGB image is enhanced to obtain an enhanced malicious sample RGB image; wherein the sample number enhancement ratio of the category with a small sample number is not lower than the sample data enhancement ratio of the category with a large sample number;

[0244] According to the enhanced malicious sample RGB image, the autoencoder is trained using a contrastive learning training method to obtain a pre-trained autoencoder.

[0245] In some embodiments, the use of a meta-learning training method to train the cascaded pre-trained autoencoder and the classifier to obtain a trained autoencoder and a trained classifier includes:

[0246] Divide the labeled training samples into subtasks according to the sample categories; one subtask includes N labeled training samples of different categories; N ≥ 1;

[0247] For any subtask, randomly select K labeled training samples from each category of labeled training samples included in the subtask to construct the support set, and randomly select L labeled training samples from the remaining labeled training samples of each category to construct the query set; where K>L≥1;

[0248] In the inner loop training phase, the cascaded pre-trained autoencoder and the classifier are trained using labeled training samples in the support set;

[0249] In the outer loop optimization stage, the cascaded pre-trained autoencoder and the classifier are optimized using labeled training samples in the query set.

[0250] An embodiment of the present application also provides an electronic device, including a processor and a memory, wherein the memory is used to store computer programs; the processor is used to implement the malicious sample attack behavior analysis method based on deep feature characterization described above when executing the program stored in the memory.

[0251] See also Figure 5 , is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. The electronic device may include a processor 501 and a memory 502 storing machine executable instructions. The processor 501 and the memory 502 may communicate via a system bus 503. In addition, by reading and executing the machine executable instructions corresponding to the malicious sample attack behavior analysis logic based on deep feature characterization in the memory 502, the processor 501 may execute the malicious sample attack behavior analysis method based on deep feature characterization described above.

[0252] The memory 502 mentioned herein may be any electronic, magnetic, optical or other physical storage device that may contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium may be: RAM (RadomAccess Memory, random access memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as optical disk, DVD, etc.), or similar storage medium, or a combination thereof.

[0253] In some embodiments, a machine-readable storage medium is also provided. Figure 5 The memory 502 in the machine-readable storage medium stores machine executable instructions, and when the machine executable instructions are executed by the processor, the malicious sample attack behavior analysis method based on deep feature characterization described above is implemented. For example, the machine-readable storage medium can be ROM, RAM, CD-ROM, tape, floppy disk, optical data storage device, etc.

[0254] An embodiment of the present application also provides a computer program product, which stores a computer program, and when a processor executes the computer program, it prompts the processor to execute the malicious sample attack behavior analysis method based on deep feature characterization described above.

Claims

1. A method for analyzing malicious sample attack behavior based on deep feature characterization, characterized in that: include: Performing visualization processing on the sample file to be detected to obtain an RGB image of the sample to be detected corresponding to the sample file to be detected; as well as, Extracting static features of the sample file to be detected to obtain static feature information of the sample file to be detected corresponding to the sample file to be detected; The RGB image of the sample to be detected is fused with the static feature information of the sample to be detected to obtain the RGB image of the sample to be detected after feature fusion; Inputting the RGB image of the sample to be detected after the feature fusion into the trained autoencoder to obtain the deep feature information of the sample to be detected after the feature fusion; According to the deep feature information of the sample to be detected, the classification result of the sample file to be detected is determined by using a trained classifier; wherein the trained classifier is trained by a meta-learning training method; The step of fusing the RGB image of the sample to be detected with the static feature information of the sample to be detected to obtain a feature-fused RGB image includes: Encoding the static feature information of the sample to be detected into a binary sequence; The binary sequence is used to sequentially replace the least significant bit of each channel pixel value of the RGB image of the sample to be detected, so as to obtain the RGB image of the sample to be detected after feature fusion; The automatic encoder and the classifier are trained in the following way: The autoencoder is trained using a contrastive learning training method to obtain a pre-trained autoencoder; The cascaded pre-trained autoencoder and the classifier are trained using a meta-learning training method to obtain a trained autoencoder and a trained classifier; wherein, in the meta-learning inner loop training stage, the parameters of the pre-trained autoencoder are fixed.

2. The method according to claim 1, characterized in that The visual processing of the sample file to be detected to obtain the RGB image of the sample to be detected corresponding to the sample file to be detected includes: Converting the sample to be detected into a binary data stream; Using hexadecimal mapping technology to convert the binary data stream into a hexadecimal data stream; The hexadecimal data stream is converted into pixel values ​​of RGB channels in a manner that every two hexadecimal characters represent an 8-bit pixel value of a color channel, so as to obtain an RGB image of the sample to be detected corresponding to the sample file to be detected.

