Malicious software detection method and device based on integration of confrontation strategy to deep auto-encoder

Abstract

The invention discloses a malicious software detection method and device based on integrating an adversarial strategy into a deep auto-encoder, and the method comprises the steps: extracting a plurality of single features from a sample, and carrying out the preprocessing, and obtaining a real sample set; reconstructing a real sample set by using an abnormal score calculation network, generating a pseudo sample set similar to the distribution of the real sample set, discriminating and classifying the real sample set and the pseudo sample set, obtaining a real sample probability, and calculating an abnormal score value by using the real sample probability when a set condition is met; obtaining deep features through the deep feature structure of the real sample set by using a deep feature extraction network; and making a decision by using the abnormal score value and the deep features, and detecting the malicious software according to a decision result. According to the method, through the synergistic effect of the two sub-networks of deep feature extraction and abnormal score calculation, the detection capability of novel and hidden malicious software is remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security, and specifically relates to a malware detection method and device based on integrating a countermeasure strategy into a deep autoencoder. Background Art

[0002] As cyberattacks continue to escalate, malware is becoming more diverse and stealthy. Traditional signature-based malware detection methods rely on the characteristics of known threats and have limited effectiveness in detecting new or variant malware. In addition, malware developers often use techniques such as obfuscation, packing, and code reordering to make malware features even more elusive. Although existing machine learning and deep learning-based methods have improved detection accuracy in some cases, they still have significant detection blind spots when facing complex and diverse malware, especially small sample malware. Summary of the invention

[0003] The main purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art, and to provide a malware detection method and device based on integrating adversarial strategies into deep autoencoders, which combines the feature extraction capability of the autoencoder and the generative adversarial network game mechanism, and significantly improves the detection capability of new and hidden malware through the synergy of the two sub-networks of deep feature extraction and anomaly score calculation.

[0004] In order to achieve the above object, the present invention adopts the following technical solutions:

[0005] In a first aspect, the present invention provides a malware detection method based on integrating an adversarial strategy into a deep autoencoder, comprising the following steps:

[0006] Extract multiple single features from the samples and perform preprocessing to obtain a real sample set;

[0007] The anomaly score calculation network is used to reconstruct the real sample set, generate a pseudo sample set with a similar distribution to the real sample set, discriminate and classify the real sample set and the pseudo sample set, obtain the real sample probability, and calculate the anomaly score value using the real sample probability when the set conditions are met; the deep feature extraction network is used to obtain deep features through the deep feature structure of the real sample set;

[0008] Decisions are made using anomaly score values ​​and deep features, and malware is detected based on the decision results.

[0009] As a preferred technical solution, the step of extracting multiple single features from the sample and performing preprocessing includes:

[0010] Extract string information features through PE files, extract API features by analyzing the contents of assembly file samples, and extract opcode features by analyzing the contents of assembly file samples;

[0011] Multiple single features are fused to obtain the feature vector of multiple features, and principal component analysis is used to select and reduce the dimension of the feature vector of multiple features to retain the most representative feature subset.

[0012] As a preferred technical solution, the anomaly score calculation network includes a generative autoencoder and a discriminative autoencoder. The generative autoencoder is used to calculate the network to reconstruct the real sample set and generate a pseudo sample set with a distribution similar to the real sample set. The discriminative autoencoder is used to discriminate and classify the real sample set and the pseudo sample set to obtain the real sample probability.

[0013] As a preferred technical solution, the method of reconstructing the real sample set by using the anomaly score calculation network to generate a pseudo sample set with a distribution similar to that of the real sample set includes:

[0014] The generative autoencoder encodes the sample to obtain a low-dimensional potential representation, and remaps the low-dimensional potential representation back to the original feature space to generate a pseudo sample;

[0015] The loss between the sample and the pseudo sample is calculated to optimize the generative autoencoder learning sample; the loss between the calculated sample and the pseudo sample is as follows:

[0016]

[0017] Among them, ‖·‖2 represents the bi-norm, which is used to measure the difference between the original sample x and the pseudo sample The distance between.

