Malicious software detection method and device and electronic equipment
By jointly encoding the executable files and grayscale image feature vectors in the malware detection model, generating multimodal input sequences and performing deep interactions, the problem that malware detection models in the prior art is easily bypassed is solved, and the problem of improving the problem of malware detection models being easily bypassed, The accuracy and robustness of the detection are achieved.
Patent Information
- Application Number
- CN202411434164.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-14
- Publication Date
- 2025-02-18
AI Technical Summary
Existing malware detection models usually only detect a single source of information, which is easily by attackers to bypass detection using the inconsistency of multimodal information, resulting in insufficient detection accuracy and robustness.
By obtaining the executable file of the software to be detected, converting it into an instruction feature vector and an image feature vector of the grayscale image, splicing it into a multi-modal input sequence, and importing a multi-layer encoder to generate the target feature vector for detection.
This method can focus on multiple information sources of the software to be detected, perform joint encoding, and improve the accuracy and robustness of malware detection.
Smart Images
Figure CN119475332A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security, and in particular to a malware detection method, device and electronic device. Background Art
[0002] Currently, malware detection technology plays an important role in maintaining network security and can be used to protect home automation devices, smart door locks, and smart appliances. However, with the development of malware attack technology, attackers can bypass the detection of detection models that only focus on a single information source and use the inconsistency of multimodal information to bypass the detection of traditional multimodal malware detection. Therefore, there is a need for a method to improve the accuracy and robustness of malware detection.
[0003] In the existing technology, deep learning-based malware detection models usually only detect a single information source, such as assembly instruction sequences or binary images, which makes them easy for attackers to bypass detection by exploiting the inconsistency of multimodal information. Summary of the invention
[0004] The present invention provides a malware detection method, device and electronic device, which are used to improve the accuracy and robustness of malware detection.
[0005] In a first aspect, an embodiment of the present invention provides a malware detection method, the method comprising:
[0006] Obtaining an executable file of the software to be detected, and converting the executable file into an instruction feature vector, wherein the instruction feature vector includes vocabulary information of the executable file and location information of the vocabulary information in the executable file;
[0007] Extracting the content to be detected from the executable file, converting the content to be detected into a grayscale image, and generating an image feature vector of the grayscale image;
[0008] The instruction feature vector and the image feature vector are concatenated into a multimodal input sequence, and the multimodal input sequence is imported into a multi-layer encoder to obtain a target feature vector corresponding to the software to be detected;
[0009] The detection result of the software to be detected is obtained according to the classification result of the target feature vector.
[0010] This method can focus on multiple information sources of the software to be detected and jointly encode multiple information sources, thereby improving the accuracy and robustness of malware detection.
[0011] In an optional embodiment, converting the executable file into an instruction feature vector includes:
[0012] Disassemble the executable file to obtain the instruction sequence;
[0013] The instruction sequence is encoded to generate the instruction feature vector.
[0014] In an optional embodiment, encoding the instruction sequence to generate an instruction feature vector includes:
[0015] Splitting the instruction sequence into basic units according to a vocabulary, wherein the vocabulary contains all basic units and the basic units contain operation codes and operands;
[0016] The basic unit is converted into an embedding vector through an embedding matrix, where the number of rows of the embedding matrix is the total number of all basic units in the vocabulary, and the number of columns is the embedding dimension of the basic unit;
[0017] The positional encoding is added to the embedding vector to obtain the instruction feature vector, where the positional encoding has the same dimension as the embedding vector.
[0018] In an optional embodiment, the content to be detected is converted into a grayscale image, and an image feature vector of the grayscale image is generated, including:
[0019] Convert the content to be detected into a bit sequence;
[0020] Convert the bit sequence into a grayscale image;
[0021] Cut the grayscale image into image blocks of the same size, and convert each image block into an image block vector;
[0022] The image block vector is input into the fully connected layer network to generate the image feature vector.
[0023] By jointly encoding the assembly language instruction sequence of the executable file and the grayscale image of the binary content, deep interaction between multimodal data is achieved, so that the model can capture the association between multimodal data, thereby improving the accuracy of malware detection.
[0024] In an optional embodiment, the instruction feature vector and the image feature vector are concatenated into a multimodal input sequence, including:
[0025] Create an empty sequence, where the empty sequence contains a start marker;
[0026] Add an instruction feature vector after the start marker, and add a separator after the instruction feature vector;
[0027] The image feature vector is added after the separator, and the terminator is added after the image feature vector to obtain a multimodal input sequence.
