Malware family classification method based on static multi-feature optimization and fusion

Abstract

The present invention discloses a malware family classification method based on static multi-feature optimization and fusion, comprising: extracting malware image features based on EfficientNet-B3; extracting static API sequences using IDA Pro and Radare2, respectively, and fusing the results of the two extractions to obtain a fused static API sequence; extracting static statistical features of the malware; optimizing the fused static API sequence based on the BERT-Tiny embedding mechanism; calculating the mutual information value of the features using a discrete target variable mutual information algorithm based on the features extracted and optimized, and screening the optimal fused feature sequence combination based on the mutual information value of the features; and inputting the optimal fused feature sequence combination into a classification model to complete malware family classification. The present invention solves problems such as single feature type, excessive redundant information, and low classification efficiency.

Description

Technical Field

[0001] The present invention relates to the field of malware defense technology, and in particular to a malware family classification method based on static multi-feature optimization and fusion. Background Art

[0002] The first phase of malware defense involves preliminary screening of massive samples from real networks. Suspicious samples require further analysis, which is the second phase of malware defense. The volume of data at this stage is substantial, requiring efficient processing. Malware family classification is the mainstream research direction at this stage.

[0003] Research on malware family classification has important theoretical and practical implications for malware defense. For malware detection, family classification helps reveal family characteristics, making it possible to identify unknown family variants. On the other hand, simple detection and prevention remain passive. To better curb the development of malware at its source, research institutions and security companies are conducting analysis and research on malware tracing, with malware family classification providing a crucial technical support for this tracing.

[0004] After the first phase of testing, the suspicious samples identified generally fall into the following three categories:

[0005] The first category is sample files that can be directly subjected to static reverse analysis. This is the most ideal situation. Such malware samples are usually ordinary viruses, Trojans, worms, etc. They may be samples that have not been subjected to operations such as obfuscation, encryption, and packing, or they may be protected by common packing, encryption, and other technologies. However, tools can be used to implement operations such as unpacking and decryption, and their complete assembly code and functions can be obtained through static reverse analysis. For such samples, static analysis can obtain various types of features such as the structure, semantics, and statistics of the program. This has always been one of the most popular and effective analysis methods in malware analysis. Therefore, for such files, studying the intelligent malware family classification method based on static analysis features has important theoretical value and practical significance. The research work of the present invention is carried out for the family classification of such samples, especially focusing on feature optimization and fusion screening in the family classification process.

[0006] Family variants are new malware that evolve from known malware through functional or anti-detection techniques. Existing efforts to trace the family origins of malware variants typically extract feature information or portions of the original code and analyze their similarities with known family samples to identify the family origins of suspicious samples. In recent years, research using machine learning to achieve intelligent classification has increased. Feature extraction in these efforts can be broadly divided into two categories. One, similar to traditional detection, leverages prior knowledge of malware, extracting features such as readable strings, file structures, and function call graphs through static or dynamic analysis. Reference [Kinable, J., & Kostakis, O. (2011). Malware classification based on call graph clustering [J]. Journal in Computer Virology, 7, 233-245.] extracts system call graphs from malware samples and applies graph matching to analyze malware similarities, thereby identifying family ancestry. Another type of research, without relying on prior knowledge of malware, directly utilizes machine learning methods to achieve family classification. The method of converting malware directly into grayscale images, proposed in the paper [Nataraj, L., Karthikeyan, S., Jacob, G., & Manjunath, BS (2011). Malware images: visualization and automatic classification [C]. Visualization for Computer Security.], opened up a new research direction in academia. Subsequent studies have continued this idea of ​​converting code into grayscale images, building on it with various improvements. Some studies segment grayscale images and use gray-level cooccurrence matrix (GLCM) features, while others introduce the concept of information entropy and propose the concept of entropy maps, classifying malware by comparing the entropy values ​​of images.

[0007] These works have achieved certain results and contributed to the research on malware family classification, but some issues still need improvement: First, most existing work still uses a single feature or a single type of feature. This means that these features can only cover a portion of the malware's characteristic information and cannot fully and comprehensively represent the information carried by the original sample. In other words, there is a certain amount of information loss, which affects the final classification results. Second, some research works have begun to explore the combination of multiple features, but most of them are implemented in a simple splicing manner without optimizing and selecting features. This can easily lead to excessive feature dimensions, resulting in increased training time. Excessive feature redundancy can also disperse the influence of effective features on the classification results, making it difficult to focus on the truly effective features. Summary of the Invention

[0008] To address the above problems, the present invention proposes a malware family classification method based on static multi-feature optimization and fusion. The research focuses on three aspects: feature extraction, feature optimization and feature fusion, and focuses on solving problems such as single feature type, excessive redundant information and low classification efficiency. It includes static multi-type feature extraction of malware, feature optimization based on deep learning models and feature fusion based on mutual information of discrete target variables.

