Malicious code detection method based on software genes and improved Siamese network

Abstract

The present invention relates to a malicious code detection method based on software genes and an improved Siamese network, comprising: data preprocessing, static analysis and dynamic analysis of the code file to be detected, and extraction of basic features; converting the basic features into gene fragments, mapping them to gene expressions, and constructing the gene sequence of the code; using the improved Siamese network, performing a similarity comparison between the extracted gene sequence and a known malicious code gene library to obtain a similarity calculation result; judging whether the code file contains malicious gene features based on the similarity calculation result, and further determining the malicious code family to which the malicious code belongs if malicious code is detected; and updating and optimizing the malicious code gene library based on the detection results so that the malicious code gene library covers the latest malicious code samples and variant features. The present invention significantly improves the effectiveness of malicious code detection tasks by combining malicious code gene features with AI models.

Description

Technical Field

[0001] The invention belongs to the field of network security, and in particular relates to a malicious code detection method based on software genes and an improved Siamese network. Background Art

[0002] Malicious code detection typically analyzes malware characteristics and behavioral patterns. These detection methods aim to identify and counter malware attack strategies and activity patterns in different environments. Although many malicious codes exhibit similar attack characteristics, their behaviors vary. Malicious code is likely to exhibit specific attack intent, such as data theft, system damage, or other security threats. Therefore, accurately identifying and detecting these malicious code characteristics is crucial for improving network security protection.

[0003] With the rapid growth of malicious code, early rule- and signature-based methods, while making some progress, face challenges with slow pattern updates and high false positive rates. Existing signature-based detection methods often face the following challenges when dealing with complex and ever-changing malicious code: Slow pattern updates: New malicious code emerges quickly, and signature updates often lag, making it difficult to respond to new threats in a timely manner; high false positive rates: Fixed rules and signature matching are prone to false positives, especially when dealing with variant malicious code; insufficient feature extraction: Traditional methods rely on predefined static features and are unable to fully capture the dynamic behavior of malicious code; and high resource consumption: When processing large datasets, signature matching consumes significant computational resources, impacting detection efficiency.

[0004] The present invention aims to overcome these shortcomings of the existing technology by introducing software genetic technology. By extracting the unique genetic characteristics of malicious code and building an efficient gene library system, it can achieve accurate detection and classification of malicious code. Summary of the Invention

[0005] The technical problem addressed by the present invention is that existing malicious code detection methods have limitations in many aspects. First, these methods typically rely on high-quality annotated data, which is both time-consuming and labor-intensive to obtain. Furthermore, existing methods are complex and prone to inaccuracies in feature extraction, resulting in high resource consumption and low processing efficiency. Furthermore, these methods often lack detection accuracy when dealing with the ever-changing and complex nature of malicious code features, making them ineffective in addressing the threats posed by new and variant malicious code.

[0006] The purpose of the present invention is to address the above-mentioned problems and provide a malicious code detection method based on software genes and an improved Siamese network. By improving data preprocessing and feature extraction mechanisms, the dependence on high-quality data is reduced. By constructing and maintaining an efficient malicious code gene library, feature expression and detection efficiency are optimized, thereby improving the accuracy and practicality of detection.

[0007] In order to achieve the above object, the technical solution of the present invention is:

[0008] The malicious code detection method based on software genes and improved Siamese network includes the following steps:

[0009] Step 1: Data preprocessing: static analysis and dynamic analysis are performed on the code files to be tested to extract basic features;

[0010] Step 2: Convert the basic features obtained in step 1 into gene fragments, map them to gene expression, and construct the gene sequence of the code;

[0011] Step 3: Using the improved Siamese network, the gene sequence extracted in step 2 is compared with the known malicious code gene library to obtain the similarity calculation result;

[0012] Step 4: Based on the similarity calculation results, determine whether the code file contains malicious gene features. If so, further determine the malicious code family it belongs to and output the detection and classification results;

[0013] Step 5: Gene library update and optimization: Based on the detection results, update and optimize the malicious code gene library so that the malicious code gene library covers the latest malicious code samples and variant features.