[0028] In an optional embodiment, the multimodal input sequence is imported into a multi-layer encoder to obtain a target feature vector corresponding to the software to be detected, including:
[0029] Extract the semantic information of the multimodal input sequence after encoding in each layer of encoder;
[0030] All semantic information is concatenated to obtain the target feature vector.
[0031] By inputting the multimodal input sequence into a multi-layer encoder, the low-level encoder focuses on local features and the high-level encoder captures global features. Each layer extracts more abstract semantic information after encoding, achieving progressive deep interaction layer by layer, and finally generating a target feature vector containing multimodal information, thereby improving the accuracy and robustness of malware detection.
[0032] In an optional embodiment, obtaining the detection result of the software to be detected according to the classification result of the target feature vector includes:
[0033] Input the target feature vector into the fully connected layer network to obtain a scalar, where the scalar indicates the score of the software to be detected as malware;
[0034] Convert the scalar into a first probability value through an activation function;
[0035] Calculate a cross entropy loss by combining the first probability value with the positive label, wherein the positive label indicates that the software to be detected is malware;
[0036] Training the cross entropy loss based on gradient descent, and obtaining a second probability value when the cross entropy loss reaches a fixed value;
[0037] If the second probability value is greater than or equal to 0.5, the software to be detected is output as malware;
[0038] If the second probability value is less than 0.5, the software to be detected is output as non-malware.
[0039] In a second aspect, an embodiment of the present application provides a malware detection device, the device comprising:
[0040] An acquisition module is used to acquire the executable file of the software to be detected;
[0041] A processing module is used to convert an executable file into an instruction feature vector, wherein the instruction feature vector contains the vocabulary information of the executable file and the position information of the vocabulary information in the executable file; extract the content to be detected from the executable file, and convert the content to be detected into a grayscale image to generate an image feature vector of the grayscale image; splice the instruction feature vector and the image feature vector into a multimodal input sequence, and import the multimodal input sequence into a multi-layer encoder to obtain a target feature vector corresponding to the software to be detected; and obtain the detection result of the software to be detected according to the classification result of the target feature vector.
[0042] In a third aspect, an embodiment of the present application provides an electronic device, including:
[0043] Memory, used to store computer programs;
[0044] The processor is used to implement the steps of the above-mentioned malware detection method when executing the computer program stored in the memory.
[0045] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned malware detection method are implemented.
[0046] For each aspect from the second to the fourth aspect and the technical effects that may be achieved by each aspect, please refer to the above description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS
[0047] Figure 1 A flowchart of a method for detecting malware provided by the present application;
[0048] Figure 2 A schematic diagram of the structure of a video segmentation device provided in this application;
[0049] Figure 3 A schematic diagram of an electronic device provided for this application. DETAILED DESCRIPTION
[0050] At present, malware attacks can be intercepted by malware detection technology. Among them, malware detection models based on deep learning usually only detect a single information source. However, with the development of malware attack technology, attackers can bypass the detection of detection models that only focus on a single information source and use the inconsistency of multimodal information to bypass the detection of traditional multimodal malware detection.
[0051] In order to solve the above technical problems, the present application provides a malware detection method, characterized in that the method includes: obtaining an executable file of the software to be detected, and converting the executable file into an instruction feature vector, extracting the content to be detected in the executable file, and converting the content to be detected into a grayscale image, generating an image feature vector of the grayscale image; splicing the instruction feature vector and the image feature vector into a multimodal input sequence, and importing the multimodal input sequence into a multi-layer encoder to obtain a target feature vector corresponding to the software to be detected; and obtaining the detection result of the software to be detected according to the classification result of the target feature vector. Through this method, multiple information sources of the software to be detected can be paid attention to, and multiple information sources can be jointly encoded, thereby improving the accuracy and robustness of malware detection.
[0052] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0053] In one possible implementation, the malware detection model can be used for smart home security to protect home automation devices such as smart cameras, smart door locks, and smart appliances. The model obtains executable file code by scanning the device's storage or firmware, and checks the code content to find malware signatures, vulnerabilities, and other potential threats. If an abnormality is found, the model can automatically alarm and notify the user to take security measures such as upgrading firmware and changing passwords. The specific implementation steps are as follows.