[0009] In order to achieve the above object, the present invention adopts the following technical solutions:

[0010] A malware family classification method based on static multi-feature optimization and fusion, including:

[0011] Step 1: Extract malware image features based on the deep neural network EfficientNet-B3; Use the disassemblers IDAPro and Radare2 to extract static API sequences respectively, and fuse the extraction results of the two to obtain a fused static API sequence; Extract malware static statistical features, including statistical features of assembly program files, statistical features of binary byte files, and file byte sequence features;

[0012] Step 2: Feature optimization of the fused static API sequence based on the lightweight natural language processing model BERT-Tiny embedding mechanism;

[0013] Step 3: Based on the code image features extracted in step 1, the static statistical features of the malware, and the static API sequence features optimized in step 2, a discrete target variable mutual information algorithm is used to calculate the mutual information value of the features, and the optimal fusion feature sequence combination is selected based on the mutual information value of the features;

[0014] Step 4: Input the optimal fusion feature sequence combination into the classification model to complete the malware family classification.

[0015] Furthermore, the code image feature extraction based on the deep neural network EfficientNet-B3 includes:

[0016] Each 8 bits of the malware binary file are combined into a vector, which is treated as the grayscale value of a pixel in a grayscale image. A square code image with equal height and width is generated based on an image adaptation mechanism. All generated square images of varying sizes are then normalized to obtain grayscale images of the same size.

[0017] Taking the obtained grayscale image as input, the EfficientNet-B3 model is used to extract malware image features.

[0018] Furthermore, the fused static API sequence is obtained as follows:

[0019] IDAPro is used to recursively traverse and read the assembly file to obtain the static API sequence of the sample. Radare2 is used to extract the control flow information and then obtain the static API sequence of the sample. Two sets of static API sequences of the same file are obtained. The static API sequence extracted based on Radare2 and the static API sequence extracted based on IDAPro are fused in two ways to obtain the fused static API sequence.

[0020] Furthermore, statistical features of the assembly program file are extracted in the following manner:

[0021] Construct a list of features to be matched, including registers, opcodes, keywords, and API call names;

[0022] Each feature in the feature list is counted in each program through string matching, and the feature vector is finally saved.

[0023] Furthermore, statistical features of binary byte files are extracted in the following manner:

[0024] For the binary byte file of the disassembled program, the file size and byte information entropy are extracted as the statistical features of the binary byte file. The total number of bytes contained in the statistical file is used as the file size. The file byte information entropy is calculated as follows:

[0025]

[0026] where p k It is the ratio of bytes with value k to all bytes.

[0027] Furthermore, the file byte sequence features are extracted in the following way:

[0028] For the assembly program file, the .asm file generated by IDAPro disassembly is selected, and the description of the key information of the program PE file and the description bytes of the program code segment initialization in the header of the file are used as the file byte sequence feature vector;

[0029] For a binary byte file, take its first 1000 bytes as the file byte sequence feature vector.

[0030] Furthermore, the step 2 includes:

[0031] First, the WordPiece algorithm is used to convert the static API sequence features into a vocabulary. Then, each static API sequence is represented as ([content vector, position vector], label) and input into the BERT-Tiny model for deep feature extraction. Finally, the output of the fully connected layer of the BERT-Tiny model is extracted and used as the optimized static API sequence feature vector.

[0032] Furthermore, the mutual information value of the feature calculated by using the discrete target variable mutual information algorithm includes:

[0033]

[0034] Where MI(X,Y) is the mutual information value of the discrete target variable between X and Y, X and Y are two discrete random variables, For X i and Y j The joint probability distribution of P(i) and P(j) are x i and Y j The marginal probability of , N is the number of samples.

[0035] Furthermore, the method of screening out the optimal fusion feature sequence combination based on the mutual information value of the features includes:

[0036] The first n features with the highest mutual information values ​​are selected in turn and evaluated using K-fold cross-validation of the machine learning model; the evaluation results are then recorded, and the best feature combination is selected as the final selected fusion feature.

[0037] Furthermore, the classification model includes decision tree, logistic regression and random forest.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] (1) In terms of feature representation, this paper selects three types of features, including statistical features based on static analysis, code image features, and static API sequence features. These three types of features contain multi-level and multi-type information at the instruction level, structure level, and behavior level. The combination of features at different levels and types complements each other, more comprehensively characterizing the program feature information of the original sample, which is more comprehensive than the single feature or single type of feature representation commonly selected in existing work.

[0040] (2) In terms of feature extraction, the deep features extracted by the image feature extraction method based on EfficientNet-B3 proposed in this paper outperform the existing feature extraction methods based on traditional image texture features and other deep learning methods in terms of both visual analysis and quantitative analysis.