[0018] As a preferred technical solution, the real sample set and the fake sample set are discriminated and classified to obtain the real sample probability, including:

[0019] The discriminative autoencoder obtains the probability value of the real sample by classifying the real sample set and the pseudo sample set; the logarithmic loss of the discriminative autoencoder is calculated as follows

[0020]

[0021] Among them, D(·) is the discriminant function, which represents the probability of the sample, x represents the real sample, represents a pseudo sample.

[0022] As a preferred technical solution, the method of calculating the abnormal score value using the true sample probability includes:

[0023] When the game between the generative autoencoder and the discriminative autoencoder reaches equilibrium, the anomaly score is calculated as follows:

[0024] S(x)=1-D(x)

[0025] Among them, S(x) represents the anomaly score value and D(x) represents the true sample probability.

[0026] As a preferred technical solution, the deep feature extraction network is used to extract the deep feature structure of the real sample set, including:

[0027] Set up the autoencoder and pre-train it by calculating the error between real samples and fake samples;

[0028] The pre-trained autoencoder is used to obtain deep features by capturing the deep feature structure of real samples.

[0029] As a preferred technical solution, the decision-making using the abnormal score value and deep features is specifically as follows:

[0030] Combine the anomaly score value with the deep features, use random forest to predict the sample, and output the software label as follows:

[0031] y=RF(S(x),h(x))

[0032] Among them, RF(·) represents the random forest model and y is the output label.

[0033] In a second aspect, the present invention further provides a malware detection system based on integrating adversarial strategies into a deep autoencoder, which is applied to the malware detection method based on integrating adversarial strategies into a deep autoencoder, including a feature acquisition module, a feature engineering module, and an anomaly detection module;

[0034] The feature acquisition module is used to extract multiple single features from the sample and perform preprocessing to obtain a real sample set;

[0035] The feature engineering module is used to reconstruct the real sample set using the anomaly score calculation network, generate a pseudo sample set with a distribution similar to the real sample set, distinguish and classify the real sample set and the pseudo sample set, obtain the real sample probability, and calculate the anomaly score value using the real sample probability when the set conditions are met; use the deep feature extraction network to obtain deep features through the deep feature structure of the real sample set;

[0036] The anomaly detection module is used to make decisions using anomaly score values ​​and deep features, and detect malware based on the decision results.

[0037] In a third aspect, the present invention provides an electronic device, the electronic device comprising:

[0038] at least one processor; and,

[0039] a memory communicatively connected to the at least one processor; wherein,

[0040] The memory stores computer program instructions that can be executed by the at least one processor, and the computer program instructions are executed by the at least one processor to enable the at least one processor to perform the malware detection method based on integrating the adversarial strategy into the deep autoencoder.

[0041] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0042] (1) The present invention significantly improves the sensitivity to small anomalies and hidden malware by combining the feature extraction capability of the autoencoder and the generative adversarial network game mechanism. Compared with traditional feature- and signature-based detection methods, it can better detect those carefully disguised malicious behaviors, thereby reducing missed reports.

[0043] (2) The present invention uses an anomaly score calculation network to enhance the sensitivity to small anomalies and hidden malware. It generates pseudo samples that are very similar to real samples and trains the model to distinguish between real samples and pseudo samples, thereby improving the accuracy of identifying potential malicious behaviors.

[0044] (2) The present invention uses a deep feature extraction network to more deeply explore the implicit information of the input data through features learned from a large number of real samples. This enables the model to comprehensively analyze sample features from multiple dimensions and extract the deep-level information that is most useful for classification, thereby achieving more accurate malware detection.