[0054] Reference Figure 1 FIG. 1 is a flowchart of a malware detection method provided by the present application, the method comprising:
[0055] S1, obtaining the executable file of the software to be detected, and converting the executable file into an instruction feature vector;
[0056] In an embodiment of the present application, the malware detection system extracts the executable files of the software by scanning the software. After the executable files are input into the system, the system places the executable files in corresponding locations for storage.
[0057] In an optional embodiment, the executable file is converted into an instruction feature vector, and the step specifically includes:
[0058] First, disassemble the executable file to get the instruction sequence.
[0059] Specifically, the executable file is read from the memory, and a reverse engineering tool (such as IDA Pro, etc.) is called to disassemble the contents of the executable file to obtain the assembly language instruction sequence of the executable file.
[0060] After obtaining the instruction sequence, the instruction sequence is encoded to generate an instruction feature vector.
[0061] Specifically, after obtaining the instruction sequence, the instruction sequence is split into basic units (tokens) according to the vocabulary. It should be noted that the vocabulary is a pre-trained vocabulary, that is, a vocabulary containing all basic units constructed by analyzing a large number of instruction sequences, and the basic unit includes an opcode and an operand.
[0062] After splitting the instruction sequence into basic units, the index of the basic unit in the vocabulary is obtained to locate the position of the basic unit in the vocabulary, and the basic unit is converted from characters to digital form. For example, the sentence "Hello, Word!" is split into "Hello", ",","Word","!", then "Hello" may be assigned index 0, "," is assigned index 1, "Word" is assigned index 2, and "!" is assigned index 3, then the original sentence "Hello, world!" may be converted to [0,1,2,3].
[0063] The system then generates an embedding matrix of the form (V, D) based on the total number of all basic units in the vocabulary and the embedding dimension of the basic unit, where V is the total number of all basic units in the vocabulary and D is the embedding dimension of the basic unit. The basic unit in digital form is converted into an embedding vector through the embedding matrix. After obtaining the embedding vector, the positional encoding is added to the embedding vector to obtain the instruction feature vector. It should be noted that the positional encoding has the same dimension as the embedding vector and is a learnable positional encoding, that is, the positional encoding can be updated by an algorithm during the training process to obtain the encoding method of the current basic unit.
[0064] S2, extracting the content to be detected from the executable file, converting the content to be detected into a grayscale image, and generating an image feature vector of the grayscale image;
[0065] In this step, the system extracts part of the content in the executable file according to the set range, such as extracting the first 10% of the content in the executable file as the content to be detected. The content to be detected is converted into binary, the spaces between each binary are deleted and they are spliced into a continuous bit sequence, and the first 2000 bits of the bit sequence are stored as the data set to be analyzed. The bit sequence is input into the software tool to obtain a grayscale image.
[0066] The grayscale image is cut into image blocks of the same size, and each image block is converted into an image block vector, and the image block vector is input into the fully connected layer network to generate an image feature vector. For example, the grayscale image is cut into image blocks of size 16X16, and then each 16X16 image block is flattened into a vector of length 256 in the order of each row, and finally the vector of length 256 is input into the fully connected layer network to obtain a 786-dimensional image feature vector.
[0067] S3, concatenates the instruction feature vector and the image feature vector into a multimodal input sequence;
[0068] In this step, you first need to create an empty sequence, where the empty sequence contains a start marker; add an instruction feature vector after the start marker, and add a separator after the instruction feature vector; add an image feature vector after the separator, and add an end marker after the image feature vector, and finally get a multimodal input sequence.
[0069] For example, assuming that the instruction sequence has N tokens and the image has M blocks, the length of the concatenated input sequence is N+M+3, that is, [cls, token_1, token_2, ..., token_N, sep, image_block_1, ..., image_block_M, end], where cls is the start marker, sep is the separator used to separate the contents of the instruction feature vector and the image feature vector, and end is the end marker.
[0070] By jointly encoding the assembly language instruction sequence of the executable file and the grayscale image of the binary content, deep interaction between multimodal data is achieved, so that the model can capture the association between multimodal data, thereby improving the accuracy of malware detection.