[0041] (3) In terms of classification efficiency, the fusion features obtained by the feature optimization and fusion method proposed in this invention have significantly reduced dimensions, lower training costs, and higher classification efficiency compared to the features obtained by directly splicing the extracted shallow features;

[0042] (4) In terms of classification effect, the fusion features extracted, optimized and integrated by the method proposed in the present invention have achieved classification accuracy at a relatively high level compared with existing related work on three different types of simple machine learning classification models. At the same time, compared with the existing mainstream features and the single optimized features proposed in the present invention, the fusion features have improved classification accuracy, precision, recall rate and F1-score. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a flowchart of a malware family classification method based on static multi-feature optimization and fusion according to an embodiment of the present invention;

[0044] Figure 2 Comparison of the accuracy of EfficientNet provided by the embodiment of the present invention and other models;

[0045] Figure 3 Schematic diagram of the scaling of the EfficientNet model provided in an embodiment of the present invention;

[0046] Figure 4 Schematic diagram of the feature extraction model structure based on EfficientNet-B3 provided in an embodiment of the present invention;

[0047] Figure 5 An example of a static API sequence extracted and fused according to an embodiment of the present invention;

[0048] Figure 6 The .asm file format provided in the embodiment of the present invention;

[0049] Figure 7 A list of register and opcode features extracted according to an embodiment of the present invention;

[0050] Figure 8 A list of keyword features (partial) provided for embodiments of the present invention;

[0051] Figure 9 A partial list of API call features provided for embodiments of the present invention;

[0052] Figure 10 .asm file statistical feature vector (part) provided by the embodiment of the present invention;

[0053] Figure 11 A byte file feature vector (partial) provided by an embodiment of the present invention;

[0054] Figure 12 .asm file byte sequence feature vector provided by an embodiment of the present invention;

[0055] Figure 13 The byte sequence feature vector of the .byte file provided in the embodiment of the present invention;

[0056] Figure 14 This is a flow chart of the fusion feature screening algorithm provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments:

[0058] like Figure 1 As shown in the figure, a malware family classification method based on static multi-feature optimization and fusion includes:

[0059] Phase 1: Multi-type static feature extraction. This mainly involves extracting three types of features: The first type is code image feature extraction based on deep neural networks. Here, we propose a code image deep feature extraction method based on EfficientNet-B3. The second type is the extraction of static API sequences. For each sample in the dataset, we use dual disassemblers to extract APIs separately and combine them to obtain a more complete static API call sequence. The third type is statistical feature extraction based on static analysis. We collect basic program information such as commonly used registers, opcodes, keywords, and API calls.

[0060] Phase 2: Feature optimization based on deep learning models. We propose static API sequence feature optimization based on the BERT-Tiny embedding mechanism, learn the implicit feature information of the API sequence, and perform dimensionality reduction.

[0061] The third stage is feature fusion based on the mutual information of discrete target variables. The features extracted and optimized above are integrated, and the feature scores are calculated using the discrete target variable mutual information algorithm. The optimal feature sequence is selected, and then a recursive algorithm is used to filter it again to obtain more refined features, thereby improving classification efficiency and accuracy.

[0062] Phase 4: Input the optimal fusion feature sequence combination into the classification model to complete the malware family classification.

[0063] 1. Malware multi-type static feature extraction

[0064] 1.1 Malware Image Feature Extraction Based on EfficientNet-B3

[0065] EfficientNet is a network series released by Google in 2019. EfficienNet is a series of models obtained by scaling the basic model. The basic model is an efficient network structure obtained through the Neural Architecture Search (NAS) method. EfficienNet stands out for its fast and accurate features. For a comparison of EfficientNet with other models in terms of accuracy and number of model parameters, see Figure 2 , which has obvious advantages.

[0066] The basic model that EfficientNet searches for through NAS is EfficientNet-B0 in the figure above. On this basis, the three characteristics of the above-mentioned convolutional neural network accuracy improvement are comprehensively utilized to scale the model from three perspectives: network depth, width, and input image resolution to achieve higher accuracy. The resulting models are denoted as B1, B2, B3, ..., and the specific content of the scaling is as follows: Figure 3 shown.

[0067] Malware has obvious texture features after being converted into grayscale images. Such features can be used to classify malware. To this end, this paper proposes a malware image feature extraction method based on EfficientNet-B3, which consists of two parts: malware visualization and malware grayscale image feature extraction.

[0068] During malware visualization, each eight bits of the malware binary file are organized into a vector with a value range of 0-255, which is then treated as the grayscale value of a pixel in a grayscale image. A square code image with equal height and width is then generated. All generated square images of varying sizes are then normalized to obtain a 512×512 grayscale image, which better preserves the original texture features of the image.

