An intelligent multi-dimensional evolutionary collaborative analysis method and device for malicious attack features

Abstract

The embodiment of the present application provides an intelligent multi-dimensional evolutionary collaborative analysis method and device for malicious attack features, which relates to the field of data processing technology. The specific scheme is as follows: based on the decompiled data of the target software, the target features of the target software in each target feature dimension are obtained; respectively, the encoding features of each target feature obtained by encoding each target feature are reconstructed to obtain the reconstructed features of each target feature; the reconstruction error between each target feature and the reconstructed features of each target feature is obtained; the distance between the error vector and the reconstruction error distribution of the known software is calculated, and the error vector is the vector formed by each reconstruction error obtained; if the distance is less than or equal to the distance threshold, the known software classification to which the target software belongs is determined based on the error vector, otherwise, the target software is determined to be abnormal software. The scheme provided by the embodiment of the present application can be used to identify malicious software in the control system.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an intelligent multi-dimensional evolutionary collaborative analysis method and device for malicious attack features. Background Art

[0002] With the development of network technology, control systems are being applied in more and more fields to intelligently control equipment, thereby improving equipment operation efficiency, automation management level, etc. For example, in the field of industrial Internet of Things, industrial control systems are used to control various industrial equipment, thereby improving the production efficiency of industrial equipment, etc. However, control systems are easily targeted by malware attacks, posing a threat to the security of control systems. Therefore, it is necessary to detect the software running in the control system to identify malware in the control system. Summary of the invention

[0003] The purpose of the embodiment of the present application is to provide an intelligent multi-dimensional evolution collaborative analysis method and device for malicious attack features to identify malware in a control system. The specific technical solution is as follows:

[0004] According to one aspect of an embodiment of the present application, a method for intelligent multi-dimensional evolutionary collaborative analysis of malicious attack features is provided, the method comprising:

[0005] Based on the decompiled data of the target software, obtaining target features of the target software in each target feature dimension;

[0006] Encode each target feature respectively to obtain the encoded feature of each target feature, and reconstruct features based on the encoded feature of each target feature to obtain the reconstructed feature of each target feature;

[0007] Obtaining a reconstruction error between each target feature and a reconstructed feature of each target feature;

[0008] Calculating the distance between the error vector and the reconstruction error distribution of the known software, wherein the error vector is a vector formed by each reconstruction error obtained;

[0009] If the distance is less than or equal to a distance threshold, the known software category to which the target software belongs is determined based on the error vector; if the distance is greater than the distance threshold, the target software is determined to be abnormal software, wherein the known software category includes: a category of known malware and a category of known non-malware.

[0010] In one embodiment of the present application, the target feature dimension is determined in the following manner:

[0011] Obtaining a feature sequence of each first sample software, wherein the feature sequence includes: features of the first sample software in each initial feature dimension, the first sample software being a known software;

[0012] For each first sample software, based on the current weight sequence formed by the weight of each feature in the feature sequence of the first sample software, obtain an accuracy characterization value for classifying the first sample software as malware using the feature sequence of the first sample software; if the obtained accuracy characterization value is greater than the optimal accuracy characterization value of the first sample software, update the optimal accuracy characterization value of the first sample software to the obtained accuracy characterization value, and update the optimal weight sequence of the first sample software to the current weight sequence of the first sample software, wherein the weight characterization of the feature represents the importance of the feature to classifying the first sample software as malware;

[0013] If the maximum value among the optimal accuracy characterization values ​​of the first sample software is greater than the global optimal accuracy characterization value, then the global optimal accuracy characterization value is updated to the maximum value, and the global optimal weight sequence is updated to the optimal weight sequence of the first sample software corresponding to the maximum value;

[0014] Based on the optimal weight sequence, current weight sequence and global optimal weight sequence of each first sample software, calculate the weight adjustment step sequence of each first sample software, adjust the weight in the current weight sequence of each first sample software based on the obtained weight adjustment step sequence, and re-obtain the accuracy characterization value for each first sample software until the iteration end condition is met;

[0015] In descending order of weights, a first number of weights are selected from the global optimal weight sequence, and initial feature dimensions of features corresponding to the selected weights are determined as target feature dimensions.

[0016] In one embodiment of the present application, the step of calculating the weight adjustment step length sequence of each first sample software based on the optimal weight sequence of each first sample software, the current weight sequence and the global optimal weight sequence includes:

[0017] For each first sample software, the weight adjustment step sequence is calculated in the following manner:

[0018] Based on a preset inertia weight coefficient, obtaining a first adjustment step length of each weight in a current weight sequence of the first sample software;

[0019] Based on each weight in the optimal weight sequence of the first sample software, obtaining a second adjustment step length for each weight in the current weight sequence of the first sample software;

[0020] Based on each weight in the global optimal weight sequence, obtaining a third adjustment step length of each weight in the current weight sequence of the first sample software;

[0021] The adjustment step of each weight in the current weight sequence of the first sample software is calculated according to the first adjustment step, the second adjustment step and the third adjustment step, to obtain a weight adjustment step sequence including the obtained adjustment step.

[0022] In one embodiment of the present application, the current weight sequence formed based on the weights of each feature in the feature sequence of the first sample software, obtaining the accuracy characterization value of malware classification of the first sample software using the feature sequence of the first sample software, includes:

[0023] Using various preset malware classification methods respectively, based on the current weight sequence formed by the weights of each feature in the feature sequence of the first sample software and the feature sequence of the first sample software, the first sample software is classified as malware, and a classification accuracy representation value corresponding to each malware classification method is obtained;

[0024] The maximum characterization value among the obtained classification accuracy characterization values ​​is determined as the accuracy characterization value for classifying the first sample software as malware using the feature sequence of the first sample software.

[0025] In one embodiment of the present application, the initial feature dimension includes at least one of the following dimensions:

[0026] The characteristic dimensions that describe the operations triggered by the software, the characteristic dimensions that describe the interface calls triggered by the software, the characteristic dimensions that describe the software control flow, the characteristic dimensions that describe the software properties, and the characteristic dimensions that describe the software organizational structure.

[0027] In one embodiment of the present application, the calculating the distance between the error vector and the reconstruction error distribution of the known software includes:

[0028] The distance between the error vector and the reconstructed error distribution of the known software is calculated based on the error vector and the mean vector, wherein the mean vector is: the average vector of the sample error vectors of each second sample software, the sample error vector is: the vector formed by the error between the first sample feature and the reconstructed feature of the first sample feature, the first sample feature is: the feature of the second sample software in each target feature dimension, and the second sample software is the known software.

[0029] In one embodiment of the present application, the distance threshold is determined in the following manner:

[0030] Calculating the Mahalanobis distance between the sample error vector of each second sample software and the average value vector;

[0031] Obtaining distance distribution information of the calculated Mahalanobis distance;

[0032] A distance value of the distance distribution information at a preset quantile is determined as the distance threshold.

[0033] In one embodiment of the present application, encoding each target feature to obtain a coding feature of each target feature, and reconstructing features based on the coding features of each target feature to obtain a reconstructed feature of each target feature include:

[0034] For each target feature dimension, input the target feature under the target feature dimension into the encoder in the codec group corresponding to the target feature dimension in the pre-trained malware detection model for encoding, input the encoded feature of the target feature output by the encoder into the decoder in the codec group corresponding to the target feature dimension for feature reconstruction, and obtain the reconstructed feature of the target feature output by the decoder, wherein the malware detection model includes a first number of codec groups and classification layers, each codec group corresponds to a target feature dimension, and the first number is equal to the number of target feature dimensions;

[0035] If the distance is less than or equal to a distance threshold, determining the malware category to which the target software belongs based on the error vector includes:

[0036] If the distance is less than or equal to a distance threshold, the error vector is input into the classification layer to classify the target software as malware.

[0037] According to another aspect of an embodiment of the present application, a malware detection model training method is provided, the method comprising:

[0038] Based on the decompiled data of the third sample software, obtaining the second sample features of the third sample software in each target feature dimension, wherein the third sample software includes known software;

[0039] For each target feature dimension, input the second sample feature under the target feature dimension into the encoder in the codec group corresponding to the target feature dimension in the malware detection model for encoding, input the encoded feature of the second sample feature output by the encoder into the decoder in the codec group corresponding to the target feature dimension for feature reconstruction, and obtain the reconstructed feature of the second sample feature output by the decoder, wherein the malware detection model includes a first number of codec groups and classification layers, each codec group corresponds to a target feature dimension, and the first number is equal to the number of target feature dimensions;

[0040] Obtaining a sample reconstruction error between each second sample feature and a reconstructed feature of each second sample feature;

[0041] Calculating the distance between a sample error vector and a reconstruction error distribution of a known software, wherein the sample error vector is a vector formed by the obtained reconstruction errors of each sample;

[0042] If the distance is less than or equal to the distance threshold, input the sample error vector into the classification layer to classify the third sample software as malware, and output the classification result;

[0043] If the distance is greater than the distance threshold, determining that the classification result indicates that the third sample software is abnormal software;

[0044] Obtaining a training loss value based on the sample error vector, the classification result, and the malware classification label of the third sample software;

[0045] Based on the training loss value, model parameters of the malware detection model are adjusted.