[0071] S4, importing the multimodal input sequence into the multi-layer encoder to obtain the target feature vector corresponding to the software to be detected;
[0072] In this step, each layer of encoder encodes the multimodal input sequence and extracts the semantic information from the multimodal input sequence, and then inputs the encoded multimodal input sequence into the next layer of encoder, repeating the operation of extracting semantic information after encoding, and progressing layer by layer to the last layer of encoder. Finally, the semantic information extracted by each layer of encoder is spliced to obtain the target feature vector containing comprehensive multimodal information.
[0073] By inputting the multimodal input sequence into a multi-layer encoder, the low-level encoder focuses on local features and the high-level encoder captures global features. Each layer extracts more abstract semantic information after encoding, achieving progressive deep interaction layer by layer, and finally generating a target feature vector containing multimodal information, thereby improving the accuracy and robustness of malware detection.
[0074] S5, obtaining the detection result of the software to be detected according to the classification result of the target feature vector;
[0075] In this step, after obtaining the target feature vector, the target feature vector needs to be classified. The classification process includes:
[0076] The target feature vector is input into the fully connected layer network to obtain a scalar, where the scalar indicates the score of the software to be detected as malware. After obtaining the scalar, the scalar is converted into a first probability value through an activation function (such as sigmoid, etc.), defined as Y, with a value range of [0,1]; the first probability value is combined with the positive label to calculate the cross entropy loss, where the positive label indicates that the software to be detected is malware, defined as y, with a value of 1, and the cross entropy loss formula is as follows:
[0077] Loss=∑-(y*logY+(1-y)*log(1-Y))
[0078] After obtaining the cross entropy loss, the cross entropy loss is trained based on the gradient descent method, and the parameters of the model are updated (including updating the Y value). When the cross entropy loss gradually decreases and reaches a fixed value, the current value of Y is obtained and recorded as the second probability value.
[0079] After obtaining the second probability value, the detection result of the software to be detected is obtained based on the magnitude relationship between the second probability value and 0.5. Specifically, if the second probability value is greater than or equal to 0.5, the software to be detected is output as malware; if the second probability value is less than 0.5, the software to be detected is output as non-malware.
[0080] Based on the same inventive concept, the present application embodiment also provides a device for detecting malware, referring to Figure 2 The figure is a schematic diagram of a malware detection device provided in an embodiment of the present application, the device comprising:
[0081] The acquisition module 201 is used to acquire the executable file of the software to be detected;
[0082] The processing module 202 is used to convert the executable file into an instruction feature vector, wherein the instruction feature vector includes the vocabulary information of the executable file and the location information of the vocabulary information in the executable file; extract the content to be detected from the executable file, and convert the content to be detected into a grayscale image to generate an image feature vector of the grayscale image; splice the instruction feature vector and the image feature vector into a multimodal input sequence, and import the multimodal input sequence into a multi-layer encoder to obtain a target feature vector corresponding to the software to be detected; and obtain the detection result of the software to be detected according to the classification result of the target feature vector.
[0083] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application. The electronic device can realize the functions of the aforementioned malware detection device, referring to Figure 3 , electronic equipment includes:
[0084] At least one processor 301, and a memory 302 connected to the at least one processor 301. The specific connection medium between the processor 301 and the memory 302 is not limited in the embodiment of the present application. Figure 3 In the example, the processor 301 and the memory 302 are connected via the bus 300. The bus 300 is connected to the memory 302 via the bus 300. Figure 3 The bus 300 is represented by a bold line, and the connection between other components is only for schematic illustration and is not intended to be limiting. The bus 300 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 301 can also be called a controller, and there is no limitation on the name.
[0085] In the embodiment of the present application, the memory 302 stores instructions that can be executed by at least one processor 301. The at least one processor 301 can execute the malware detection method discussed above by executing the instructions stored in the memory 302. The processor 301 can implement Figure 2 The functions of each module in the device shown.
[0086] Among them, the processor 301 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 302 and calling data stored in the memory 302, the various functions of the device and process data, the device can be monitored as a whole.
[0087] In one possible design, the processor 301 may include one or more processing units, and the processor 301 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 301. In some embodiments, the processor 301 and the memory 302 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.
[0088] The processor 301 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the malware detection method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.
[0089] The memory 302 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 302 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 302 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 302 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.