[0069] Convolutional neural networks have achieved good results in image recognition and other related applications, indicating that they can extract unique features of images through training and learning, and their performance improvement focuses on the three dimensions of network depth, network width, and resolution. Given that EfficientNet can uniformly scale these three dimensions through a set of fixed scaling factors, well balance depth, width, and resolution, give full play to their advantages, and also has the characteristics of being fast and accurate, the present invention uses EfficientNet to automatically extract malware image features. The present invention uses the EfficientNet-B3 model to extract deep malware features. The overall structure of the feature extraction model is as follows: Figure 4 As shown in the figure, with a 512×512 grayscale image as input, EfficientNet-B3 uses a scaling factor of (width, depth, res, dropout) = (1.2, 1.4, 300, 0.3), and obtains a 1536-dimensional feature vector after the average pooling layer. In order to reduce the amount of computation for subsequent classification, the present invention adds Dense and Dense_1 layers after the pooling layer to reduce the extracted features from 1536 dimensions to 512 dimensions, so as to obtain more refined and accurate features and improve the efficiency of subsequent classification.

[0070] 1.2 API sequence feature extraction based on dual-path fusion

[0071] Existing research has proved through concept verification and quantitative analysis that due to the use of different algorithms to identify the structure of binary files, different disassemblers will produce different results, and the use of a single disassembler will result in misjudgment (false positive and false negative), resulting in inaccurate information acquisition. Therefore, in the method of the present invention, two typical commonly used disassemblers IDA Pro and Radare2 with different working principles are selected, and the data set samples are reverse analyzed respectively, and the extraction results of the two are fused to obtain a more accurate API call sequence. Among them, IDA Pro is an industry-standard recursive disassembly tool, and Radare2 provides two disassembly modes, linear and recursive, and supports interactive and scripting. The two disassemblers complement each other in working principle.

[0072] IDA Pro is used to obtain the static API call sequence of the sample by recursively traversing the assembly file. Radare2 is used to extract the control flow information and then obtain the static API call sequence of the sample, obtaining two sets of API call sequences for the same file. Due to the differences between the two disassembly tools, IDA Pro and Radare2, the disassembly results of the two are different for some malware. The API call sequence extracted based on Radare2 and the API call sequence extracted based on IDA Pro are fused in two ways to form a more accurate static API call sequence feature set. Some of the obtained API call sequences are shown in the figure below. Figure 5 shown.

[0073] 1.3 Malware Static Statistical Feature Extraction

[0074] In this part, we mainly extract three types of features, including statistical features of assembly program files, statistical features of binary byte files and file byte sequences.

[0075] Statistical feature extraction of assembly program files. By disassembling the .exe file, we can get the assembly program file (.asm file), which is in the form of Figure 6 .

[0076] The assembly program file contains information such as registers, operation codes, keywords, and APIs used by the program. This paper uses the method of traversing each line of matching strings to count the number of times these contents appear as statistical features. The specific steps are as follows:

[0077] (1) Construct a feature list that needs to be matched, specifically including registers, opcodes, keywords, and API call names. For registers, opcodes, and keywords, the present invention enumerates commonly used content as a feature list; for APIs, the present invention first counts the number of programs that exist for each API in the entire data set, and then takes the top 2,000 APIs with the largest number of programs and adds them to the constructed feature list. The purpose is to avoid the situation where some APIs are only used by a few programs, resulting in a large number of zero values ​​in the feature vector, thereby affecting the classification effect. The constructed feature list is as follows:

[0078] Register features include 26 commonly used registers such as edx, esi, es, and fs. Operation code features include 93 commonly used operation codes such as add, al, bt, call, and cdq. Figure 7 shown.

[0079] Keyword features include 95 common keywords such as Virtual, Offset, loc, Import, etc. The specific content is as follows Figure 8 shown.

[0080] The API call features include GetProcAddress, GetModuleHandleA, GetLastError, LoadLibraryA, etc., a total of 2000 API calls, some of which are shown below. Figure 9 shown.

[0081] (2) Through string matching, each feature in the feature list is counted in each program, and finally the feature vector is saved. The resulting csv file is as follows Figure 10 shown.

[0082] Statistical feature extraction of binary byte files, for the binary byte files (.byte files) obtained by disassembly. For .byte files, two features, file size and byte information entropy, are extracted as their statistical features. Among them, the file size statistics file contains the total number of bytes. Because the value range of bytes is 0-255, each value is a class, and the proportion of bytes with value k to all bytes is p k (k=1,2,3...,256), the calculation method of file byte information entropy is shown in formula (1).

[0083]

[0084] The final feature vector is Figure 11 shown.

[0085] The present invention also extracts byte features for assembly program files and binary byte files. Specifically, for assembly program files, the .asm file generated by IDAPro disassembly is selected, where the header at the beginning of the file contains a description of the key information of the program PE file and a description of the initialization of the program code segment. This part of the bytes is used as a feature vector and saved to obtain the .asm file byte sequence feature vector, such as Figure 12 As shown in the figure, for binary byte files, the first 1000 bytes are directly taken as the feature vector. Since the malware is a PE file, the first 1000 bytes correspond to the PE header information of the malware, so this is directly extracted as a feature. The feature vector obtained is as follows: Figure 13 shown.