[0045] (3) The present invention does not need to rely on specific features or signatures of malware, and can adaptively learn features based on input data, making it more adaptable. This makes it possible to effectively respond to ever-changing malware attack methods, with greater versatility and adaptability. At the same time, compared with traditional generative adversarial networks (GANs), the adversarial training method based on autoencoders has higher stability. Due to the non-randomness of data input, the common crash and non-convergence problems in GAN training are avoided, thereby improving the training efficiency and robustness of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0047] Figure 1 A flowchart of a malware detection method based on integrating a countermeasure strategy into a deep autoencoder according to an embodiment of the present invention;

[0048] Figure 2 A schematic diagram of the structure of a malware detection system based on integrating a countermeasure strategy into a deep autoencoder according to an embodiment of the present invention;

[0049] Figure 3 4 is a structural diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0051] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0052] See also Figure 1 , this embodiment provides a malware detection method based on integrating the adversarial strategy into a deep autoencoder, comprising the following steps:

[0053] S1. Extract multiple single features from the sample and perform preprocessing to obtain a real sample set.

[0054] The features extracted in this embodiment can be divided into three types: string information features, API features, and operation code features.

[0055] String information features are extracted from PE files. String information is represented by the statistical features of printable strings in the file, counting the number of printable strings, average length, and histogram distribution of printable characters in them. The number of these special strings and other general statistical information are counted. By collecting and concatenating the above string statistics, the final string feature vector is obtained.

[0056] API features are extracted by analyzing the content of the assembly file sample. The number of extracted APIs is huge. The Sklearn feature selection method selectFromModel is used to extract the top 256 APIs based on the feature importance weights to reduce calculation time and improve efficiency. APIs are selected by training linear regression using API counts as features. The number of API calls related to different functions (such as "file system", "registry", "network", "DLL", "object", "process", "service", "synchronization", "system information" and "time") is counted. The number of API calls related to each function is used as a feature and spliced ​​to obtain the import table feature vector. The final string feature vector is obtained by collecting the above API information and splicing it.

[0057] The opcode features are extracted by analyzing the contents of the assembly file samples. The length of the instruction opcode is only one byte: so the maximum number of instructions is 256. The number of different types of opcodes (such as "basic math", "logical operations", "shift instructions", "internal stack operations", "register operations" and "port operations") is counted. The number of each opcode type is used as a feature and concatenated to obtain an opcode feature vector. By collecting the above opcode information and concatenating it, the final string feature vector is obtained.

[0058] After completing the extraction of a single feature, this embodiment considers fusing the features to create new features with better classification and discrimination capabilities. The purpose of feature fusion is to combine different types of features to improve the expressiveness and classification performance of the features. A commonly used feature fusion method is to connect the vectors of different features in sequence to form a longer feature vector through feature splicing and merging.

[0059] In order to reduce noise and improve computational efficiency, feature selection and dimensionality reduction can be performed through methods such as principal component analysis (PCA) to retain the most representative feature subset.

[0060] S2. Use the anomaly score calculation network to reconstruct the real sample set, generate a pseudo sample set with a similar distribution to the real sample set, discriminate and classify the real sample set and the pseudo sample set, obtain the real sample probability, and when the set conditions are met, use the real sample probability to calculate the anomaly score value; use the deep feature extraction network to obtain deep features through the deep feature structure of the real sample set.

[0061] See again Figure 2, this embodiment is provided with an anomaly score calculation network and a deep feature extraction network. Among them, the design purpose of the anomaly score calculation network is to enhance the model's recognition ability of minor anomalies and hidden malicious behaviors by introducing adversarial training strategies. Traditional malware detection methods usually rely on the significance of features, and tend to ignore subtle anomalies hidden in normal behaviors. However, these subtle anomalies are often early signs of malware. In order to solve this problem, the network draws on the idea of ​​generative adversarial networks (GANs), and through adversarial training, the generation network and the discriminant network are continuously improved in the game, so as to mine more useful information from inconspicuous anomalies. Unlike the standard GAN, the anomaly score calculation network adopts an adversarial training method based on an autoencoder. This method generates pseudo samples similar to real samples while reconstructing the input samples, and identifies these pseudo samples through a discriminant network, thereby establishing a more stable and efficient game relationship between generation and discrimination.