[0090] By programming the processor 301, the code corresponding to the malware detection method described in the above embodiment can be fixed into the chip, so that the chip can execute the malware detection method when it is running. Figure 1The steps of the malware detection method of the embodiment shown are as follows: How to design and program the processor 301 is a technique known to those skilled in the art and will not be described in detail here.
[0091] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the malware detection method discussed above.
[0092] In some possible implementations, various aspects of the malware detection method provided in the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of the malware detection method according to various exemplary implementations of the present application described above in this specification.
[0093] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0094] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0095] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0096] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in one or more boxes. Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.
Claims
1. A malware detection method, characterized in that: The method comprises: Obtaining an executable file of the software to be detected, and converting the executable file into an instruction feature vector, wherein the instruction feature vector includes vocabulary information of the executable file and location information of the vocabulary information in the executable file; Extracting the content to be detected from the executable file, converting the content to be detected into a grayscale image, and generating an image feature vector of the grayscale image; splicing the instruction feature vector and the image feature vector into a multimodal input sequence, and importing the multimodal input sequence into a multi-layer encoder to obtain a target feature vector corresponding to the software to be detected; The detection result of the software to be detected is obtained according to the classification result of the target feature vector.
2. The method according to claim 1, characterized in that The step of converting the executable file into an instruction feature vector comprises: Disassembling the executable file to obtain an instruction sequence; The instruction sequence is encoded to generate the instruction feature vector.
3. The method according to claim 1, characterized in that The step of converting the content to be detected into a grayscale image and generating an image feature vector of the grayscale image comprises: Converting the content to be detected into a bit sequence; Converting the bit sequence into a grayscale image; Cutting the grayscale image into image blocks of the same size, and converting each image block into an image block vector; The image block vector is input into a fully connected layer network to generate the image feature vector.
4. The method according to claim 1, characterized in that The step of splicing the instruction feature vector and the image feature vector into a multimodal input sequence comprises: Create an empty sequence, wherein the empty sequence contains a start marker; Adding the instruction feature vector after the start marker, and adding a separator after the instruction feature vector; The image feature vector is added after the separator, and a terminator is added after the image feature vector to obtain the multimodal input sequence.
5. The method according to claim 1, characterized in that The step of importing the multimodal input sequence into a multi-layer encoder to obtain a target feature vector corresponding to the software to be detected includes: Extracting semantic information of the multimodal input sequence after being encoded in each layer of encoder; All semantic information is concatenated to obtain the target feature vector.
6. The method according to claim 1, characterized in that The step of obtaining the detection result of the software to be detected according to the classification result of the target feature vector includes: Inputting the target feature vector into a fully connected layer network to obtain a scalar, wherein the scalar indicates the score of the software to be detected as malware; Converting the scalar into a first probability value through an activation function; Calculating a cross entropy loss by combining the first probability value with a positive label, wherein the positive label indicates that the software to be detected is malware; Training the cross entropy loss based on gradient descent, and obtaining a second probability value when the cross entropy loss reaches a fixed value; If the second probability value is greater than or equal to 0.5, outputting that the software to be detected is malware; If the second probability value is less than 0.5, it is output that the software to be detected is non-malware.
7. The method according to claim 2, characterized in that The step of encoding the instruction sequence to generate the instruction feature vector comprises: Splitting the instruction sequence into basic units according to a vocabulary, wherein the vocabulary contains all basic units, and the basic units contain operation codes and operands; Converting the basic unit into an embedding vector through an embedding matrix, wherein the number of rows of the embedding matrix is the total number of all basic units in the vocabulary, and the number of columns is the embedding dimension of the basic unit; The position code is added to the embedding vector to obtain the instruction feature vector, wherein the position code has the same dimension as the embedding vector.
8. A device for detecting malware, characterized in that: The device comprises: An acquisition module is used to acquire the executable file of the software to be detected; A processing module is used to convert the executable file into an instruction feature vector, wherein the instruction feature vector contains the vocabulary information of the executable file and the position information of the vocabulary information in the executable file; extract the content to be detected from the executable file, and convert the content to be detected into a grayscale image to generate an image feature vector of the grayscale image; splice the instruction feature vector and the image feature vector into a multimodal input sequence, and import the multimodal input sequence into a multi-layer encoder to obtain a target feature vector corresponding to the software to be detected; and obtain the detection result of the software to be detected according to the classification result of the target feature vector.
9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 7 when executing the computer program stored in the memory.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 7 are implemented.