[0086] 2 Feature Optimization Based on BERT-Tiny Embedding Mechanism

[0087] When reverse-engineering software, security professionals focus on the sequence of API calls within the code to understand the intended functionality of the software. Extracting static API call sequences simulates and restores this process. Static API call sequences have distinct word order and semantic logic, making them well-suited for feature optimization using natural language processing models.

[0088] In existing work, the use of API call sequence features usually involves selecting their statistical information as the vectorized processing and representation of the features. Such an operation directly loses the word order characteristics and cannot fully reflect the inherent implicit associations contained in it. Therefore, it is necessary to study more effective optimization methods that retain more original information.

[0089] Taking into account the operating efficiency and feature dimension, the present invention chooses the lightweight BERT-Tiny (Bidirectional Encoder Representations from Transformers) embedding mechanism. BERT-Tiny is a lightweight natural language processing model, which is a subset of the BERT model developed by Google. Compared with the BERT model, the BERT-Tiny model has a smaller number of parameters and faster training and inference speeds. The core of the BERT-Tiny model is the Transformer structure, which is composed of multiple encoders and decoders stacked together. In BERT-Tiny, each encoder and decoder contains only 2 layers, and the dimension of the hidden state vector is relatively small, only 128 dimensions. In addition, the BERT-Tiny model uses a simplified version of the Self-Attention mechanism, which reduces the amount of computation and storage space. These characteristics are very consistent with the research requirements of high efficiency and low dimensionality of the feature optimization of the present invention, so it is more suitable for the feature optimization work of the present invention than BERT.

[0090] In terms of operating principles, the BERT-Tiny model is similar to the BERT model, both of which obtain vocabulary and model parameters through pre-training on large-scale text corpora. During the pre-training phase, the model learns dependencies and contextual information between words through the Masked Language Model and Next Sentence Prediction tasks. During the fine-tuning phase, the BERT-Tiny model can also be used in various natural language processing tasks. It has strong transferability. Specifically, the BERT-Tiny embedding mechanism is used to optimize features. When the requirements of subsequent classification tasks change, there is no need to redesign and adjust the optimization scheme. Instead, simple fine-tuning can adapt to other subsequent natural language processing tasks. Therefore, it is very suitable for feature optimization.

[0091] The feature optimization method based on the BERT-Tiny embedding mechanism proposed in the present invention selects the WordPiece algorithm to construct a vocabulary and uses it for fine-tuning learning of the BERT-Tiny model; at the same time, the method of the present invention combines position vectors to retain the word order information of the API call sequence. For each word, a fixed-length content vector and a position vector are obtained, which respectively represent the characteristics of the current word and the position information in the sequence.

[0092] Specifically, the WordPiece algorithm is first used to convert the API call sequence into a vocabulary. Then, each API call sequence is represented as ([content vector, position vector], label) and input into the BERT-Tiny model for deep feature extraction. Finally, the output of the model's dense layer is extracted and represented as a 128-dimensional vector as the optimized feature vector for subsequent classification tasks.

[0093] Compared with other existing sequence feature optimization methods, the feature optimization method based on the BERT-Tiny embedding mechanism proposed in this invention, on the one hand, takes into account the word order relationship within the API call sequence, making the extracted feature vector more accurate and discriminative; on the other hand, the use of a lightweight BERT-Tiny model for feature extraction can improve operational efficiency while ensuring classification performance, and is more suitable for actual application scenarios based on multi-feature methods.

[0094] 3 Feature fusion screening based on mutual information of discrete target variables

[0095] 3.1 Calculation of Mutual Information

[0096] The feature fusion screening method based on the mutual information of discrete target variables proposed in this invention selects the mutual information value of discrete target variables as the basis for evaluating features. The mutual information of discrete target variables is a commonly used metric in information theory, usually used to measure the correlation between two random variables. When one of the random variables is discrete, the mutual information of discrete target variables can be used to describe the degree of correlation between the two variables. Suppose there are two discrete random variables X and Y, and their joint probability distribution is The marginal probabilities are P(X) and P(Y) respectively. Then, the calculation of the mutual information of discrete target variables between X and Y can be expressed as formula (2):

[0097]

[0098] in, For X i and Y j The joint probability distribution of Xi and Y j The marginal probability, X i 、Y j It can be understood as a specific value of the random variables X and Y, where N is the number of samples. The base of log can be any value, typically 2 or the natural logarithm e. The mutual information of discrete target variables reflects the degree of correlation between X and Y, with larger values ​​indicating a stronger correlation. If X and Y are independent, their mutual information is 0; if they are completely correlated, their mutual information is equal to the entropy of one of the random variables. In the present invention, mutual information is used to characterize the degree of dependence between a feature and a label, that is, the degree of correlation with the label. A larger mutual information value indicates that the uncertainty about the sample label after using this feature is reduced. A mutual information of 0 indicates that the label and feature are independent and have no dependency relationship, meaning that this feature does not contribute to the classification. Therefore, in feature selection, the mutual information value of discrete target variables is used to evaluate the correlation between each feature and the target variable, thereby selecting the features with the highest discriminative power and filtering out features with limited or no contribution. This screening not only provides higher-quality features, helping to improve subsequent classification results, but also achieves interpretable dimensionality reduction for the features, which also helps improve subsequent classification efficiency.