[0046] According to another aspect of the embodiment of the present application, there is provided an intelligent multi-dimensional evolution collaborative analysis device for malicious attack features, the device comprising:

[0047] A target feature acquisition module, used for obtaining target features of the target software in each target feature dimension based on the decompiled data of the target software;

[0048] A feature reconstruction module is used to encode each target feature respectively to obtain the encoding feature of each target feature, and to reconstruct features based on the encoding feature of each target feature to obtain the reconstructed feature of each target feature;

[0049] A first reconstruction error obtaining module is used to obtain a reconstruction error between each target feature and a reconstructed feature of each target feature;

[0050] A first distance calculation module, used for calculating the distance between an error vector and a reconstruction error distribution of a known software, wherein the error vector is a vector formed by each reconstruction error obtained;

[0051] A first malware classification module, configured to determine, when the distance is less than or equal to a distance threshold, a known software classification to which the target software belongs based on the error vector, wherein the known software classification includes: a classification of known malware and a classification of known non-malware;

[0052] The first abnormal software determining module is used to determine that the target software is abnormal software when the distance is greater than the distance threshold.

[0053] In one embodiment of the present application, the target feature dimension is determined in the following manner: a feature sequence of each first sample software is obtained, wherein the feature sequence includes: features of the first sample software in each initial feature dimension, and the first sample software is a known software; for each first sample software, based on a current weight sequence formed by weights of each feature in the feature sequence of the first sample software, an accuracy characterization value for malware classification of the first sample software using the feature sequence of the first sample software is obtained; if the obtained accuracy characterization value is greater than the optimal accuracy characterization value of the first sample software, the optimal accuracy characterization value of the first sample software is updated to the obtained accuracy characterization value, and the optimal weight sequence of the first sample software is updated to the current weight sequence of the first sample software, wherein the weight characterization feature of the feature is the accuracy characterization value of the first sample software. The importance of malware classification; if the maximum value of the optimal accuracy characterization value of each first sample software is greater than the global optimal accuracy characterization value, then the global optimal accuracy characterization value is updated to the maximum value, and the global optimal weight sequence is updated to the optimal weight sequence of the first sample software corresponding to the maximum value; based on the optimal weight sequence of each first sample software, the current weight sequence and the global optimal weight sequence, the weight adjustment step sequence of each first sample software is calculated, and the weight in the current weight sequence of each first sample software is adjusted based on the obtained weight adjustment step sequence, and the accuracy characterization value is regained for each first sample software until the iteration end condition is met; in order of weight from large to small, a first number of weights are selected from the global optimal weight sequence, and the initial feature dimension of the feature corresponding to the selected weight is determined as the target feature dimension.

[0054] In one embodiment of the present application, the weight adjustment step length sequence of each first sample software is calculated based on the optimal weight sequence, current weight sequence and global optimal weight sequence of each first sample software, including: for each first sample software, the weight adjustment step length sequence is calculated in the following manner: based on a preset inertia weight coefficient, a first adjustment step length of each weight in the current weight sequence of the first sample software is obtained; based on each weight in the optimal weight sequence of the first sample software, a second adjustment step length of each weight in the current weight sequence of the first sample software is obtained; based on each weight in the global optimal weight sequence, a third adjustment step length of each weight in the current weight sequence of the first sample software is obtained; according to the first adjustment step length, the second adjustment step length and the third adjustment step length, the adjustment step length of each weight in the current weight sequence of the first sample software is calculated to obtain a weight adjustment step length sequence including the obtained adjustment step lengths;

[0055] In one embodiment of the present application, the current weight sequence formed based on the weights of each feature in the feature sequence of the first sample software is used to obtain the accuracy characterization value of classifying the first sample software as malware using the feature sequence of the first sample software, including: using various preset malware classification methods respectively, based on the current weight sequence formed based on the weights of each feature in the feature sequence of the first sample software and the feature sequence of the first sample software, classifying the first sample software as malware to obtain the classification accuracy characterization value corresponding to each malware classification method; and determining the maximum characterization value among the obtained classification accuracy characterization values ​​as the accuracy characterization value of classifying the first sample software as malware using the feature sequence of the first sample software.

[0056] In one embodiment of the present application, the initial feature dimension includes at least one of the following dimensions: a feature dimension describing the operation triggered by the software, a feature dimension describing the interface call triggered by the software, a feature dimension describing the software control flow, a feature dimension describing the software attributes, and a feature dimension describing the software organizational structure.

[0057] In one embodiment of the present application, the first distance calculation module is specifically used to calculate the distance between the error vector and the reconstructed error distribution of the known software based on the error vector and the mean vector, wherein the mean vector is: the average vector of the sample error vectors of each second sample software, the sample error vector is: the vector formed by the error between the first sample feature and the reconstructed feature of the first sample feature, the first sample feature is: the feature of the second sample software in each target feature dimension, and the second sample software is the known software.

[0058] In one embodiment of the present application, the distance threshold is determined in the following manner: calculating the Mahalanobis distance between the sample error vector of each second sample software and the average value vector; obtaining distance distribution information of the calculated Mahalanobis distance; determining the distance value of the distance distribution information at a preset quantile as the distance threshold.

[0059] In one embodiment of the present application, the feature reconstruction module is specifically used to, for each target feature dimension, input the target feature under the target feature dimension into the encoder in the codec group corresponding to the target feature dimension in the pre-trained malware detection model for encoding, and input the encoded features of the target features output by the encoder into the decoder in the codec group corresponding to the target feature dimension for feature reconstruction, so as to obtain the reconstructed features of the target features output by the decoder, wherein the malware detection model includes a first number of codec groups and classification layers, each codec group corresponds to a target feature dimension, and the first number is equal to the number of target feature dimensions; the first malware classification module is specifically used to, when the distance is less than or equal to the distance threshold, input the error vector into the classification layer to classify the target software as malware.

[0060] According to another aspect of an embodiment of the present application, a malware detection model training device is provided, the device comprising:

[0061] A second sample feature obtaining module, configured to obtain second sample features of the third sample software in each target feature dimension based on decompiled data of the third sample software, wherein the third sample software includes known software;

[0062] a reconstructed feature acquisition module, for each target feature dimension, inputting the second sample feature under the target feature dimension into the encoder in the codec group corresponding to the target feature dimension in the malware detection model for encoding, inputting the encoded feature of the second sample feature output by the encoder into the decoder in the codec group corresponding to the target feature dimension for feature reconstruction, and obtaining the reconstructed feature of the second sample feature output by the decoder, wherein the malware detection model includes a first number of codec groups and classification layers, each codec group corresponds to a target feature dimension, and the first number is equal to the number of target feature dimensions;

[0063] A second reconstruction error obtaining module, used to obtain a sample reconstruction error between each second sample feature and a reconstructed feature of each second sample feature;

[0064] A second distance calculation module is used to calculate the distance between the sample error vector and the reconstruction error distribution of the known software, wherein the sample error vector is a vector formed by the obtained reconstruction errors of each sample;

[0065] A second malware classification module is configured to input the sample error vector into the classification layer to classify the third sample software as malware when the distance is less than or equal to the distance threshold, and output a classification result, wherein the known software classification includes: classification of known malware and classification of known non-malware;

[0066] A second abnormal software determination module is used to determine that, when the distance is greater than the distance threshold, the classification result indicates that the third sample software is abnormal software;

[0067] A training loss value obtaining module, used to obtain a training loss value based on the sample error vector, the classification result and the malware classification label of the third sample software;

[0068] A model parameter adjustment module is used to adjust the model parameters of the malware detection model based on the training loss value.

[0069] According to another aspect of the embodiments of the present application, there is provided an electronic device, including:

[0070] Memory, used to store computer programs;

[0071] The processor is used to implement any of the above-mentioned intelligent multi-dimensional evolutionary collaborative analysis methods of malicious attack features when executing the program stored in the memory.

[0072] According to another aspect of an embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the intelligent multi-dimensional evolutionary collaborative analysis method of any of the above-mentioned malicious attack features is implemented.

[0073] According to another aspect of the embodiments of the present application, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute any of the intelligent multi-dimensional evolutionary collaborative analysis methods of malicious attack features described above.

[0074] Beneficial effects of the embodiments of the present application:

[0075] As can be seen from the above, the intelligent multi-dimensional evolution collaborative analysis method of malicious attack features provided in the embodiment of the present application is applied, by obtaining the target features of the decompiled data of the target software in each target feature dimension, then encoding the target features, and reconstructing the obtained encoded features, extracting the reconstructed features to represent the deep features of the software, and then calculating the reconstruction error between the reconstructed features and the target features. In this way, the features of multiple target dimensions of the target software are multi-dimensionally evolved to obtain an error vector formed by the reconstruction error, and the distance between the error vector combining the features of multiple target dimensions and the reconstruction error of the known software is calculated to achieve collaborative analysis of the above-mentioned multi-dimensional features. In this way, the collaborative analysis can more accurately determine the distance between the malicious attack features representing the target software and the known software of each classification. In the case where the target software belongs to malware, it can be determined that the distance between the malicious attack features of the target software and the malicious attack features of the known software is less than the distance threshold. Then, according to the malicious attack feature analysis of the target software, it can be obtained that the target software belongs to malware in the known software classification. Similarly, based on the above distance, it is possible to more accurately analyze whether the target software is malware, or analyze whether the target software is abnormal software. In the case where the target software belongs to an abnormal software of an unknown software category, the target software can also be regarded as malware to achieve malware identification.