[0014] Preferably, the improved Siamese network includes an encoder, an adaptive weighting module and a decoder, the encoder includes a first convolutional layer, a maximum pooling layer, a second convolutional layer, an average pooling layer, a third convolutional layer and a flattening layer; the decoder includes 3 fully connected layers; the adaptive weighting module adopts an adaptive weighting algorithm.

[0015] Furthermore, the step 1 specifically includes the following sub-steps:

[0016] Step 1.1: Use the static analysis tool IDA Pro to analyze the code structure, API call sequence, and string constants of the code file to be tested to obtain static features;

[0017] Step 1.2: Use the dynamic analysis platform Cuckoo Sandbox to analyze the runtime behavior and system call sequence of the code file to be tested to obtain dynamic features;

[0018] Step 1.3: Clear the noise and irrelevant information in the data, delete null values ​​or outliers, and ensure the quality of feature data;

[0019] Step 1.4: Standardize the extracted basic features to make different features comparable.

[0020] Furthermore, the step 2 specifically includes the following sub-steps:

[0021] Step 2.1: Perform feature segmentation on the basic features extracted from static analysis and dynamic analysis. Use predefined gene segmentation rules to segment the basic features into independent gene segments.

[0022] Step 2.2: Map each gene segment to gene expression, that is, convert the gene segment into a feature vector;

[0023] Step 2.3: All gene fragments are combined into a complete gene sequence. By splicing or arranging the feature vectors of multiple gene fragments, a complete gene sequence of the code is constructed, so that it can be effectively compared with the existing malicious code genes in the malicious code gene library.

[0024] Furthermore, the step 3 specifically includes the following sub-steps:

[0025] Step 3.1: Compare the gene feature vector of the sample to be tested with all the gene features in the malicious code gene library; use the improved Siamese network to calculate the similarity between the sample and each gene feature in the malicious code gene library. The similarity calculation formula is:

[0026] ;

[0027] Where, represents the similarity function, 、 Respectively represent the gene feature vectors in the sample to be detected and the malicious code gene library, is the feature extraction function of the improved Siamese network, represents the weight matrix, is the activation function;

[0028] Step 3.2: Combining the similarity scores of the statistical analysis and the improved Siamese network output, the similarity threshold is dynamically set according to the similarity distribution of gene features in the malicious code gene library. The calculation formula of the similarity threshold is:

[0029] ;

[0030] Where, is the similarity threshold, and Represent the mean and standard deviation of similarity scores in the malicious code gene library; 、 Both are adjustment coefficients, used to control the impact of standard deviation and feature deviation on the threshold; represents the weight of the i-th feature, represents the eigenvalue output by the improved Siamese network, represents the expected value of the feature; n represents the number of features;

[0031] Step 3.3: Screen out gene features with higher similarity; according to the set similarity threshold , the gene features whose similarity scores output by the improved Siamese network exceed the threshold are screened out, and it is judged that these gene features have a high similarity with the sample to be tested;

[0032] Step 3.4: Evaluate the relationship between gene features. Further analyze the similar gene features screened in step 3.3. Use an adaptive weighting algorithm to dynamically adjust the weights of different features to ensure that the influence weights of each feature are reasonably distributed during the evaluation process, ultimately obtaining accurate similarity detection results. The calculation formula of the adaptive weighting algorithm is:

[0033]

[0034] Where, Indicates the i The weight of the feature, is the similarity value of the corresponding feature, 、 Both are weight adjustment coefficients, which are used to control the distribution of weights.