[0099] 3.2 Screening of fusion features

[0100] Feature selection is an important step in machine learning model development because it helps reduce the dimensionality of the dataset and remove unnecessary redundancy to improve model performance. In this paper, we use the discrete target variable mutual information algorithm to calculate the mutual information value of the features, which is then used as the basis for feature fusion selection. The goal is to identify the most informative and predictive correlation features, thereby improving the accuracy of the classification model.

[0101] Based on the algorithmic idea of ​​recursive feature elimination, this paper designs a fusion feature screening algorithm. The specific operation is as follows: select the first n features with the highest mutual information value (before 300 dimensions, n increases by 10 dimensions, and after 300 dimensions, n increases by 50 each time), and evaluate them using the K-fold cross-validation of the machine learning model; then record the evaluation results, and select the best feature combination as the final selected fusion feature. The algorithm flow is as follows Figure 14 shown.

[0102] Many existing research works use different random numbers to divide the training and test sets into certain proportions. Using different random numbers to divide the dataset can lead to significant variations in model accuracy. Furthermore, the model is only evaluated on a subset of the data, lacking comprehensiveness and failing to measure the model's performance across the entire dataset.

[0103] The present invention chooses to use K-fold cross validation to make up for this deficiency. Its basic principle is to create a series of training sets and test sets, calculate the accuracy of the model on each test set, and then calculate the average value as the final accuracy of the model.

[0104] The specific steps are as follows:

[0105] ① Divide the original dataset into K equal parts (folds);

[0106] ②Use the first part as the test set and the rest as the training set;

[0107] ③Train the model and calculate the accuracy of the model on the test set;

[0108] ④ Each time, use a different part as the test set and repeat steps ② and ③ K times;

[0109] ⑤ Take the average accuracy as the final model accuracy.

[0110] Cross-validation, a method that helps estimate model performance on unseen data, involves partitioning a dataset into K subsets, training the model on K-1 subsets, and validating the model on the remaining subsets. This process is repeated K times, with each subset used as a validation set. By averaging the performance of these K-fold validations, a more accurate estimate of model performance on unseen data can be achieved, making it well-suited for the real-world context of rapidly increasing malware variants. The feature fusion selection algorithm proposed in this paper uses K-fold cross-validation to evaluate the performance of selected features, helping to prevent overfitting and improve the model's generalization ability. This approach ensures that the selected features are informative and predictive not only for the training data, but also for other parts of the data.

[0111] Compared with other existing feature selection methods, the feature selection algorithm based on the mutual information value of discrete target variables proposed in the present invention has the following advantages: First, it can identify the features with the largest amount of information and the strongest predictiveness, which is critical for improving the detection performance of classification learning models; second, it has certain flexibility in practical applications and can be flexibly adjusted and optimized according to specific needs and available computing resources and data conditions; third, it can be used to reduce the dimension of the data set, and this method is interpretable and maximizes the retention of effective information, which helps to achieve more efficient and higher-precision model training; fourth, it uses mutual information values ​​to identify the features with the largest amount of information, which helps to reduce the negative interference of noise and redundancy in the data set on the effective weights and improve the final classification effect; fifth, the use of sequential sorting to select the features with the largest amount of information helps to reduce the computational complexity of the algorithm; finally, the K-fold cross-validation method is used to select the final combined feature dimension, which can also prevent overfitting of model training to a certain extent, which is helpful for the robustness and generalization ability of features and models.

[0112] In summary, the proposed feature fusion selection algorithm helps extract more informative and effective features, providing more information for the classification model to learn, thereby improving the final classification efficiency and effectiveness. The specific effectiveness evaluation needs to be verified through experiments.

[0113] The experimental results show that the features processed by the feature fusion screening method proposed in this invention perform better than any single feature in four indicators (classification accuracy, precision, recall, and F1-score) in the decision tree, logistic regression, and random forest models, including the optimized features. This shows that the proposed feature fusion method does have a positive effect on improving classification results. Among them, the random forest classifier has the highest classification accuracy of 99.64% for a single feature, while the highest classification accuracy of the fused feature is 99.94%, an improvement of 0.3%. This improvement is still very considerable and not easy to achieve for a classification model with an accuracy of over 99%.

[0114] The experimental results of the three classifiers also reflect the inherent characteristics of the models. Compared to decision trees and random forests, logistic regression is generally better at handling binary classification problems. Multi-classification problems generally require transformation or normalization of class probabilities, which results in some transformation errors. Therefore, the classification accuracy is relatively the lowest among the three. Because random forests are a simple ensemble learning model composed of multiple decision trees, their higher classification results are expected.