[0076] Of course, implementing any product or method of the present application does not necessarily require achieving all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0078] Figure 1 A schematic diagram of a flow chart of an intelligent multi-dimensional evolutionary collaborative analysis method of malicious attack features provided in an embodiment of the present application;

[0079] Figure 2a A flowchart of a method for determining target feature dimensions provided in an embodiment of the present application;

[0080] Figure 2b A schematic diagram of a flow chart of another target feature dimension determination method provided in an embodiment of the present application;

[0081] Figure 3 A schematic diagram of the structure of a malware detection model provided in an embodiment of the present application;

[0082] Figure 4A flowchart of a malware detection model training method provided in an embodiment of the present application;

[0083] Figure 5 A schematic diagram of the structure of an intelligent multi-dimensional evolution collaborative analysis device for malicious attack features provided in an embodiment of the present application;

[0084] Figure 6 A schematic diagram of the structure of a malware detection model training device provided in an embodiment of the present application;

[0085] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0086] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field based on the present application belong to the scope of protection of the present application.

[0087] The execution subject of the embodiment of the present application is described below.

[0088] The solution provided in the embodiment of the present application can be applied to electronic devices such as desktop computers, laptops, tablet computers, servers, and can also be applied to a detection platform that is communicatively connected to the system, platform, and device to be detected. For example, in an industrial intelligent production scenario, the detection platform can be deployed in the industrial Internet of Things under the industrial intelligent production scenario and communicated with each industrial Internet of Things device. For another example, in the field of intelligent transportation, the detection platform can be deployed in an intelligent transportation system and communicated with the system nodes in each intelligent transportation system. For ease of expression, the execution subject of the intelligent multi-dimensional evolution collaborative analysis method of malicious attack features provided in the embodiment of the present application is collectively referred to as a detection platform.

[0089] The application scenarios of the embodiments of the present application are described below using the above two scenarios as examples.

[0090] 1. In the industrial intelligent production scenario, the industrial control system can control various industrial IoT devices in the industrial IoT to improve the production efficiency and automation management level of industrial equipment. It can be seen that the security of industrial control systems and industrial IoT is very important, and it is necessary to detect the software of industrial control systems and various industrial IoT devices in the industrial IoT. For example, when performing malware detection, the detection platform can perform malware detection on the software such as applications and firmware running in various industrial IoT devices. For example, the detection platform can perform malware detection on the software in various industrial IoT devices in real time. After detecting malware, the information of the detected malware and the category to which the malware belongs can be sent to personnel in a timely manner. Among them, industrial IoT devices can include PLC (Programmable Logic Controller), SCADA (Supervisory Control And Data Acquisition), HMI (Human Machine Interface) and other sensors in the industrial IoT.

[0091] Second, in the field of intelligent transportation, intelligent transportation systems can realize functions such as traffic flow management, real-time road condition monitoring and autonomous driving. Among them, intelligent transportation systems can include system nodes such as sensors, communication equipment, control subsystems and data analysis platforms. Obviously, intelligent transportation systems used to realize functions such as autonomous driving have high security requirements. In order to avoid malware threats to the security of intelligent transportation systems, it is necessary to detect malware in intelligent transportation systems. For example, the detection platform can perform malware detection on the application programs, firmware and other software running in the equipment belonging to the intelligent transportation system and the equipment belonging to each system node included in the intelligent transportation system. Among them, the equipment belonging to each system node in the transportation system may include: on-board sensors, roadside units, camera control subsystems, traffic signal control subsystems, vehicle control subsystems, and their electronic devices. Among them, the on-board sensors are used to collect vehicle speed, position and lane deviation information. The on-board sensors can be deployed on the vehicle and can communicate with other system nodes through the vehicle network; the roadside unit is used to communicate with the vehicle control subsystem, and can also enable communication between different vehicle control subsystems. The roadside unit can be deployed on equipment on both sides of the road; the camera control subsystem is used to monitor information such as traffic flow and road conditions, and send the above information to the intelligent transportation system. The camera control subsystem can be deployed at intersections and equipment on both sides of the road; the traffic signal control subsystem is used to control traffic signals such as traffic lights, and can be deployed on equipment located on the road; the vehicle control subsystem is deployed in the vehicle to control the vehicle according to the information sent by the on-board sensors to realize the automatic driving function.

[0092] The solution provided in the embodiment of the present application can also be applied to other scenarios where malware detection is required, and the embodiment of the present application does not limit the application scenario.

[0093] The following is a detailed description of the intelligent multi-dimensional evolutionary collaborative analysis method of malicious attack features according to an embodiment of the present application.

[0094] In one embodiment of the present application, see Figure 1 A flow chart of an intelligent multi-dimensional evolutionary collaborative analysis method of malicious attack features is provided, the method comprising the following steps S101-S106.

[0095] Step S101: based on the decompiled data of the target software, obtaining the target features of the target software in each target feature dimension.

[0096] Among them, the detection platform can disassemble the binary file of the target software based on the disassembly tool to obtain the assembly code of the target software as the decompiled data of the target software. The assembly code is easier to analyze and understand. Based on such decompiled data, more accurate features of the target software can be extracted and more accurate target features of the target software in each target feature dimension can be obtained. In addition, the operating system of the device to which the target software belongs is different, and the disassembly tool used for disassembling the binary file of the target software is also different. For example, for the Windows operating system, the detection platform can use IDA Pro (Interactive Disassembler Professional) for disassembly processing. For another example, for the Linux operating system, the detection platform can use Binary Ninja (a binary disassembly tool) or Ghidra (a disassembly tool) for disassembly processing.

[0097] The target feature dimension is a feature dimension of a preset number of types selected. In one way, the target feature dimension can be pre-selected based on the experience of personnel. In another way, the target feature dimension can be selected from each initial feature dimension based on the importance of the feature of the feature dimension to the classification of malware. Specifically, the method of selecting the target feature dimension is described in the following embodiment.

[0098] For different application scenarios, the target software that the detection platform needs to detect is also different. Taking the two application scenarios mentioned above as examples, in the industrial intelligent production scenario, the detection platform can use the application programs, firmware and other software running in the industrial IoT devices and industrial control system devices as the target software. In the field of intelligent transportation, the detection platform can use the application programs, firmware and other software running in the devices belonging to each system node in the transportation system as the target software.

[0099] The method of obtaining the target features is described below.

[0100] Specifically, the detection platform extracts the target data corresponding to the target feature dimension from the decompiled data for each dimension of the target feature dimension, and performs standardization on the obtained target data to obtain the target features of each target feature dimension. The method of extracting data from the decompiled data is described in the following embodiment and will not be described in detail here.

[0101] Step S102: Encode each target feature respectively to obtain the encoded feature of each target feature, and reconstruct features based on the encoded feature of each target feature to obtain the reconstructed feature of each target feature.

[0102] In one implementation, for each target feature, the target feature is input into a pre-trained encoder-decoder, the encoder encodes the target feature to obtain the encoded feature, and the encoded feature is input into the decoder, the decoder decodes the encoded feature to obtain the reconstructed feature of each target feature output by the decoder.

[0103] Another implementation of step S102 is described in the following embodiments and will not be described in detail here.

[0104] Step S103: Obtaining a reconstruction error between each target feature and the reconstructed feature of each target feature.

[0105] Specifically, for each target feature, the detection platform may calculate a reconstruction error based on a difference between the target feature and a reconstructed feature corresponding to the target feature.

[0106] For example, the detection platform uses the root mean square error between the target feature and the reconstructed feature corresponding to the target feature as the reconstruction error. For example, taking the calculation of the root mean square error between the mth target feature and the reconstructed feature of the mth target feature among the target features of the i-th target software as an example, the detection platform can calculate the root mean square error corresponding to the mth target feature of the i-th target software according to the following expression:

[0107] ;

[0108] in, is the mth target feature, is the mth reconstructed feature corresponding to the mth target feature, is the dimension of the feature vector of the mth target feature, is the feature vector of the mth target feature. The eigenvalue of dimension, is the feature vector of the mth reconstructed feature The eigenvalue of the dimension.

[0109] Step S104: Calculate the distance between the error vector and the reconstruction error distribution of the known software.

[0110] The implementation of step S104 is described in the following embodiments and will not be described in detail here.

[0111] Step S105: If the distance is less than or equal to the distance threshold, determine the known software category to which the target software belongs based on the error vector.

[0112] The known software classification includes: a classification of known malicious software and a classification of known non-malicious software.