[0062] Specifically, a generative autoencoder AE1 and a discriminative autoencoder AE2 are provided in the anomaly score calculation network. The generative autoencoder AE1 is used to calculate the network to reconstruct the real sample set and generate a pseudo sample set with a distribution similar to the real sample set. The discriminative autoencoder AE2 is used to discriminate and classify the real sample set and the pseudo sample set to obtain the probability of the real sample.

[0063] When training the anomaly score calculation network, this embodiment includes the following steps:

[0064] First, the generative autoencoder AE1 is used to encode the input sample x through the encoder to obtain a low-dimensional latent representation z. The purpose of the encoder is to compress the input information while retaining the main features of the sample. Then, AE1 remaps the latent representation z back to the original feature space through the decoder to generate a pseudo sample. The task of the decoder is to reconstruct a sample that is as similar to the input sample x as possible.

[0065] In order to optimize the performance of AE1, the loss function of AE1 is defined as the loss of the input sample x and the pseudo sample The mean square error (MSE) between is defined as:

[0066]

[0067] Among them, ‖·‖2 represents the bi-norm, which is used to measure the distance between the original input and the reconstructed output. By minimizing this loss function, AE1 can learn the main features of the input samples and generate realistic pseudo samples.

[0068] Secondly, the discriminative autoencoder AE2 receives the real sample x and the pseudo sample generated by AE1 As input, and through its internal neural network structure, it outputs a probability value D(x), which represents the probability that sample x is a true sample. In order to optimize the discrimination ability of AE2, the loss function of AE2 is based on logarithmic loss and is defined as:

[0069]

[0070] Among them, D(·) is the discriminant function, which represents the probability of the sample, and D(x) is the estimated probability that the input sample x belongs to the real sample. This value is between 0 and 1. The closer the value is to 1, the more likely the model thinks the sample is a real sample; the closer the value is to 0, the more likely the model thinks the sample is a fake sample. By maximizing this loss function, AE2 can gradually improve its ability to identify fake samples, allowing it to continuously approach the optimal classification boundary during the discrimination process.

[0071] During the training process, AE1 and AE2 improve each other through the game relationship: AE1 continuously improves to generate more difficult to distinguish pseudo samples, while AE2 improves its ability to identify pseudo samples through continuous optimization. Finally, when the game reaches equilibrium, the probability D(x) output by AE2 will be used to calculate the anomaly score S(x):

[0072] S(x)=1-D(x)

[0073] The anomaly score indicates the degree to which the input sample is likely to be malware, and the higher the value, the more likely the sample is malware. Through this process, the model can not only detect significant malicious behavior, but also effectively identify those hidden and difficult-to-detect small anomalies.

[0074] In this embodiment, a deep feature extraction network is also provided in parallel with the anomaly score calculation network. The introduction of the deep feature extraction network is to solve the problems of sparse sample features, high data dimension, and sample imbalance. By pre-training the autoencoder from a large number of real samples, the network can learn the deep feature representation of the data and extract high-dimensional features that are helpful for classification from the input test samples.

[0075] It is worth further explaining that the standard for the above game to reach equilibrium can be judged by the following points:

[0076] (1) The loss function tends to be stable: During the training process, the loss function of the generator (L AE1 ) and the loss function of the discriminator (L AE2 ) gradually converges and fluctuates less. This means that the game between the two has entered a stable state.

[0077] (2) Similarity between generated samples and real samples: The statistical characteristics of the samples generated by the generator and the real samples (e.g., feature distribution, mean, variance, etc.) are very close, and the discriminator has difficulty distinguishing between the two.

[0078] (3) Model training stop conditions: The conditions for stopping training can be set. For example, in multiple rounds of iterations, the accuracy of the discriminator remains at a level close to random guessing (for example, 50%), which indicates that the pseudo samples of the generator are realistic enough for the discriminator to make a clear judgment.

[0079] (4) D(x) is close to 0.5: Ideally, when the game between the generator and the discriminator reaches equilibrium, D(x) should be close to 0.5, because in this state, the discriminator cannot effectively distinguish between real samples and generated samples, which reflects the high quality of the samples generated by the generator.