3. The method according to claim 1, characterized in that The step of extracting static features from the sample file to be detected to obtain static feature information of the sample file to be detected corresponding to the sample file to be detected includes: Using a specified static feature analysis tool, extract static features from the sample file to be detected; wherein the static features include part or all of file header information, character strings, imported libraries and functions, byte sequences, and code entropy values; Numerically processing the static features to obtain static feature information of the sample to be detected corresponding to the sample file to be detected; Among them, for static features of string type, the numerical processing method includes converting them into integers using a hash function; For Boolean or enumeration data, numerical processing methods include one-hot encoding; For numerical data, the numerical processing method includes normalization processing.

4. The method according to claim 1, characterized in that: The method of training the autoencoder by contrastive learning to obtain a pre-trained autoencoder includes: Obtain malicious sample files for autoencoder training; Performing visualization processing on the malicious sample file to obtain a malicious sample RGB image corresponding to the malicious sample file; and, Extracting static features of the malicious sample file to obtain static feature information of the malicious sample corresponding to the malicious sample file; Performing feature fusion on the malicious sample RGB image and the static feature information of the malicious sample to obtain a fused malicious sample RGB image; According to the sample numbers of malicious sample files of different categories, the sample number of the fused malicious sample RGB image is enhanced to obtain an enhanced malicious sample RGB image; wherein the sample number enhancement ratio of the category with a small sample number is not lower than the sample data enhancement ratio of the category with a large sample number; According to the enhanced malicious sample RGB image, the autoencoder is trained using a contrastive learning training method to obtain a pre-trained autoencoder.

5. The method according to claim 1, characterized in that The method of using a meta-learning training method to train the cascaded pre-trained autoencoder and the classifier to obtain a trained autoencoder and a trained classifier includes: Divide the labeled training samples into subtasks according to the sample categories; one subtask includes N labeled training samples of different categories; N ≥ 1; For any subtask, randomly select K labeled training samples from each category of labeled training samples included in the subtask to construct the support set, and randomly select L labeled training samples from the remaining labeled training samples of each category to construct the query set; where K>L≥1; In the inner loop training phase, the cascaded pre-trained autoencoder and the classifier are trained using labeled training samples in the support set; In the outer loop optimization stage, the cascaded pre-trained autoencoder and the classifier are optimized using labeled training samples in the query set.

6. A malicious sample attack behavior analysis device based on deep feature characterization, characterized in that: include: A visualization processing unit, used for performing visualization processing on the sample file to be detected, and obtaining an RGB image of the sample to be detected corresponding to the sample file to be detected; as well as, A static feature extraction unit, used to extract static features from the sample file to be detected, and obtain static feature information of the sample to be detected corresponding to the sample file to be detected; A feature fusion unit, used for fusing the RGB image of the sample to be detected with the static feature information of the sample to be detected to obtain a feature-fused RGB image of the sample to be detected; A deep feature extraction unit, used for inputting the RGB image of the sample to be detected after the feature fusion into a trained autoencoder to obtain the deep feature information of the sample to be detected after the feature fusion; A classification unit, used to determine the classification result of the sample file to be detected by using a trained classifier according to the deep feature information of the sample to be detected; wherein the trained classifier is trained by a meta-learning training method; The feature fusion unit fuses the RGB image of the sample to be detected with the static feature information of the sample to be detected to obtain a feature-fused RGB image, including: Encoding the static feature information of the sample to be detected into a binary sequence; The binary sequence is used to sequentially replace the least significant bit of each channel pixel value of the RGB image of the sample to be detected, so as to obtain the RGB image of the sample to be detected after feature fusion; The automatic encoder and the classifier are trained in the following way: The autoencoder is trained using a contrastive learning training method to obtain a pre-trained autoencoder; The cascaded pre-trained autoencoder and the classifier are trained using a meta-learning training method to obtain a trained autoencoder and a trained classifier; wherein, in the meta-learning inner loop training stage, the parameters of the pre-trained autoencoder are fixed.

7. An electronic device, characterized in that: comprising a processor and a memory, wherein: Memory, used to store computer programs; A processor, for implementing the method according to any one of claims 1 to 5 when executing a program stored in a memory.

8. A computer program product, characterized in that The computer program product stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images