[0113] Specifically, the detection platform can input the error vector of the target software into a pre-trained classifier, and the classifier performs software classification on the target software to determine whether the target software belongs to a known classification of software, and obtain the software classification to which the target software belongs output by the classifier. Among them, the software classification to which the target software belongs output by the classifier may include: the target software is a known malware classification or the target software is a known non-malware classification. The classifier may be a decision tree classifier, a support vector machine classifier, a naive Bayes classifier, a K nearest neighbor classifier, a random forest classifier, a neural network classifier, a logistic regression classifier, and the like. If the above distance is less than or equal to the distance threshold, it means that the target software is similar to the software of the known classification and belongs to the known software classification, then the category of the specific software to which the target software belongs can be further classified. The software classification to which the target software belongs output by the classifier may include a specific software classification. For example, if the target software is a known classified malware, the specific software classification to which the target software belongs output by the classifier may include Class A (a malware classification), and if the target software is a known non-malware software, the specific software classification to which the target software belongs output by the classifier may include Class C (a non-malware software classification).

[0114] The method of determining the distance threshold is described in the following embodiments and will not be described in detail here.

[0115] Step S106: If the distance is greater than the distance threshold, the target software is determined to be abnormal software.

[0116] If the above distance is greater than the distance threshold, it means that the target software is not similar to the software of the known classification, and is abnormal software that does not belong to the known software classification. The probability that the software that is not similar to the known classification is malware is high, and the abnormal software can be regarded as malware. However, in this case, it is difficult to determine the malware classification to which the abnormal software belongs using the above distance. The detection platform can further judge the classification of malware to which the abnormal software belongs. For example, the detection platform can report malware to the malware analyst for the target software, so that the malware analyst can analyze the target software, and then analyze the classification of malware to which the above abnormal software, that is, the target software, belongs. Of course, if the target software is not malware according to the analysis of the malware analyst, the classification of non-malware software described in the target software can also be further analyzed.

[0117] As can be seen from the above, the intelligent multi-dimensional evolution collaborative analysis method of malicious attack features provided in the embodiment of the present application is applied, by obtaining the target features of the decompiled data of the target software in each target feature dimension, then encoding the target features, and reconstructing the obtained encoded features, extracting the reconstructed features to represent the deep features of the software, and then calculating the reconstruction error between the reconstructed features and the target features. In this way, the multi-dimensional features combined with the target software are multi-dimensionally evolved to obtain the error vector formed by the reconstruction error, and the distance between the error vector of the features combined with the multiple feature dimensions and the reconstruction error of the known software is calculated to achieve collaborative analysis of the above-mentioned multi-dimensional features. In this way, the distance obtained by the collaborative analysis can more accurately represent the distance between the target software and the malicious attack features of the known software of each classification. In the case where the target software belongs to malware, it can be determined that the distance between the malicious attack features of the target software and the malicious attack features of the known software is less than the distance threshold. Then, according to the malicious attack feature analysis of the target software, it can be obtained that the target software belongs to malware in the known software classification. Similarly, based on the above distance, it is possible to more accurately analyze whether the target software is malware, or analyze whether the target software is abnormal software. In the case where the target software belongs to an abnormal software of an unknown software category, the target software can also be regarded as malware to achieve malware identification.

[0118] In one embodiment of the present application, a target feature dimension may be selected from each initial feature dimension according to the importance of the feature dimension to the malware classification. Figure 2a A flow chart of a method for determining a target feature dimension is provided, and the method for determining a target feature dimension includes the following steps S201-S205.

[0119] Step S201: Obtain a feature sequence of each first sample software.

[0120] The feature sequence includes: the features of the first sample software in each initial feature dimension, the feature sequence is the feature set corresponding to the first sample software, and the first sample software is a software of known classification. When determining the target feature dimension, the feature sequence of a first sample software can be used as a particle, and a particle represents the feature set corresponding to the first sample software. When determining the target feature dimension, the feature sequences of each first sample software used can be used as a particle group, and the particle group represents the feature set corresponding to each first sample software used when determining the target feature dimension, and represents the feature set corresponding to all first sample software.

[0121] Specifically, for each first sample software, the first sample software can be disassembled to obtain the decompiled data of the first sample software, and the data corresponding to each initial feature dimension can be extracted from the decompiled data, and then the data corresponding to each initial feature dimension can be standardized to obtain the features of each initial feature dimension. The first sample software can be selected according to the scenario to be detected for malware. For example, for industrial intelligent production scenarios, known software in the software of industrial control systems and various industrial Internet of Things devices in the industrial Internet of Things can be selected as the first sample software. For example, for the field of intelligent transportation, known software in the software such as applications and firmware running in the equipment belonging to the intelligent transportation system and the equipment belonging to each system node included in the intelligent transportation system can be selected as the first sample software.

[0122] In addition, for different initial feature dimensions, the method of extracting data from the decompiled data is also different. The initial feature dimension includes at least one of the following dimensions: a feature dimension describing the operation triggered by the software, a feature dimension describing the interface call triggered by the software, a feature dimension describing the software control process, a feature dimension describing the software attribute, and a feature dimension describing the software organizational structure. The following describes the method of extracting data corresponding to each initial feature dimension from the decompiled data.

[0123] (1) Describe the characteristic dimensions of the actions triggered by the software

[0124] Identify the code that performs the specified operation from the assembly code in the decompiled data, and use the information of the operation object and the operation mode information as the data corresponding to this dimension. The specified operation may include the operation of calling a specified file, the operation of modifying the registry, etc. If the malware needs to implement malicious behaviors such as modifying system settings and shutting down security software, the malware will usually achieve this by triggering the above specified operations.

[0125] (2) Describe the characteristic dimensions of the interface calls triggered by the software

[0126] The code that executes the interface call is identified from the assembly code in the decompiled data, and the called interface information is used as the data corresponding to the dimension.

[0127] (3) Characteristic dimensions describing software control processes

[0128] Identify the grammatical structure that represents the control flow structure from the assembly code in the decompiled data, and construct the control flow graph of the software according to the identified control grammatical structure as the data corresponding to this dimension. The grammatical structure may include a sequential structure, a branch structure, a loop structure, etc. For example, the code of the branch structure may include "if-else", and the code of the loop structure may include "while", etc.

[0129] (4) Characteristic dimensions describing software attributes

[0130] The header information of the file and the header information of the PE (Portable Executable) file are identified from the metadata in the decompiled data as the data corresponding to this dimension. For example, the file type, version, timestamp, format, entry point address, section table, compiler information, etc. can be identified.

[0131] (5) Describe the characteristic dimensions of software organizational structure

[0132] Identify the calling function from the assembly code in the decompiled data, and build a function call graph based on the function call relationship in the code, identify the structural layout information of the code segment and the data segment from the assembly code, and use the above function call graph and structural layout information as the data corresponding to this dimension.

[0133] In this way, the features of different initial feature dimensions are used as the feature sequence of the first sample software, and the influence of features on the accuracy of malware classification is analyzed from different dimensions to select the feature dimensions used for malware classification. This can improve the accuracy of malware classification using features of the target feature dimensions.

[0134] Step S202: For each first sample software, based on the current weight sequence formed by the weights of each feature in the feature sequence of the first sample software, obtain an accuracy characterization value for classifying the first sample software as malware using the feature sequence of the first sample software; if the obtained accuracy characterization value is greater than the optimal accuracy characterization value of the first sample software, update the optimal accuracy characterization value of the first sample software to the obtained accuracy characterization value, and update the optimal weight sequence of the first sample software to the current weight sequence of the first sample software.

[0135] The weight of the feature represents the importance of the feature to the malware classification of the first sample software.

[0136] 1. Obtain accuracy characterization value.

[0137] Specifically, various preset malware classification methods are used respectively, and the first sample software is classified as malware based on a current weight sequence formed by the weights of each feature in the feature sequence of the first sample software and the feature sequence of the first sample software, to obtain a classification accuracy characterization value corresponding to each malware classification method; the maximum characterization value among the obtained classification accuracy characterization values ​​is determined as the accuracy characterization value for classifying the first sample software as malware using the feature sequence of the first sample software.

[0138] Specifically, various preset malware classification methods may be: using a pre-trained classifier to classify malware, for example, a decision tree classifier, a support vector machine classifier, a K nearest neighbor classifier, and a logistic regression classifier may be used to classify the first sample software as malware, and then, for each classifier, according to the classification result output by the classifier and the malware category to which the first sample software belongs, the classification accuracy characterization value corresponding to the classifier is determined. The maximum characterization value among the obtained classification accuracy characterization values ​​is used as the final accuracy characterization value. For example, the accuracy characterization value of malware classification of the first sample software using the feature sequence of the first sample software may be: ,in, is the classification accuracy representation value corresponding to the support vector machine classifier, is the classification accuracy representation value corresponding to the decision tree classifier, is the classification accuracy representation value corresponding to the logistic regression classifier, It is the classification accuracy representation value corresponding to the K nearest neighbor classifier.

[0139] In this way, the first sample software is classified as malware by using a variety of malware classification methods, and the maximum characterization value among the obtained classification accuracy characterization values ​​is used as the accuracy characterization value. This can improve the accuracy of the obtained accuracy characterization value and improve the accuracy of malware classification using the selected target feature dimension.