[0035] Furthermore, step 4 specifically includes the following sub-steps:

[0036] Step 4.1: Based on the similarity analysis results of the improved Siamese network, if the similarity between the gene signature of the code file to be detected and one or more gene signatures in the malicious code gene library exceeds a threshold, the code file is determined to contain malicious code;

[0037] Step 4.2: For code files determined to contain malicious code, determine their possible family affiliation by analyzing the similarity between the malicious code and the gene features of different families in the malicious code gene library; select the family with the highest similarity as the family affiliation of the malicious code;

[0038] Step 4.3: Generate a detection report; based on the similarity analysis results, generate a detailed detection report, including whether the code sample is malicious code, its possible family affiliation, and similarity analysis details.

[0039] Furthermore, step 5 specifically includes the following sub-steps:

[0040] Step 5.1: For the malicious code sample whose family is determined to belong to, extract its genetic features again to ensure the accuracy and completeness of the features;

[0041] Step 5.2: Add the genetic features of the new malicious code sample to the corresponding malicious code family gene library;

[0042] Step 5.3: De-redundancy processing is performed on the updated malicious code gene library, merging highly similar gene features to avoid the gene library being too long and repetitive;

[0043] Step 5.4: Regularly maintain and update the malicious code gene library based on the introduction of new malicious code samples and changes to existing malicious code samples.

[0044] The system of the above-mentioned malicious code detection method includes:

[0045] Gene extraction module: performs static and dynamic analysis on the code file data to be tested, extracts representative gene features, and provides clean data input for other modules;

[0046] Gene library management module: Builds and maintains a gene database of known malware families, optimizing the gene library structure through redundancy removal and diversity maintenance strategies;

[0047] Siamese network similarity calculation module: uses the improved Siamese network to calculate the similarity between the extracted gene feature vector and the gene feature vector in the gene library;

[0048] Detection decision module: Based on the similarity score output by the improved Siamese network, it is compared with the set threshold to make a detection decision;

[0049] Gene library update module: Dynamically update and maintain the gene library according to the introduction of new samples and changes in existing samples to ensure the real-time and effectiveness of the gene library.

[0050] Compared with the prior art, the present invention has the following beneficial effects:

[0051] 1) This invention utilizes a software gene-based malware detection method that extracts representative genetic signatures from input code. These genetic signatures effectively capture the core behaviors and characteristic patterns of malicious code. Compared to traditional methods based on signatures or behavioral analysis, this method can more accurately identify and classify malicious code families. Gene signature extraction and similarity detection algorithms adaptively extract key information from large datasets, thereby improving the accuracy and efficiency of malicious code detection and avoiding the limitations of traditional methods in dealing with new or variant malware.

[0052] 2) This invention utilizes a software gene library to detect unknown code and compares its characteristics with genes in a known malicious code gene library. This method dynamically and flexibly adapts to the characteristics of new malicious code variants. Compared to existing fixed feature selection methods, this invention can adaptively update and optimize the gene library, ensuring that the detection model is always up to date, thereby improving the detection capability of unknown malware and enhancing the system's robustness and response capabilities.

[0053] 3) The gene similarity detection module of this invention utilizes an improved Siamese network and an adaptive weighting algorithm to rapidly identify the similarity between code snippets and known malicious code genes, enabling fast and accurate detection. This method achieves efficient detection with low computational resource consumption and is particularly suitable for real-time malicious code monitoring and protection in large-scale network environments, significantly improving the system's detection speed and responsiveness.

[0054] 4) By introducing a modified Siamese network for multi-dimensional genetic feature analysis, this invention is able to capture the complex behavioral patterns and underlying characteristics of malicious code. Compared to traditional single-feature detection methods, this invention provides richer and more in-depth feature data analysis capabilities through an adaptive weighting algorithm. This multi-dimensional genetic analysis method enables the system to more comprehensively understand and identify the diverse characteristics of malicious code, improving the accuracy and generalization of malicious code classification.

[0055] 5) This invention effectively classifies malicious code families. By deeply analyzing the genetic characteristics of different families using an improved Siamese network, it enhances the ability to identify and classify malicious code families. The software genetics-based detection system can make classification decisions based on the characteristics of different families, further improving the accuracy and reliability of complex malware detection, and contributing to the overall level of network security.