[0115] In addition, the classification results of the three classification models also show that compared with single-type features, the random forest classification effect after adopting fusion features has the largest improvement and the highest accuracy rate. The possible reason here is that among the three models, random forest is relatively better at handling high-dimensional feature classification problems. The method proposed in this invention finally selected 1000 as the final fusion feature dimension, which is still relatively high-dimensional. Since it is a simple ensemble learning, multiple decision tree classification results can be voted. The results show that the proposed fusion feature has an improvement effect on the results of malware family classification, which proves the effectiveness of the fusion feature algorithm based on the mutual information of discrete target variables.

[0116] 4 Discussion on classification methods based on optimization and fusion features

[0117] In existing research work related to intelligent classification of malware, methods that use a single feature type often have problems such as limited feature types, insufficient retention of original feature representations, and a large number of shallow features, which can easily lead to problems such as interference in the classification effect of the classification model, poor generalization ability, and limited scope of application; while multi-feature type methods have problems such as high feature dimension, strong feature redundancy, and insufficient sample representation accuracy, which can easily lead to problems such as huge computational overhead of the classification model and decreased classification efficiency. Therefore, the research on the classification method of the present invention focuses on the early optimization of the intelligent classification method, focusing on the processing and optimization of sample features. In addition, in order to verify the effectiveness of the method, in the later stage of the intelligent classification method, that is, in the design and optimization of the classification model, no deliberate optimization processing was performed. Instead, three different types of models that are relatively typical and simple in structure in machine learning were selected, namely decision trees, logistic regression, and random forests, to complete the classification of malware families.

[0118] These three models are relatively typical in machine learning classification models and have certain representativeness. At the same time, their structures are relatively simple and the computational overhead is relatively low. The decision tree has the advantages of being intuitive and easy to understand, highly interpretable, and able to handle nonlinear features and missing values, but it is prone to overfitting; logistic regression has the advantages of fast calculation speed, being suitable for processing large-scale data, and being able to handle binary classification problems, but its ability to handle nonlinear features is relatively poor; random forest has the advantages of being able to handle high-dimensional features, nonlinear features, and missing values, but it is relatively sensitive to outliers. These models have been widely used and studied in different fields and problems. Therefore, the selection of these three models can, in a certain sense, represent different types of models applicable to different problems, which helps to verify the universality and effectiveness of the feature processing method of the present invention.

[0119] The experimental results show that the extraction, optimization and fusion mechanisms in the method proposed in the present invention have played a positive role in the three different types of simple models selected, improving and ultimately achieving a higher classification accuracy. Therefore, it can be inferred that the effectiveness of the method proposed in the present invention is not limited to a certain type of classification model, that is, the method is not only applicable to these basic and simple classification models, but is also effective in other more complex classification models. The fact that this method can obtain such ideal classification results on these basic simple classification models also shows that it has great potential on more complex models. Therefore, the feature optimization and fusion method proposed in the present invention only needs to select the appropriate feature dimension as needed to adapt to different types of intelligent classification models on the back end, and has strong flexibility and versatility. In the present invention, through comparison, the random forest with the best effect among the three models is selected as the classification model to achieve the family classification task of malware.

[0120] Because the feature extraction in this method also uses deep, intrinsic correlations rather than shallow, artificial features, it is also applicable to deep learning models. Therefore, this method provides a universal and valuable sample processing method for future research and practical applications on a wider range of related issues, helping to further improve work in areas such as malware classification, and has important theoretical and practical significance.

[0121] Overall, this study highlights the importance of feature engineering using machine learning for malware classification. The proposed method provides a practical and effective approach for optimizing and fusing features, with potential applications in intrusion detection, network security, and other related fields. The findings of this study provide valuable insights for researchers and practitioners in network security and other related fields.

[0122] The present invention targets malware samples that can be directly statically reverse engineered, and adopts a family classification method based on static analysis features, which is an important part of current malware defense technology. In order to solve the information missing problem of single features or single-type features in existing work, static multi-type features of files are extracted, and a code image deep feature extraction method based on EfficientNet-B3 and an API sequence feature extraction method based on two-way fusion are proposed. In order to solve the problem of missing word order logic information in API sequence statistical features in existing work, a sequence feature optimization method based on the BERT-Tiny embedding mechanism is proposed. In order to solve the problem of excessive feature dimension and excessive redundant information in the existing feature fusion splicing method, a feature fusion screening method based on the mutual information of discrete target variables is proposed to fuse and screen multi-type features to obtain a feature vector with smaller dimension and more comprehensive information. Malware family classification is achieved based on three typical machine learning classification models: decision tree, logistic regression and random forest. The experimental results show that:

[0123] (1) In terms of feature representation, this paper selects three types of features, including statistical features based on static analysis, code image features, and static API sequence features. These three types of features contain multi-level and multi-type information at the instruction level, structure level, and behavior level. The combination of features at different levels and types complements each other, more comprehensively characterizing the program feature information of the original sample, which is more comprehensive than the single feature or single type of feature representation commonly selected in existing work.

