Malicious code gene information recessive association mining method based on meta learning

Abstract

The invention provides a malicious code gene information recessive association mining method based on meta-learning, which comprises the following steps of: generating a function call graph (FCG) to obtain an attribute function call graph; training the feature extraction model based on the sequence-to-sequence mechanism by adopting meta-learning, and obtaining a key sub-graph of the function call graph from the generated attribute function call graph through the trained feature extraction model based on the sequence-to-sequence mechanism; generating a control flow graph (CFG), and obtaining an attribute control flow graph; using the optimized gene feature extraction model based on the graph structure for the generated attribute control flow graph to obtain a key sub-graph of the control flow graph; and a fine-tuning corpus is obtained through the key sub-graph of the function call graph and the key sub-graph of the control flow graph, and hidden association mining of malicious code gene information is carried out by using the fine-tuned large language model. According to the method, the recessive association of the malicious code gene information can be accurately mined, and the malicious code analysis precision and efficiency are remarkably improved.

Description

Technical Field

[0001] The invention relates to a method for mining implicit associations of malicious code gene information based on meta-learning, and belongs to the technical field of information mining. Background Art

[0002] With the rapid development of Internet technology, network security issues have become increasingly prominent, especially malware attacks have become a major threat to personal privacy and corporate data security. In order to effectively combat malware, researchers are constantly exploring new detection technologies and methods. In recent years, Graph Neural Networks (GNNs) have been widely used in the field of malicious code analysis due to their powerful graph structure data processing capabilities. Graph Neural Networks GNNs can extract valuable information from complex graph structures to help identify and understand the behavior patterns of malicious code.

[0003] Meta-learning is a learning strategy that enables machine learning algorithms to quickly adapt to new tasks. It can achieve good generalization effects even with a small number of samples. In the field of malware analysis, meta-learning is used to improve the detection efficiency of models when facing unknown malicious code. Combined with graph neural networks (GNNs), meta-learning can help the model learn the key subgraphs in the control flow graph and function call graph of malicious code more quickly, that is, those parts that have a decisive influence on the behavior of malicious code.

[0004] With the development of deep learning technology, large-scale pre-trained models have achieved remarkable results in fields such as natural language processing. These large language models usually have a large number of parameters and can capture complex relationships between data. However, directly applying these models to specific tasks often leads to overfitting or insufficient generalization ability, resulting in low accuracy and efficiency in identifying malicious code.

[0005] In summary, existing problems in existing malicious code analysis restrict the effective mining of malicious code family behavior patterns and implicit associations. Summary of the invention

[0006] The purpose of the present invention is to provide a method for mining implicit associations of malicious code gene information based on meta-learning to solve the problem in the prior art that the accuracy and efficiency of identifying implicit associations of malicious code gene information need to be improved.

[0007] The technical solution of the present invention is: A method for mining hidden associations of malicious code gene information based on meta-learning, comprising the following steps: S1. Use a disassembly tool to identify and mark functions in the malicious code, generate a function call graph FCG, and use the generated function call graph to perform feature extraction and preprocessing to obtain an attribute function call graph; S2, constructing a gene feature extraction model based on a sequence-to-sequence mechanism, using meta-learning to train the feature extraction model based on the sequence-to-sequence mechanism, and obtaining a trained feature extraction model based on the sequence-to-sequence mechanism, and obtaining a key subgraph of the function call graph by the attribute function call graph generated by step S1 through the trained feature extraction model based on the sequence-to-sequence mechanism; S3. Parse the binary file of the malicious code through a disassembly tool to obtain the assembly code, build the calling relationship between functions, generate a control flow graph CFG, and extract semantic and structural features from the control flow graph CFG to obtain an attribute control flow graph; S4, constructing a graph-structure-based gene feature extraction model, optimizing the graph-structure-based gene feature extraction model using meta-learning, obtaining an optimized graph-structure-based gene feature extraction model, and using the optimized graph-structure-based gene feature extraction model on the attribute control flow graph generated in step S3 to obtain a key subgraph of the control flow graph; S5. Using the key subgraph of the function call graph obtained in step S3 and the key subgraph of the control flow graph obtained in step S4, a template-based prompt word automatic generation technology is used to obtain a fine-tuning corpus, and the large language model is fine-tuned to obtain a fine-tuned large language model. The fine-tuned large language model is used to perform implicit association mining of malicious code gene information.