[0056] 6) The detection system of this invention adaptively learns and adjusts its gene signature library through a Siamese network and an adaptive weighting algorithm. This system continuously optimizes and updates over time, maintaining high detection capabilities even when dealing with evolving malware and its variants. Compared to traditional methods that rely on fixed training datasets, this invention significantly reduces the reliance on high-quality training data, making the system more flexible and operational in practical applications, and particularly efficient and accurate when processing massive amounts of low-quality data. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The present invention will be further described below with reference to the accompanying drawings and examples.

[0058] Figure 1 2 is an architecture diagram of a malicious code detection system according to an embodiment of the present invention.

[0059] Figure 2 Schematic diagram of the gene library construction process according to an embodiment of the present invention.

[0060] Figure 3 The figure is a schematic diagram of the malicious code detection process according to an embodiment of the present invention.

[0061] Figure 4 Schematic diagram of the improved Siamese network structure of an embodiment of the present invention.

[0062] Figure 5 The figure is a comparison of the detection effects of the method of the present invention and different anti-virus engines. DETAILED DESCRIPTION

[0063] In order to improve the accuracy and efficiency of malicious code detection, the embodiment of the present invention proposes a malicious code detection method and system based on software genetic technology and improved Siamese network. The main implementation principles, specific implementation process and corresponding beneficial effects of the embodiment of the present invention are described in detail below in conjunction with the accompanying drawings.

[0064] The dataset used in this example contains samples from multiple malware families, divided into six families: Downloader, Shellcode Inject, Unicorn, Powerfun, SET, and PowerShell Empire. The example runs on an Intel(R) Xeon(R) Gold 6330 CPU @ 2.00GHz, a GeForce RTX3090 GPU, and 500GB of memory. Python version 3.7 is used. Tools such as Pytorch and Sklearn are used to implement and test the proposed method.

[0065] like Figure 4 As shown in the figure, the improved Siamese network introduces an adaptive weighting module, which dynamically adjusts the weights of the input feature vectors before similarity calculation, thereby increasing the focus on important features. The encoder of the improved Siamese network uses multiple layers of convolution to gradually extract the high-dimensional features of the sample. It then downsamples the feature map using max pooling and average pooling layers. The three-dimensional feature map is then flattened into a one-dimensional vector using a flattening layer. The flattened feature vector is then input to the adaptive weighting module, which generates weights of the same dimensionality as the feature vector and uses these weights to dynamically weight the features, thereby increasing the influence of key features in the similarity calculation. In the similarity calculation, the cosine similarity is used to measure the similarity between the two weighted feature vectors, resulting in a similarity score between the two samples. In the final part of the network model, the similarity score passes through several layers of fully connected decoders, gradually reducing the dimensionality and ultimately outputting a similarity score for classification.

[0066] The malicious code detection method based on software genes and improved Siamese network of the embodiment includes the following steps:

[0067] Step 1: Extract the original malicious code files from the open source dataset and extract static and dynamic features from the samples.

[0068] Step 1.1: Use the static analysis tool IDA Pro to analyze static features such as code structure, API call sequences, and string constants;

[0069] Step 1.2: Use the dynamic analysis platform Cuckoo Sandbox to monitor the sample’s runtime behavior and system call sequence and other dynamic features;

[0070] Step 1.3: Clean the data of noise and irrelevant information, delete null values ​​or outliers, and ensure the quality of feature data. Through this process, the noise that affects feature expression is removed and the accuracy of gene features is improved;

[0071] Step 1.4: Standardize the extracted gene features to ensure comparability between different features. By standardizing, the gene feature vectors are ensured to have the same scale in different dimensions.

[0072] Step 1.5: Select features that are useful for malicious code detection and classification tasks and remove redundant features. Through feature selection, retain the gene features that contribute significantly to detection and classification, and generate an optimized gene feature vector.