[0080] When the above conditions are met, it can be considered that the game between the generator and the discriminator has reached an equilibrium state. At this time, the true sample probability D(x) calculated by the discriminator can be used to calculate the anomaly score S(x). In the process of deep feature extraction, the following steps are included:

[0081] Pre-trained autoencoder: In a deep feature extraction network, an autoencoder is first trained using a large number of real samples so that it can capture the deep feature structure of normal data. The goal of the pre-training process is to minimize the error between the input sample x and the pseudo sample x^. The specific formula is:

[0082]

[0083] By continuously optimizing the loss function, the network can learn the main features of the input data and extract deep feature representations through the encoder part.

[0084] Feature extraction: During the model testing phase, the input sample x is fed into a pre-trained autoencoder, and deep features h(x) are extracted through the encoder. These features can reflect the potential characteristics of the sample and provide support for subsequent classification decisions. The feature extraction network can effectively extract deep features from the input sample by learning the distribution of real samples. These deep features h(x) not only contain the surface information of the sample, but also reveal the complex patterns hidden inside the data, thus providing richer information for the final anomaly detection. It is also important to note that:

[0085] (1) The deep features h(x) are high-dimensional features extracted from the input samples by the autoencoder. These features can be regarded as a representation of the complex patterns and internal structures of the samples.

[0086] (2) Learning the distribution of real samples means that by training a large number of real samples, the feature extraction network (such as autoencoder) can capture the common characteristics of these samples, that is, the distribution pattern in the feature space.

[0087] (3) The result of deep feature extraction is an information vector that contains the main characteristics of the sample. Although it cannot be directly equivalent to the probability distribution, it indirectly reflects the distribution of the sample in a certain feature space.

[0088] S3. Make decisions using anomaly score values ​​and deep features, and detect malware based on the decision results.

[0089] Combine the anomaly score value with the deep features, use random forest to predict the sample, and output the software label as follows:

[0090] y=RF(S(x),h(x))

[0091] Among them, RF(·) represents the random forest model and y is the output label.

[0092] The output labels here are "normal" and "malicious", which are used to determine whether the detected software is malicious.

[0093] It should be noted that, for the sake of convenience, the aforementioned method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited to the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously.

[0094] Based on the same idea as the malware detection method based on integrating the adversarial strategy into the deep autoencoder in the above-mentioned embodiment, the present invention also provides a malware detection system based on integrating the adversarial strategy into the deep autoencoder, which can be used to execute the above-mentioned malware detection method based on integrating the adversarial strategy into the deep autoencoder. For ease of explanation, in the structural diagram of the embodiment of the malware detection system based on integrating the adversarial strategy into the deep autoencoder, only the parts related to the embodiment of the present invention are shown. Those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than shown in the diagram, or combine certain components, or arrange the components differently.

[0095] See also Figure 2 , in another embodiment of the present application, there is provided a malware detection system 10 based on integrating adversarial strategies into a deep autoencoder, the system comprising a feature acquisition module 11, a feature engineering module 12, and an anomaly detection module 13;

[0096] The feature collection module 11 is used to extract multiple single features from the sample and perform preprocessing to obtain a real sample set;

[0097] The feature engineering module 12 is used to reconstruct the real sample set by using the anomaly score calculation network, generate a pseudo sample set with a distribution similar to the real sample set, distinguish and classify the real sample set and the pseudo sample set, obtain the real sample probability, and calculate the anomaly score value by using the real sample probability when the set conditions are met; use the deep feature extraction network to obtain deep features through the deep feature structure of the real sample set;

[0098] The anomaly detection module 13 is used to make decisions using anomaly score values ​​and deep features, and detect malware based on the decision results.