[0140] 2. Update the optimal accuracy representation value and optimal weight sequence.

[0141] In this iteration, if the obtained accuracy characterization value is greater than the optimal accuracy characterization value of the first sample software, the optimal accuracy characterization value of the first sample software is updated to the obtained accuracy characterization value, and the optimal weight sequence of the first sample software is updated to the current weight sequence of the first sample software; otherwise, the optimal accuracy characterization value of the first sample software and the optimal weight sequence of the first sample software are not updated. For example, if the accuracy characterization value of the kth first sample software in the tth iteration is , the optimal accuracy representation value of the kth first sample software is , the current weight sequence of the kth first sample software is , the optimal weight sequence of the kth first sample software is For example, the optimal weight sequence of the kth first sample software can be updated according to the following expression:

[0142] ;

[0143] Step S203: If the maximum value among the optimal accuracy characterization values ​​of the first sample software is greater than the global optimal accuracy characterization value, the global optimal accuracy characterization value is updated to the maximum value, and the global optimal weight sequence is updated to the optimal weight sequence of the first sample software corresponding to the maximum value.

[0144] For example, the global optimal weight sequence is The global optimal accuracy representation value is , the accuracy representation value of the kth first sample software in the tth iteration is , the current weight sequence of the kth first sample software in the tth iteration is For example, the optimal weight sequence of the kth first sample software can be updated according to the following expression:

[0145] ;

[0146] Step S204: Based on the optimal weight sequence, current weight sequence and global optimal weight sequence of each first sample software, calculate the weight adjustment step sequence of each first sample software, adjust the weight in the current weight sequence of each first sample software based on the obtained weight adjustment step sequence, and re-obtain the accuracy characterization value for each first sample software until the iteration end condition is met.

[0147] The iteration end condition may be: satisfying a preset number of iterations, the iteration end condition may be: the accuracy characterization value is no longer updated, or the iteration end condition may be: the accuracy characterization value is greater than a preset accuracy threshold.

[0148] The weight adjustment step sequence is the step size and adjustment direction for adjusting the weight of each feature in the current weight sequence of the first sample software. The weight adjustment step sequence is used to adjust the weight sequence in the next iteration. Specifically, for each first sample software, the weight adjustment step sequence is calculated in the following manner: based on the preset inertia weight coefficient, the first adjustment step size of each weight in the current weight sequence of the first sample software is obtained. Based on each weight in the optimal weight sequence of the first sample software, the second adjustment step size of each weight in the current weight sequence of the first sample software is obtained. Based on each weight in the global optimal weight sequence, the third adjustment step size of each weight in the current weight sequence of the first sample software is obtained. According to the first adjustment step size, the second adjustment step size and the third adjustment step size, the adjustment step size of each weight in the current weight sequence of the first sample software is calculated to obtain a weight adjustment step size sequence containing the obtained adjustment step size.

[0149] For example, the weight adjustment step sequence for adjusting the weight sequence in the t+1th iteration can be calculated as follows:

[0150] ;

[0151] in, is the weight adjustment step sequence of the kth first sample software for adjusting the weight sequence in the t+1th iteration, is the first adjustment step, is the weight adjustment step sequence used to adjust the weight sequence in the t-th iteration, is the preset inertia weight coefficient, is the second adjustment step size, is the third adjustment step, and is the learning factor, and is a random number, is the weight of the jth feature dimension in the optimal weight sequence of the kth first sample software, is the weight of the jth feature dimension in the current weight sequence of the kth first sample software in the tth iteration, is the weight of the jth feature dimension in the global optimal weight sequence, The mean is 0 and the variance is Gaussian noise.

[0152] In this way, the adjustment step of each weight in the current weight sequence of the first sample software can be calculated more accurately to obtain a weight adjustment step sequence. Based on the above weight adjustment step sequence, a better global optimal weight sequence that can characterize the accuracy of the first sample software for malware classification can be obtained, thereby making the initial feature dimension selected from the global optimal weight sequence more suitable for malware classification, thereby improving the accuracy of malware classification.

[0153] Step S205: Select a first number of weights from the global optimal weight sequence in descending order of weights, and determine the initial feature dimensions of the features corresponding to the selected weights as the target feature dimensions.

[0154] In one implementation, for each first sample software corresponding to the global optimal weight sequence, the initial feature dimensions of the features corresponding to the first number of weights with the largest weights in descending order are selected as the target feature dimensions. For example, the first number may be 30% of the number of dimensions in the initial feature dimensions.

[0155] From the above, it can be seen that by adjusting the weight of each feature in the feature sequence, and then obtaining the accuracy characterization value of malware classification for the first sample software using the feature sequence, the weight adjustment step sequence is calculated according to the optimal weight sequence, the current weight sequence and the global optimal weight sequence of the first sample software to adjust the weights in the current weight sequence, so that the feature sequence using the first sample software is closer to the optimal weight sequence and the global optimal weight sequence. In this way, by continuously iterating to find the weight of each feature in a better feature sequence, a better global optimal weight sequence that can obtain the accuracy characterization value of malware classification for the first sample software can be selected, thereby making the initial feature dimension selected from the global optimal weight sequence more suitable for malware classification, thereby improving the accuracy of malware classification.

[0156] In one embodiment of the present application, see Figure 2b A flow chart of another target feature dimension determination method is provided, wherein the target feature dimension determination method includes the following steps S201, S2021-S2023, S2031-S2033 and S205.

[0157] Step S201: Obtain a feature sequence of each first sample software.

[0158] Step S2021: For each first sample software, based on a current weight sequence formed by weights of each feature in the feature sequence of the first sample software, obtain an accuracy characterization value for malware classification of the first sample software using the feature sequence of the first sample software.

[0159] Step S2022: Determine whether the obtained accuracy characterization value is greater than the optimal accuracy characterization value of the first sample software.

[0160] If the answer is yes, then step S2023 is executed. If the answer is no, then step S2031 is executed, in which case it is indicated that the optimal accuracy characterization value obtained in the previous iteration is already the optimal accuracy characterization value of the final first sample software.

[0161] Step S2023: updating the optimal accuracy characterization value of the first sample software to the obtained accuracy characterization value, and updating the optimal weight sequence of the first sample software to the current weight sequence of the first sample software.

[0162] This situation indicates that the currently obtained accuracy characterization value may still not be the optimal accuracy characterization value of the final first sample software. Therefore, after step S2023, the process returns to step S2021 to obtain the accuracy characterization value again.

[0163] Step S2031: Determine whether the maximum value among the optimal accuracy characterization values ​​of the first sample software is greater than the global optimal accuracy characterization value.

[0164] If the answer is yes, then step S2032 is executed. If the answer is no, then step S2033 is executed, in which case it is indicated that the global optimal accuracy characterization value obtained in the previous iteration is already the global optimal accuracy characterization value of the final first sample software.

[0165] Step S2032: Update the global optimal accuracy characterization value to the maximum value, and update the global optimal weight sequence to the optimal weight sequence of the first sample software corresponding to the maximum value, calculate the weight adjustment step sequence of each first sample software based on the optimal weight sequence of each first sample software, the current weight sequence and the global optimal weight sequence, and adjust the weights in the current weight sequence of each first sample software based on the obtained weight adjustment step sequence.

[0166] In this case, it means that the currently obtained global optimal accuracy characterization value may still not be the final global optimal accuracy characterization value of the first sample software. Therefore, if the iteration end condition is not met, it is still possible to return to step S2021 to re-obtain the accuracy characterization value, and then determine a new global optimal accuracy characterization value.

[0167] Step S2033: Determine whether the iteration end condition is met.

[0168] If the judgment is yes, then step S205 is executed. If the judgment is no, then the process returns to step S2021 to re-obtain the accuracy characterization value of each first sample software.

[0169] Step S205: Select a first number of weights from the global optimal weight sequence in descending order of weights, and determine the initial feature dimensions of the features corresponding to the selected weights as the target feature dimensions.

[0170] In one embodiment of the present application, the method of calculating the distance between the error vector and the reconstruction error distribution of the known software in step S104 can be implemented according to the following steps: calculating the distance between the error vector and the reconstruction error distribution of the known software based on the error vector and the mean vector. Wherein, the reconstruction error distribution is: a distribution of reconstruction errors between target features and reconstruction features of target features in each target feature dimension of the known software. For example, the reconstruction error distribution can be represented by a mean vector, especially when the distance between the error vector and the reconstruction error distribution of the known software is calculated by the Mahalanobis distance, the reconstruction error distribution can be represented by the mean vector.

[0171] The error vector and the mean vector are explained below.

[0172] 1. Error Vector

[0173] The error vector is a vector formed by the obtained reconstruction errors. If the number of target feature dimensions of the i-th target software is n, then the error vector of the i-th target software may include the reconstruction errors between the n target features of the i-th target software and the reconstructed features of the corresponding target features. For example, the reconstruction error corresponding to the m-th target feature of the i-th target software is For example, the error vector of the i-th target software can be expressed as: .