[0073] Step 2: Manage and classify the genetic feature vectors extracted and optimized in Step 1. First, perform a preliminary classification of the genetic feature vectors of all malicious code samples, dividing them into multiple initial categories based on the similarity of their genetic features. The gene library construction process is shown in Figure 2. The gene processing in the gene library is the same as that of the samples.

[0074] Step 2.1: Perform feature segmentation on the basic features extracted from static analysis and dynamic analysis. Use predefined gene segmentation rules to segment the basic features into independent gene segments.

[0075] Step 2.2: Map each gene segment to gene expression, that is, convert the gene segment into a feature vector;

[0076] Step 2.3: All gene fragments are combined into a complete gene sequence. By splicing or arranging the feature vectors of multiple gene fragments, a complete gene sequence of the code is constructed, so that it can be effectively compared with the existing malicious code genes in the malicious code gene library.

[0077] Step 3: Obtain the gene feature vector of the sample to be tested. Use the gene feature vector extracted and optimized in Step 2 as input and prepare to compare it with the gene features in the gene library to calculate similarity.

[0078] Step 3.1: Compare the gene feature vector of the sample to be tested with all the gene features in the gene library. The improved Siamese network is used to calculate the similarity between the sample and each gene feature in the gene library. The detection process of the improved Siamese network is shown in Figure 3. The input of the network model is two gene feature vectors, representing the sample to be tested and a gene feature vector in the gene library respectively. The similarity score is generated through network calculation. The similarity calculation formula of the improved Siamese network is:

[0079]

[0080] Where, and Represent the gene feature vectors in the sample to be tested and the gene library respectively, is the feature extraction function of the network, is the weight matrix obtained through training, is the activation function that outputs the similarity score.

[0081] Step 3.2: By combining statistical analysis with the improved Siamese network output score, a similarity threshold is dynamically set based on the similarity distribution of gene features in the gene library for subsequent similarity screening. The threshold setting not only considers the mean and standard deviation of the similarity, but also introduces a correction for feature weighting. The formula is as follows:

[0082] ;

[0083] Where, is the similarity threshold, and Represent the mean and standard deviation of similarity scores in the malicious code gene library; 、 Both are adjustment coefficients, used to control the impact of standard deviation and feature deviation on the threshold; represents the weight of the i-th feature, represents the eigenvalue output by the improved Siamese network, represents the expected value of the feature; n represents the number of features;

[0084] Step 3.3: Screen out gene features with high similarity and select them according to the set threshold , the gene features whose similarity scores output by the improved Siamese network exceed the threshold are screened out, and it is considered that these gene features have a high similarity with the sample to be tested;

[0085] Step 3.4: Evaluate the relationship between gene features and further analyze the similar gene features screened out. The improved Siamese network structure is shown in Figure 4. Combined with the adaptive weighting algorithm, the weights of different features are dynamically adjusted to ensure that the influence weights of each feature are reasonably distributed during the evaluation process, ultimately obtaining accurate similarity detection results. The adaptive weighting formula is as follows:

[0086]

[0087] Where, represents the weight of the i-th feature, is the similarity value of the corresponding feature, 、 Both are weight adjustment coefficients, which are used to control the distribution of weights.

[0088] Step 4: Perform a comprehensive analysis of the similarity results obtained in step 3. Collect all gene features whose similarity with the sample to be tested exceeds the set threshold for further comprehensive analysis.

[0089] Step 4.1: Based on the similarity analysis results of the improved Siamese network, if the similarity between the gene signature of the code file to be detected and one or more gene signatures in the malicious code gene library exceeds a threshold, the code file is determined to contain malicious code;

[0090] Step 4.2: For code files determined to contain malicious code, determine their possible family affiliation by analyzing the similarity between the malicious code and the gene features of different families in the malicious code gene library; select the family with the highest similarity as the family affiliation of the malicious code;

[0091] Step 4.3: Generate a detection report; based on the similarity analysis results, generate a detailed detection report, including whether the code sample is malicious code, its possible family affiliation, and similarity analysis details.