[0124] (2) In terms of feature extraction, the deep features extracted by the image feature extraction method based on EfficientNet-B3 proposed in this paper outperform the existing feature extraction methods based on traditional image texture features and other deep learning methods in terms of both visual analysis and quantitative analysis.

[0125] (3) In terms of classification efficiency, the fusion features obtained by the feature optimization and fusion method proposed in this invention have significantly reduced dimensions, lower training costs, and higher classification efficiency compared to the features obtained by directly splicing the extracted shallow features;

[0126] (4) In terms of classification effect, the fusion features extracted, optimized and integrated by the method proposed in the present invention have achieved classification accuracy at a relatively high level compared with existing related work on three different types of simple machine learning classification models. At the same time, compared with the existing mainstream features and the single optimized features proposed in the present invention, the fusion features have improved classification accuracy, precision, recall rate and F1-score.

[0127] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A malware family classification method based on static multi-feature optimization and fusion, characterized by: include: Step 1: Extract malware image features based on the deep neural network EfficientNet-B3; Static API sequences are extracted using the disassemblers IDAPro and Radare2, respectively, and the extraction results are fused to obtain a fused static API sequence. Static statistical features of malware are extracted, including statistical features of assembly program files, statistical features of binary byte files, and file byte sequence features. The EfficientNet-B3 uses a scaling factor of (width, depth, res, dropout) = (1.2, 1.4, 300, 0.3) and processes it through an average pooling layer to obtain a 1536-dimensional feature vector. Dense and Dense_1 layers are added after the average pooling layer to reduce the extracted features from 1536 dimensions to 512 dimensions. The code image feature extraction based on the deep neural network EfficientNet-B3 includes: forming a vector from each 8 bits of the malware binary file, treating the vector as the grayscale value of a pixel in a grayscale image, generating square code images with equal height and width, and then normalizing all the generated square images of different sizes to obtain grayscale images of the same size; using the obtained grayscale images as input, and extracting malware image features using the EfficientNet-B3 model; The fused static API sequence is obtained as follows: IDAPro is used to recursively read the assembly file to obtain the static API sequence of the sample. Radare2 is used to extract the control flow information and then obtain the static API sequence of the sample. Two sets of static API sequences are obtained for the same file. The static API sequence extracted by Radare2 and the static API sequence extracted by IDAPro are then fused in two ways to obtain the fused static API sequence. Step 2: Feature optimization of the fused static API sequence based on the lightweight natural language processing model BERT-Tiny embedding mechanism; Step 3: Based on the code image features extracted in step 1, the static statistical features of the malware, and the static API sequence features optimized in step 2, a discrete target variable mutual information algorithm is used to calculate the mutual information value of the features, and the optimal fusion feature sequence combination is selected based on the mutual information value of the features; Step 4: Input the optimal fusion feature sequence combination into the classification model to complete the malware family classification.

2. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: Extract statistical features of assembler files as follows: Construct a list of features to be matched, including registers, opcodes, keywords, and API call names; Each feature in the feature list is counted in each program through string matching, and the feature vector is finally saved.

3. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: Extract statistical features of binary byte files as follows: For the binary byte file of the disassembled program, the file size and byte information entropy are extracted as the statistical features of the binary byte file. The total number of bytes contained in the statistical file is used as the file size. The file byte information entropy is calculated as follows: where p k It is the ratio of bytes with value k to all bytes.

4. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: Extract file byte sequence features as follows: For the assembly program file, the .asm file generated by IDAPro disassembly is selected, and the description of the key information of the program PE file and the description bytes of the program code segment initialization in the header of the file are used as the file byte sequence feature vector; For a binary byte file, take its first 1000 bytes as the file byte sequence feature vector.

5. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: The step 2 includes: First, the WordPiece algorithm is used to convert the static API sequence features into a vocabulary. Then, each static API sequence is represented as ([content vector, position vector], label) and input into the BERT-Tiny model for deep feature extraction. Finally, the output of the fully connected layer of the BERT-Tiny model is extracted and used as the optimized static API sequence feature vector.

6. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: The mutual information value of the feature calculated by using the discrete target variable mutual information algorithm includes: Where MI(X,Y) is the mutual information value of the discrete target variable between X and Y, X and Y are two discrete random variables, For X i and Y j The joint probability distribution of X i and Y j The marginal probability of , N is the number of samples.

7. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: The method of screening out the optimal fusion feature sequence combination based on the mutual information value of the features includes: The first n features with the highest mutual information values ​​are selected in turn and evaluated using K-fold cross-validation of the machine learning model; the evaluation results are then recorded, and the best feature combination is selected as the final selected fusion feature.

8. The malware family classification method based on static multi-feature optimization and fusion according to claim 1 is characterized in that: The classification models include decision trees, logistic regression, and random forests.

Images