[0174] 2. Mean Vector

[0175] The mean vector is: the average vector of the sample error vectors of each second sample software, the sample error vector is: the vector formed by the error between the first sample feature and the reconstructed feature of the first sample feature, the first sample feature is: the feature of the second sample software in each target feature dimension, and the second sample software is a known software.

[0176] Specifically, for each second sample software, the sample error vector of each second sample software can be obtained in the same way as obtaining the reconstruction error between each target feature and the reconstructed feature of each target feature, and then the average vector of the sample error vectors of each second sample software is calculated to obtain the mean vector.

[0177] Specifically, the vector distance calculation methods may include: Euclidean distance, Manhattan distance, Chebyshev distance, Minkowski distance, standardized Euclidean distance, Mahalanobis distance, cosine distance, etc.

[0178] For example, taking the Mahalanobis distance as an example, the detection platform can calculate the distance according to the following expression:

[0179] ;

[0180] in, is the error vector corresponding to the i-th target sample, is the mean vector, is the inverse of the covariance matrix.

[0181] In this way, the distance between the error vector mean corresponding to the known software samples and the error vector of the target software can more accurately determine whether the target software belongs to the known software, thereby improving the accuracy of malware detection.

[0182] In one embodiment of the present application, when the average vector of the sample error vectors of each second sample software is calculated, the distance threshold can be determined in the following manner: the Mahalanobis distance between the sample error vectors of each second sample software and the average value vector is calculated; the distance distribution information of the calculated Mahalanobis distance is obtained; and the distance value of the distance distribution information at a preset quantile is determined as the distance threshold.

[0183] Specifically, for each sample error vector of the second sample software, the Mahalanobis distance between the sample error vector and the average value vector is calculated, and then the distance distribution information of the Mahalanobis distance corresponding to each second sample software is selected, and the distance value at the preset quantile from the closest distance to the farthest distance in the distance distribution information is determined as the distance threshold. For example, the preset quantile may be 0.99, so that, in the order of the closest distance to the farthest distance, the first 99% of the distances in the Mahalanobis distances corresponding to each second sample software can be selected to be within the distance threshold.

[0184] In this way, by determining the distance threshold using the Mahalanobis distance between the sample error vector and the average value vector of a known software sample, a more appropriate distance threshold can be obtained, and then based on the more appropriate distance threshold, it is possible to more accurately determine whether the target software belongs to known software, thereby improving the accuracy of malware detection.

[0185] In one embodiment of the present application, a pre-trained malware detection model may be used to perform malware detection. The above step S102 may be implemented according to the following steps A, and the above step S105 may be implemented according to the following steps B:

[0186] Step A: For each target feature dimension, the target feature under the target feature dimension is input into the encoder in the codec group corresponding to the target feature dimension in the pre-trained malware detection model for encoding, and the encoded feature of the target feature output by the encoder is input into the decoder in the codec group corresponding to the target feature dimension for feature reconstruction, so as to obtain the reconstructed feature of the target feature output by the decoder.

[0187] The malware detection model includes a first number of codec groups and classification layers, each codec group corresponds to a target feature dimension, each codec group includes an encoder and a decoder, and the first number is equal to the number of target feature dimensions. For example, the first number can be the same as the number of target feature dimensions, such as the first number can be n, see Figure 3 A schematic diagram of the structure of a malware detection model provided. Figure 3 In the embodiment, each codec group corresponds to a target feature dimension. For example, the target feature under the first target feature dimension is input into the first codec group, the target feature under the second target feature dimension is input into the second codec group, ..., the target feature under the nth target feature dimension is input into the nth codec group.

[0188] Step B: If the distance is less than or equal to the distance threshold, the error vector is input into the classification layer to classify the target software as malware.

[0189] Among them, the classification layer may include: a nonlinear transformation layer and a Softmax (a normalized exponential function) layer.

[0190] From the above, it can be seen that using each independent codec group in the malware detection model to reconstruct the corresponding target features can improve the accuracy of feature reconstruction and the accuracy of the obtained error vector. Further, using a more accurate error vector can more accurately classify malware and improve the accuracy of malware classification.

[0191] In one embodiment of the present application, see Figure 4 A flowchart of a malware detection model training method is provided, wherein the method comprises the following steps S401-S407.

[0192] Step S401: based on the decompiled data of the third sample software, obtain the second sample features of the third sample software in each target feature dimension.

[0193] The third sample software includes known software. The third sample software may also include known malware and known non-malware.

[0194] The implementation of step S401 is similar to that of step S101, and the only difference is the name, which will not be described in detail here.

[0195] Step S402: For each target feature dimension, the second sample feature under the target feature dimension is input into the encoder in the codec group corresponding to the target feature dimension in the malware detection model for encoding, and the encoded feature of the second sample feature output by the encoder is input into the decoder in the codec corresponding to the target feature dimension for feature reconstruction to obtain the reconstructed feature of the second sample feature output by the decoder, wherein the malware detection model includes a first number of codec groups and classification layers, each codec group corresponds to a target feature dimension, and the first number is equal to the number of target feature dimensions.

[0196] The implementation of step S402 is similar to that of step A, the only difference being the name, which will not be described in detail here.

[0197] Step S403: obtaining a sample reconstruction error between each second sample feature and a reconstructed feature of each second sample feature.

[0198] Step S404: Calculate the distance between the sample error vector and the reconstruction error distribution of the known software, wherein the sample error vector is a vector formed by the obtained reconstruction errors of each sample.

[0199] The implementation of step S403 is similar to that of step S103, and the implementation of step S404 is similar to that of step S104. The only difference is the name, which will not be described in detail here.

[0200] Step S405: If the distance is less than or equal to the distance threshold, the sample error vector is input into the classification layer to classify the third sample software as malware, and the classification result is output.

[0201] Among them, known software categories include malware and non-malware.

[0202] The implementation of step S405 is similar to that of step B, the only difference being the name, which will not be described in detail here.

[0203] Step S406: If the distance is greater than the distance threshold, it is determined that the classification result indicates that the third sample software is abnormal software.

[0204] The implementation of step S406 is similar to that of step S106, and the only difference is the name, which will not be described in detail here.

[0205] Step S407: Based on the sample error vector, the classification result and the malware classification label of the third sample software, a training loss value is obtained; based on the training loss value, a model parameter of the malware detection model is adjusted.

[0206] Specifically, the training loss value may be obtained based on a preset loss calculation method. For example, the sample error vector may be calculated using cross entropy loss, Hinge loss, or KL divergence.

[0207] In this way, by training the malware detection model, a more accurate malware detection model can be obtained, and the malware detection model can be used to perform malware detection more efficiently and accurately.

[0208] In the technical solution of this application, the operations involved in obtaining, storing, using, processing, transmitting, providing and disclosing user personal information are all carried out with the user's authorization.

[0209] Corresponding to the above-mentioned intelligent multi-dimensional evolution collaborative analysis method of malicious attack features, an embodiment of the present application provides an intelligent multi-dimensional evolution collaborative analysis device of malicious attack features.

[0210] In one embodiment of the present application, see Figure 5 A schematic diagram of the structure of an intelligent multi-dimensional evolution collaborative analysis device for malicious attack features is provided, the device comprising:

[0211] A target feature acquisition module 501 is used to obtain target features of the target software in each target feature dimension based on the decompiled data of the target software;

[0212] The feature reconstruction module 502 is used to encode each target feature to obtain the encoded feature of each target feature, and to reconstruct the features based on the encoded feature of each target feature to obtain the reconstructed feature of each target feature;

[0213] A first reconstruction error obtaining module 503 is used to obtain a reconstruction error between each target feature and a reconstructed feature of each target feature;

[0214] A first distance calculation module 504 is used to calculate the distance between the error vector and the reconstruction error distribution of the known software, wherein the error vector is a vector formed by each reconstruction error obtained;

[0215] A first malware classification module 505, configured to determine, when the distance is less than or equal to a distance threshold, a known software classification to which the target software belongs based on the error vector, wherein the known software classification includes: a classification of known malware and a classification of known non-malware;

[0216] The first abnormal software determining module 506 is configured to determine that the target software is abnormal software when the distance is greater than the distance threshold.

[0217] As can be seen from the above, the intelligent multi-dimensional evolution collaborative analysis method of malicious attack features provided in the embodiment of the present application is applied, by obtaining the target features of the decompiled data of the target software in each target feature dimension, then encoding the target features, and reconstructing the obtained encoded features, extracting the reconstructed features to represent the deep features of the software, and then calculating the reconstruction error between the reconstructed features and the target features. In this way, the multi-dimensional features combined with the target software are multi-dimensionally evolved to obtain the error vector formed by the reconstruction error, and the distance between the error vector of the features combined with the multiple feature dimensions and the reconstruction error of the known software is calculated to achieve collaborative analysis of the above-mentioned multi-dimensional features. In this way, the distance obtained by the collaborative analysis can more accurately represent the distance between the target software and the malicious attack features of the known software of each classification. In the case where the target software belongs to malware, it can be determined that the distance between the malicious attack features of the target software and the malicious attack features of the known software is less than the distance threshold. Then, according to the malicious attack feature analysis of the target software, it can be obtained that the target software belongs to malware in the known software classification. Similarly, based on the above distance, it is possible to more accurately analyze whether the target software is malware, or analyze whether the target software is abnormal software. In the case where the target software belongs to an abnormal software of an unknown software category, the target software can also be regarded as malware to achieve malware identification.