[0099] It should be noted that the malware detection system based on integrating the adversarial strategy into the deep autoencoder of the present invention corresponds one to one with the malware detection method based on integrating the adversarial strategy into the deep autoencoder of the present invention. The technical features and beneficial effects described in the above-mentioned embodiment of the malware detection method based on integrating the adversarial strategy into the deep autoencoder are applicable to the embodiment of the malware detection method based on integrating the adversarial strategy into the deep autoencoder. For specific contents, please refer to the description in the embodiment of the method of the present invention, which will not be repeated here. This is hereby declared.

[0100] In addition, in the implementation of the malware detection system based on integrating the countermeasure strategy into the deep autoencoder in the above-mentioned embodiment, the logical division of each program module is only an example. In actual applications, the above-mentioned functions can be assigned to different program modules as needed, for example, for the convenience of corresponding hardware configuration requirements or software implementation. That is, the internal structure of the malware detection system based on integrating the countermeasure strategy into the deep autoencoder is divided into different program modules to complete all or part of the functions described above.

[0101] See also Figure 3 In one embodiment, an electronic device that implements a malware detection method based on integrating adversarial strategies into a deep autoencoder is provided. The electronic device 20 may include a first processor 21, a first memory 22, and a bus, and may also include a computer program stored in the first memory 22 and executable on the first processor 21, such as a malware detection program 23 based on integrating adversarial strategies into a deep autoencoder.

[0102] Among them, the first memory 22 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example: SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the first memory 22 can be an internal storage unit of the electronic device 20, such as a mobile hard disk of the electronic device 20. In other embodiments, the first memory 22 can also be an external storage device of the electronic device 20, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 20. Further, the first memory 22 can also include both an internal storage unit of the electronic device 20 and an external storage device. The first memory 22 can not only be used to store application software and various types of data installed in the electronic device 20, such as the code of the malware detection program 23 based on integrating the adversarial strategy into the deep autoencoder, but also can be used to temporarily store data that has been output or is to be output.

[0103] In some embodiments, the first processor 21 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. The first processor 21 is the control core (ControlUnit) of the electronic device, and uses various interfaces and lines to connect various components of the entire electronic device, and executes various functions and processes data of the electronic device 20 by running or executing programs or modules stored in the first memory 22, and calling data stored in the first memory 22.

[0104] Figure 3 Only an electronic device with components is shown, and those skilled in the art will understand that Figure 3 The structure shown does not constitute a limitation on the electronic device 20 , and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0105] The malware detection program 23 based on integrating the adversarial strategy into the deep autoencoder stored in the first memory 22 in the electronic device 20 is a combination of multiple instructions, which can achieve the following when running in the first processor 21:

[0106] Extract multiple single features from the samples and perform preprocessing to obtain a real sample set;

[0107] The anomaly score calculation network is used to reconstruct the real sample set, generate a pseudo sample set with a similar distribution to the real sample set, discriminate and classify the real sample set and the pseudo sample set, obtain the real sample probability, and calculate the anomaly score value using the real sample probability when the set conditions are met; the deep feature extraction network is used to obtain deep features through the deep feature structure of the real sample set;

[0108] Decisions are made using anomaly score values ​​and deep features, and malware is detected based on the decision results.

[0109] Furthermore, if the module / unit integrated in the electronic device 20 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer-readable storage medium. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0110] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0111] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0112] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A malware detection method based on integrating adversarial strategies into deep autoencoders, characterized in that: The steps include: Extract multiple single features from the samples and perform preprocessing to obtain a real sample set; The anomaly score calculation network is used to reconstruct the real sample set, generate a pseudo sample set with a similar distribution to the real sample set, discriminate and classify the real sample set and the pseudo sample set, obtain the real sample probability, and calculate the anomaly score value using the real sample probability when the set conditions are met; the deep feature extraction network is used to obtain deep features through the deep feature structure of the real sample set; Decisions are made using anomaly score values ​​and deep features, and malware is detected based on the decision results.