[0092] Step 5: Gene library update and optimization: Based on the detection results, update and optimize the malicious code gene library so that the malicious code gene library covers the latest malicious code samples and variant features.

[0093] Step 5.1: For the malicious code sample whose family is determined to belong to, extract its genetic features again to ensure the accuracy and completeness of the features;

[0094] Step 5.2: Add the genetic features of the new malicious code sample to the corresponding malicious code family gene library;

[0095] Step 5.3: De-redundancy processing is performed on the updated malicious code gene library, merging highly similar gene features to avoid the gene library being too long and repetitive;

[0096] Step 5.4: Regularly maintain and update the malicious code gene library based on the introduction of new malicious code samples and changes to existing malicious code samples; and dynamically optimize the structure and feature distribution of the gene library based on the latest threat intelligence to ensure that the gene library always covers the latest malicious code and its variants.

[0097] In the embodiment, the method of the present invention is compared with several different anti-virus engines, and the comparison results are as follows: Figure 5 As shown, Figure 5 (i) is a scatter plot of the distribution of data points of different categories in the original data set. Although the boundaries of data points of different categories are relatively clear in the figure, there is still a certain degree of confusion. Figure 5 (a), (c), (e) and (g) are the clustering effect diagrams after different detection systems perform family classification on samples. Figure 5 The results of mapping high-dimensional features to two-dimensional space through the dimensionality reduction algorithm t-SNE are shown. Points of different colors represent different malware families. Figure 5 The clustering effect shown in (g) on ​​the two-dimensional plane is more concentrated and the class intervals are more obvious, indicating that the method of the present invention is more discriminative in malware family classification.

[0098] contrast Figure 5(b), (d), (f), and (h) compare the detection accuracy of different detection systems, and the horizontal axis is the true label. S i , the vertical axis is the predicted value of different system detection The orange solid line represents the fitted line between the predicted value and the true value. , and the red dotted line represents the prediction line under ideal conditions, where k It represents the slope between the predicted value and the true value. b The closer the slope 𝑘 is to 1 and the closer the intercept 𝑏 is to 0, the more accurate the test result. The comparison results show that the method of the present invention has higher accuracy and exhibits smaller deviation, which confirms the superiority of the present invention in accuracy and detection capability.

[0099] The present invention is compared with other anti-virus engines in terms of key performance indicators. The comparison results are shown in Table 1. From the data in the table, it can be seen that the present invention has achieved a higher level in all indicators.

[0100] Table 1 Comparison results of detection between this system and some anti-virus engines

[0101]

Claims

1. A malicious code detection method based on software genes and improved Siamese network, characterized by: The following steps are involved: Step 1: Data preprocessing: static analysis and dynamic analysis are performed on the code files to be tested to extract basic features; Step 2: Convert the basic features obtained in step 1 into gene fragments, map them to gene expression, and construct the gene sequence of the code; Step 3: Using the improved Siamese network, the gene sequence extracted in step 2 is compared with the known malicious code gene library to obtain the similarity calculation result; Step 3.1: Compare the gene feature vector of the sample to be tested with all gene features in the malicious code gene library; use the improved Siamese network to calculate the similarity between the sample and each gene feature in the malicious code gene library; Step 3.2: Combining the similarity scores of the statistical analysis and the improved Siamese network output, the similarity threshold is dynamically set according to the similarity distribution of gene features in the malicious code gene library. The calculation formula of the similarity threshold is: ； Where, is the similarity threshold, and Represent the mean and standard deviation of similarity scores in the malicious code gene library; 、 Both are adjustment coefficients, used to control the impact of standard deviation and feature deviation on the threshold; represents the weight of the i-th feature, represents the eigenvalue output by the improved Siamese network, represents the expected value of the feature; n represents the number of features; Step 3.3: Screen out gene features with higher similarity; according to the set similarity threshold , the gene features whose similarity scores output by the improved Siamese network exceed the threshold are screened out, and it is judged that these gene features have a high similarity with the sample to be tested; Step 3.4: Evaluate the relationship between gene features. Further analyze the similar gene features screened in step 3.