[0218] In one embodiment of the present application, the target feature dimension is determined in the following manner: a feature sequence of each first sample software is obtained, wherein the feature sequence includes: features of the first sample software in each initial feature dimension, and the first sample software is a known software; for each first sample software, based on a current weight sequence formed by weights of each feature in the feature sequence of the first sample software, an accuracy characterization value for malware classification of the first sample software using the feature sequence of the first sample software is obtained; if the obtained accuracy characterization value is greater than the optimal accuracy characterization value of the first sample software, the optimal accuracy characterization value of the first sample software is updated to the obtained accuracy characterization value, and the optimal weight sequence of the first sample software is updated to the current weight sequence of the first sample software, wherein the weight characterization feature of the feature is the accuracy characterization value of the first sample software. The importance of malware classification; if the maximum value of the optimal accuracy characterization value of each first sample software is greater than the global optimal accuracy characterization value, then the global optimal accuracy characterization value is updated to the maximum value, and the global optimal weight sequence is updated to the optimal weight sequence of the first sample software corresponding to the maximum value; based on the optimal weight sequence of each first sample software, the current weight sequence and the global optimal weight sequence, the weight adjustment step sequence of each first sample software is calculated, and the weight in the current weight sequence of each first sample software is adjusted based on the obtained weight adjustment step sequence, and the accuracy characterization value is regained for each first sample software until the iteration end condition is met; in order of weight from large to small, a first number of weights are selected from the global optimal weight sequence, and the initial feature dimension of the feature corresponding to the selected weight is determined as the target feature dimension.

[0219] From the above, it can be seen that by adjusting the weight of each feature in the feature sequence, and then obtaining the accuracy characterization value of malware classification for the first sample software using the feature sequence, the weight adjustment step sequence is calculated according to the optimal weight sequence, the current weight sequence and the global optimal weight sequence of the first sample software to adjust the weights in the current weight sequence, so that the feature sequence using the first sample software is closer to the optimal weight sequence and the global optimal weight sequence. In this way, by continuously iterating to find the weight of each feature in a better feature sequence, a better global optimal weight sequence that can obtain the accuracy characterization value of malware classification for the first sample software can be selected, thereby making the initial feature dimension selected from the global optimal weight sequence more suitable for malware classification, thereby improving the accuracy of malware classification.

[0220] In one embodiment of the present application, the weight adjustment step length sequence of each first sample software is calculated based on the optimal weight sequence, current weight sequence and global optimal weight sequence of each first sample software, including: for each first sample software, the weight adjustment step length sequence is calculated in the following manner: based on a preset inertia weight coefficient, a first adjustment step length of each weight in the current weight sequence of the first sample software is obtained; based on each weight in the optimal weight sequence of the first sample software, a second adjustment step length of each weight in the current weight sequence of the first sample software is obtained; based on each weight in the global optimal weight sequence, a third adjustment step length of each weight in the current weight sequence of the first sample software is obtained; according to the first adjustment step length, the second adjustment step length and the third adjustment step length, the adjustment step length of each weight in the current weight sequence of the first sample software is calculated to obtain a weight adjustment step length sequence including the obtained adjustment step lengths;

[0221] In this way, the adjustment step of each weight in the current weight sequence of the first sample software can be calculated more accurately to obtain a weight adjustment step sequence. Based on the above weight adjustment step sequence, a better global optimal weight sequence that can characterize the accuracy of the first sample software for malware classification can be obtained, thereby making the initial feature dimension selected from the global optimal weight sequence more suitable for malware classification, thereby improving the accuracy of malware classification.

[0222] In one embodiment of the present application, the current weight sequence formed based on the weights of each feature in the feature sequence of the first sample software is used to obtain the accuracy characterization value of classifying the first sample software as malware using the feature sequence of the first sample software, including: using various preset malware classification methods respectively, based on the current weight sequence formed based on the weights of each feature in the feature sequence of the first sample software and the feature sequence of the first sample software, classifying the first sample software as malware to obtain the classification accuracy characterization value corresponding to each malware classification method; and determining the maximum characterization value among the obtained classification accuracy characterization values ​​as the accuracy characterization value of classifying the first sample software as malware using the feature sequence of the first sample software.

[0223] In this way, the first sample software is classified as malware by using a variety of malware classification methods, and the maximum characterization value among the obtained classification accuracy characterization values ​​is used as the accuracy characterization value. This can improve the accuracy of the obtained accuracy characterization value and improve the accuracy of malware classification using the selected target feature dimension.

[0224] In one embodiment of the present application, the initial feature dimension includes at least one of the following dimensions: a feature dimension describing the operation triggered by the software, a feature dimension describing the interface call triggered by the software, a feature dimension describing the software control flow, a feature dimension describing the software attributes, and a feature dimension describing the software organizational structure.

[0225] In this way, the features of different initial feature dimensions are used as the feature sequence of the first sample software, and the influence of features on the accuracy of malware classification is analyzed from different dimensions to select the feature dimensions used for malware classification. This can improve the accuracy of malware classification using features of the target feature dimensions.

[0226] In one embodiment of the present application, the first distance calculation module is specifically used to calculate the distance between the error vector and the reconstructed error distribution of the known software based on the error vector and the mean vector, wherein the mean vector is: the average vector of the sample error vectors of each second sample software, the sample error vector is: the vector formed by the error between the first sample feature and the reconstructed feature of the first sample feature, the first sample feature is: the feature of the second sample software in each target feature dimension, and the second sample software is the known software.

[0227] In this way, the distance between the error vector mean corresponding to the known software samples and the error vector of the target software can more accurately determine whether the target software belongs to the known software, thereby improving the accuracy of malware detection.

[0228] In one embodiment of the present application, the distance threshold is determined in the following manner: calculating the Mahalanobis distance between the sample error vector of each second sample software and the average value vector; obtaining distance distribution information of the calculated Mahalanobis distance; determining the distance value of the distance distribution information at a preset quantile as the distance threshold.

[0229] In this way, by determining the distance threshold using the Mahalanobis distance between the sample error vector and the average value vector of a known software sample, a more appropriate distance threshold can be obtained, and then based on the more appropriate distance threshold, it is possible to more accurately determine whether the target software belongs to known software, thereby improving the accuracy of malware detection.

[0230] In one embodiment of the present application, the feature reconstruction module is specifically used to, for each target feature dimension, input the target feature under the target feature dimension into the encoder in the codec group corresponding to the target feature dimension in the pre-trained malware detection model for encoding, and input the encoded features of the target features output by the encoder into the decoder in the codec corresponding to the target feature dimension for feature reconstruction, so as to obtain the reconstructed features of the target features output by the decoder, wherein the malware detection model includes a first number of codec groups and classification layers, each codec group corresponds to a target feature dimension, and the first number is equal to the number of target feature dimensions; the first malware classification module is specifically used to, when the distance is less than or equal to the distance threshold, input the error vector into the classification layer to classify the target software as malware.

[0231] From the above, it can be seen that using each independent codec group in the malware detection model to reconstruct the corresponding target features can improve the accuracy of feature reconstruction and the accuracy of the obtained error vector. Further, using a more accurate error vector can more accurately classify malware and improve the accuracy of malware classification.

[0232] In one embodiment of the present application, see Figure 6 A schematic diagram of the structure of a malware detection model training device is provided, the device comprising:

[0233] The second sample feature obtaining module 601 is used to obtain the second sample features of the third sample software in each target feature dimension based on the decompiled data of the third sample software, wherein the third sample software includes known software;

[0234] The reconstructed feature acquisition module 602 is used to input, for each target feature dimension, the second sample feature under the target feature dimension into the encoder in the codec group corresponding to the target feature dimension in the malware detection model for encoding, and input the encoded feature of the second sample feature output by the encoder into the decoder in the codec corresponding to the target feature dimension for feature reconstruction, so as to obtain the reconstructed feature of the second sample feature output by the decoder, wherein the malware detection model includes a first number of codec groups and classification layers, each codec group corresponds to a target feature dimension, and the first number is equal to the number of target feature dimensions;

[0235] A second reconstruction error obtaining module 603 is used to obtain a sample reconstruction error between each second sample feature and a reconstructed feature of each second sample feature;

[0236] A second distance calculation module 604 is used to calculate the distance between the sample error vector and the reconstruction error distribution of the known software, wherein the sample error vector is a vector formed by the obtained reconstruction errors of each sample;

[0237] A second malware classification module 605 is configured to input the sample error vector into the classification layer to classify the third sample software into malware when the distance is less than or equal to the distance threshold, and output a classification result, wherein the known software classification includes: classification of known malware and classification of known non-malware;

[0238] A second abnormal software determination module 606 is used to determine that, when the distance is greater than the distance threshold, the classification result indicates that the third sample software is abnormal software;

[0239] A training loss value obtaining module 607, configured to obtain a training loss value based on the sample error vector, the classification result and the malware classification label of the third sample software;

[0240] The model parameter adjustment module 608 is used to adjust the model parameters of the malware detection model based on the training loss value.