2. The malware detection method based on integrating adversarial strategies into deep + autoencoders according to claim 1, characterized in that: The step of extracting multiple single features from the sample and performing preprocessing includes: Extract string information features through PE files, extract API features by analyzing the contents of assembly file samples, and extract opcode features by analyzing the contents of assembly file samples; Multiple single features are fused to obtain the feature vector of multiple features, and principal component analysis is used to select and reduce the dimension of the feature vector of multiple features to retain the most representative feature subset.

3. The malware detection method based on integrating adversarial strategies into deep autoencoders according to claim 1, characterized in that: The anomaly score calculation network includes a generative autoencoder and a discriminative autoencoder. The generative autoencoder is used to calculate the network to reconstruct the real sample set and generate a pseudo sample set with a distribution similar to the real sample set. The discriminative autoencoder is used to discriminate and classify the real sample set and the pseudo sample set to obtain the real sample probability.

4. The malware detection method based on integrating adversarial strategies into deep autoencoders according to claim 3, characterized in that: The method of reconstructing the real sample set by using the anomaly score calculation network to generate a pseudo sample set with a distribution similar to that of the real sample set includes: The generative autoencoder encodes the sample to obtain a low-dimensional potential representation, and remaps the low-dimensional potential representation back to the original feature space to generate a pseudo sample; The loss between the sample and the pseudo sample is calculated to optimize the generative autoencoder learning sample; the loss between the calculated sample and the pseudo sample is as follows: Among them, ‖·‖2 represents the bi-norm, which is used to measure the difference between the original sample x and the pseudo sample The distance between.

5. The malware detection method based on integrating adversarial strategies into deep autoencoders according to claim 3, characterized in that: Perform discrimination and classification on the real sample set and the fake sample set to obtain the probability of the real sample, including: The discriminative autoencoder obtains the true sample probability value by classifying the true sample set and the pseudo sample set; Calculate the logarithmic loss of the discriminative autoencoder as follows Among them, D(·) is the discriminant function, which represents the probability of the sample, x represents the real sample, represents a pseudo sample.

6. The malware detection method based on integrating adversarial strategies into deep autoencoders according to claim 1, characterized in that: The method of calculating the abnormal score value using the true sample probability includes: When the game between the generative autoencoder and the discriminative autoencoder reaches equilibrium, the anomaly score is calculated as follows: S(x)=1-D(x) Among them, S(x) represents the anomaly score value and D(x) represents the true sample probability.

7. The malware detection method based on integrating adversarial strategies into deep autoencoders according to claim 1, characterized in that: The deep feature extraction network is used to extract the deep feature structure of the real sample set, including: Set up the autoencoder and pre-train it by calculating the error between real samples and fake samples; The pre-trained autoencoder is used to obtain deep features by capturing the deep feature structure of real samples.

8. The malware detection method based on integrating adversarial strategies into deep autoencoders according to claim 1, characterized in that: The decision-making using the abnormal score value and deep features is specifically as follows: Combine the anomaly score value with the deep features, use random forest to predict the sample, and output the software label as follows: y=RF(S(x),h(x)) Among them, RF(·) represents the random forest model and y is the output label.

9. A malware detection system based on integrating adversarial strategies into deep autoencoders, characterized in that A malware detection method based on integrating a countermeasure strategy into a deep autoencoder, applied to any one of claims 1-8, comprising a feature acquisition module, a feature engineering module, and an anomaly detection module; The feature acquisition module is used to extract multiple single features from the sample and perform preprocessing to obtain a real sample set; The feature engineering module is used to reconstruct the real sample set using the anomaly score calculation network, generate a pseudo sample set with a distribution similar to the real sample set, distinguish and classify the real sample set and the pseudo sample set, obtain the real sample probability, and calculate the anomaly score value using the real sample probability when the set conditions are met; use the deep feature extraction network to obtain deep features through the deep feature structure of the real sample set; The anomaly detection module is used to make decisions using anomaly score values ​​and deep features, and detect malware based on the decision results.

10. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor, and the computer program instructions are executed by the at least one processor so that the at least one processor can execute the malware detection method based on integrating adversarial strategies into deep autoencoders as described in any one of claims 1-8.

Images