3. Use an adaptive weighting algorithm to dynamically adjust the weights of different features to ensure that the influence weights of each feature are reasonably distributed during the evaluation process, ultimately obtaining accurate similarity detection results. Step 4: Based on the similarity calculation results, determine whether the code file contains malicious gene features. If so, further determine the malicious code family it belongs to and output the detection and classification results.

2. The malicious code detection method according to claim 1, wherein: It also includes step 5: gene library update and optimization, which updates and optimizes the malicious code gene library based on the detection results so that the malicious code gene library covers the latest malicious code samples and variant features.

3. The malicious code detection method according to claim 1 or 2, characterized in that: The improved Siamese network includes an encoder, an adaptive weighting module and a decoder, wherein the encoder includes a first convolutional layer, a maximum pooling layer, a second convolutional layer, an average pooling layer, a third convolutional layer and a flattening layer; the decoder includes three fully connected layers; and the adaptive weighting module includes an adaptive weighting algorithm.

4. The malicious code detection method according to claim 3, wherein: The step 1 specifically includes the following sub-steps: Step 1.1: Use the static analysis tool IDA Pro to analyze the code structure, API call sequence, and string constants of the code file to be tested to obtain static features; Step 1.2: Use the dynamic analysis platform to analyze the runtime behavior and system call sequence of the code file to be tested to obtain dynamic features; Step 1.3: Clear the noise and irrelevant information in the data, delete null values ​​or outliers, and ensure the quality of feature data; Step 1.4: Standardize the extracted basic features to make different features comparable.

5. The malicious code detection method according to claim 4, characterized in that: The step 2 specifically includes the following sub-steps: Step 2.1: Perform feature segmentation on the basic features extracted from static analysis and dynamic analysis. Use predefined gene segmentation rules to segment the basic features into independent gene segments. Step 2.2: Map each gene fragment to gene expression and convert it into a feature vector; Step 2.3: Combine all gene fragments into a complete gene sequence. By splicing or arranging the feature vectors of multiple gene fragments, a complete gene sequence of the code is constructed so that it can be compared with the existing malicious code genes in the malicious code gene library for similarity.

6. The malicious code detection method according to claim 5, characterized in that: In step 3.1, the specific calculation formula of the similarity is: ； Where, represents the similarity function, 、 Respectively represent the gene feature vectors in the sample to be detected and the malicious code gene library, is the feature extraction function of the improved Siamese network, represents the weight matrix, is the activation function.

7. The malicious code detection method according to claim 6, characterized in that: In step 3.4, the calculation formula of the adaptive weighted algorithm is: ； Where, represents the weight of the i-th feature, is the similarity value of the corresponding feature, 、 Both are weight adjustment coefficients, which are used to control the distribution of weights.

8. The malicious code detection method according to claim 6 or 7, characterized in that: Step 4 specifically includes the following sub-steps: Step 4.1: Based on the similarity analysis results of the improved Siamese network, if the similarity between the gene signature of the code file to be detected and one or more gene signatures in the malicious code gene library exceeds a threshold, the code file is determined to contain malicious code; Step 4.2: For code files determined to contain malicious code, determine their possible family affiliation by analyzing the similarity between the malicious code and the gene features of different families in the malicious code gene library; select the family with the highest similarity as the family affiliation of the malicious code; Step 4.3: Generate a detailed detection report based on the similarity analysis results.

9. The malicious code detection method according to claim 2, wherein: Step 5 specifically includes the following sub-steps: Step 5.1: Extract the genetic features of the new sample and add it to the corresponding malicious code family gene library, marking it as a new sample; Step 5.2: De-redundancy processing is performed on the updated malicious code gene library, merging highly similar gene features to avoid the gene library being too long and repetitive; Step 5.3: Regularly maintain and update the malicious code gene library based on the introduction of new malicious code samples and changes to existing malicious code samples.

Images