[0241] In this way, by training the malware detection model, a more accurate malware detection model can be obtained, and the malware detection model can be used to perform malware detection more efficiently and accurately.

[0242] The present application also provides an electronic device, such as Figure 7 As shown, including:

[0243] Memory 701, used for storing computer programs;

[0244] The processor 702 is used to implement any of the above-mentioned intelligent multi-dimensional evolutionary collaborative analysis methods of malicious attack features when executing the program stored in the memory 701.

[0245] Furthermore, the electronic device may further include a communication bus and / or a communication interface, and the processor 702, the communication interface, and the memory 701 communicate with each other via the communication bus.

[0246] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0247] The communication interface is used for communication between the above electronic device and other devices.

[0248] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0249] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0250] In another embodiment provided in the present application, a computer-readable storage medium is also provided, which stores a computer program. When the computer program is executed by a processor, the steps of the intelligent multi-dimensional evolutionary collaborative analysis method of any of the above-mentioned malicious attack characteristics are implemented.

[0251] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the intelligent multi-dimensional evolution collaborative analysis method of any malicious attack feature in the above-mentioned embodiments.

[0252] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a solid-state hard disk (SSD), etc.

[0253] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0254] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, electronic device, storage medium, and computer program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0255] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. An intelligent multi-dimensional evolutionary collaborative analysis method for malicious attack features, characterized in that: The method comprises: Based on the decompiled data of the target software, obtaining target features of the target software in each target feature dimension; Encode each target feature respectively to obtain the encoded feature of each target feature, and reconstruct features based on the encoded feature of each target feature to obtain the reconstructed feature of each target feature; Obtaining a reconstruction error between each target feature and a reconstructed feature of each target feature; Calculating the distance between the error vector and the reconstructed error distribution of the known software, wherein the error vector is a vector formed by each obtained reconstructed error, and the distance represents the distance between the target software and the malicious attack features of each classified known software; If the distance is less than or equal to a distance threshold, the known software category to which the target software belongs is determined based on the error vector; if the distance is greater than the distance threshold, the target software is determined to be abnormal software, wherein the known software category includes: a category of known malware and a category of known non-malware.

2. The method according to claim 1, characterized in that The target feature dimension is determined in the following manner: Obtaining a feature sequence of each first sample software, wherein the feature sequence includes: features of the first sample software in each initial feature dimension, the first sample software being a known software; For each first sample software, based on the current weight sequence formed by the weight of each feature in the feature sequence of the first sample software, obtain an accuracy characterization value for classifying the first sample software as malware using the feature sequence of the first sample software; if the obtained accuracy characterization value is greater than the optimal accuracy characterization value of the first sample software, update the optimal accuracy characterization value of the first sample software to the obtained accuracy characterization value, and update the optimal weight sequence of the first sample software to the current weight sequence of the first sample software, wherein the weight characterization of the feature represents the importance of the feature to classifying the first sample software as malware; If the maximum value among the optimal accuracy characterization values ​​of the first sample software is greater than the global optimal accuracy characterization value, then the global optimal accuracy characterization value is updated to the maximum value, and the global optimal weight sequence is updated to the optimal weight sequence of the first sample software corresponding to the maximum value; Based on the optimal weight sequence, current weight sequence and global optimal weight sequence of each first sample software, calculate the weight adjustment step sequence of each first sample software, adjust the weight in the current weight sequence of each first sample software based on the obtained weight adjustment step sequence, and re-obtain the accuracy characterization value for each first sample software until the iteration end condition is met; In descending order of weights, a first number of weights are selected from the global optimal weight sequence, and initial feature dimensions of features corresponding to the selected weights are determined as target feature dimensions.

3. The method according to claim 2, characterized in that The step of calculating the weight adjustment step length sequence of each first sample software based on the optimal weight sequence of each first sample software, the current weight sequence and the global optimal weight sequence includes: For each first sample software, the weight adjustment step sequence is calculated in the following manner: Based on a preset inertia weight coefficient, obtaining a first adjustment step length of each weight in a current weight sequence of the first sample software; Based on each weight in the optimal weight sequence of the first sample software, obtaining a second adjustment step length for each weight in the current weight sequence of the first sample software; Based on each weight in the global optimal weight sequence, obtaining a third adjustment step length of each weight in the current weight sequence of the first sample software; The adjustment step of each weight in the current weight sequence of the first sample software is calculated according to the first adjustment step, the second adjustment step and the third adjustment step, to obtain a weight adjustment step sequence including the obtained adjustment step.

4. The method according to claim 2, characterized in that: The step of obtaining the accuracy characterization value of malware classification of the first sample software using the feature sequence of the first sample software based on the current weight sequence formed by the weights of the features in the feature sequence of the first sample software comprises: Using various preset malware classification methods respectively, based on the current weight sequence formed by the weights of each feature in the feature sequence of the first sample software and the feature sequence of the first sample software, the first sample software is classified as malware, and the classification accuracy characterization value corresponding to each malware classification method is obtained; the maximum characterization value among the obtained classification accuracy characterization values ​​is determined as the accuracy characterization value of malware classification of the first sample software using the feature sequence of the first sample software; and / or The initial feature dimension includes at least one of the following dimensions: a feature dimension describing the operation triggered by the software, a feature dimension describing the interface call triggered by the software, a feature dimension describing the software control flow, a feature dimension describing the software attribute, and a feature dimension describing the software organizational structure.

5. The method according to any one of claims 1 to 4, characterized in that The calculating the distance between the error vector and the reconstruction error distribution of the known software includes: The distance between the error vector and the reconstructed error distribution of the known software is calculated based on the error vector and the mean vector, wherein the mean vector is: the average vector of the sample error vectors of each second sample software, the sample error vector is: the vector formed by the error between the first sample feature and the reconstructed feature of the first sample feature, the first sample feature is: the feature of the second sample software in each target feature dimension, and the second sample software is the known software.

6. The method according to claim 5, characterized in that The distance threshold is determined in the following manner: Calculating the Mahalanobis distance between the sample error vector of each second sample software and the mean vector; Obtaining distance distribution information of the calculated Mahalanobis distance; A distance value of the distance distribution information at a preset quantile is determined as the distance threshold.

7. The method according to any one of claims 1 to 4, characterized in that The encoding of each target feature to obtain the encoding feature of each target feature, and feature reconstruction based on the encoding feature of each target feature to obtain the reconstructed feature of each target feature, include: For each target feature dimension, input the target feature under the target feature dimension into the encoder in the codec group corresponding to the target feature dimension in the pre-trained malware detection model for encoding, input the encoded feature of the target feature output by the encoder into the decoder in the codec group corresponding to the target feature dimension for feature reconstruction, and obtain the reconstructed feature of the target feature output by the decoder, wherein the malware detection model includes a first number of codec groups and classification layers, each codec group corresponds to a target feature dimension, and the first number is equal to the number of target feature dimensions; If the distance is less than or equal to a distance threshold, determining the malware category to which the target software belongs based on the error vector includes: If the distance is less than or equal to a distance threshold, the error vector is input into the classification layer to classify the target software as malware.

8. A malware detection model training method, characterized in that: The method comprises: Based on the decompiled data of the third sample software, obtaining the second sample features of the third sample software in each target feature dimension, wherein the third sample software includes known software; For each target feature dimension, input the second sample feature under the target feature dimension into the encoder in the codec group corresponding to the target feature dimension in the malware detection model for encoding, input the encoded feature of the second sample feature output by the encoder into the decoder in the codec group corresponding to the target feature dimension for feature reconstruction, and obtain the reconstructed feature of the second sample feature output by the decoder, wherein the malware detection model includes a first number of codec groups and classification layers, each codec group corresponds to a target feature dimension, and the first number is equal to the number of target feature dimensions; Obtaining a sample reconstruction error between each second sample feature and a reconstructed feature of each second sample feature; Calculating the distance between the sample error vector and the reconstructed error distribution of the known software, wherein the sample error vector is a vector formed by the obtained reconstruction errors of each sample, and the distance represents the distance between the malicious attack features of the third sample software and the known software of each classification; If the distance is less than or equal to the distance threshold, input the sample error vector into the classification layer to classify the third sample software into malware, determine the known software classification to which the third sample software belongs, and output the classification result, wherein the known software classification includes: classification of known malware and classification of known non-malware; If the distance is greater than the distance threshold, determining that the classification result indicates that the third sample software is abnormal software; Obtaining a training loss value based on the sample error vector, the classification result, and the malware classification label of the third sample software; Based on the training loss value, model parameters of the malware detection model are adjusted.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, for implementing the method described in any one of claims 1 to 7 or 8 when executing a program stored in a memory.

10. A computer program product comprising instructions, characterized in that When the computer program product is run on a computer, the computer is enabled to execute the method according to any one of claims 1 to 7 or 8.

Images