[0008] Further, in step S2, the feature extraction model based on the sequence-to-sequence mechanism includes a graph attention network GAT, a first leaky linear rectifier function layer, i.e., a first LeakyRELU layer, a first fully connected layer, a second leaky linear rectifier function layer, i.e., a second LeakyRELU layer, a sequence-to-sequence model, and a second fully connected layer. Graph Attention Network (GAT): classifies the attribute function call graph and obtains the attention weights; The first LeakyRELU layer: The node embedding set containing neighbor features of N nodes is calculated by the input attention weight; The first fully connected layer: The current attribute node feature embeddings of the N nodes of the graph are called by the input attribute function to obtain the current attribute node feature embedding set of N nodes that is consistent with the dimension of the node embedding set; The second LeakyRELU layer: concatenates the node embedding set containing neighbor features and the current attribute node feature embedding set to obtain the final node feature set of N nodes; Sequence-to-sequence model: extract global features from the final node feature set of the input N nodes, obtain nodes with attention weights and output them to the key subgraph construction module, generate a global graph vector, and output it to the second fully connected layer; Key subgraph construction module: sort the importance of nodes with attention weights and generate a subgraph sequence sorted by importance as the key subgraph of the control flow graph; The second fully connected layer: calculates the classification probability of the input global graph vector and obtains the classification result.

[0009] Furthermore, the sequence-to-sequence model includes a normalized exponential function layer, namely a softmax layer, a weighted average module, a concatenation layer, and a long short-term memory network LSTM. Softmax layer: The final node feature in the input final node feature set and the query vector at time step t=0,1,2,...,T , calculate the attention weight of the node ; Weighted average module: Generates the full graph information aggregated from the node features at the current time step ; Concatenation layer: concatenates the query vector at time step t and aggregated full-image information Concatenate and Concat to get the feature vector generated by time step t , and output to the long short-term memory network LSTM; after time step T, the global graph vector is obtained Output to the second fully connected layer; Long Short-Term Memory Network LSTM: feature vector generated by input time step t Get the query vector at time step t+1 , and output to the softmax layer.

[0010] Furthermore, in step S2, meta-learning is used to train the feature extraction model based on the sequence-to-sequence mechanism, specifically, S21, randomly sample N categories from the attribute function call graph, each category contains K support set samples and several query set samples; S22. On the support set, the base learner starts with the initial global meta-parameters θ provided by the meta-learner and optimizes the task-specific parameters , where α is the base learner learning rate, is the loss gradient of the support set with respect to the initialization parameter θ, is the loss function on the support set, A feature extraction model based on sequence-to-sequence mechanism is adopted for the base learner; S23. On the query set, the meta-learner evaluates the updated model performance of the base learner and optimizes the global meta-parameters through the loss of the query set: , where β is the meta-learner learning rate, is the loss gradient of the query set with respect to the global meta-parameter θ, is the loss function on the query set, and updates the global meta-parameter θ, completing the training after reaching the set number of training times.

[0011] Furthermore, in step S4, the graph-structure-based gene feature extraction model includes a graph attention network model classifier, a control flow graph interpreter, i.e., a CFG interpreter, and a key subgraph generation module. Graph attention network model classifier: The node embedding generation component generates node embeddings for the input attribute control flow graph CFG, and the classification component predicts the category of each attribute control flow graph as the class label, and outputs the node embedding and class label to the CFG interpreter; CFG interpreter: includes initial learning module and interpretation module, Initial learning module: The node scoring component calculates the node score from the node embedding, multiplies the node embedding and the node score to get the weighted embedding, and uses the weighted embedding to generate the classification probability through the classification component to obtain the classification result of each node; Explanation module: According to the node scores and the actual number of nodes in the attribute control flow graph, the attribute control flow graph is pruned step by step for multiple times. After gradually removing a set number of nodes with the lowest scores, multiple subgraphs are obtained from the remaining nodes each time, and the most important subgraph is used as the key subgraph of the control flow graph.

[0012] Furthermore, in the interpretation module, the attribute control flow graph is pruned step by step multiple times according to the node scores and the actual number of nodes in the attribute control flow graph. After gradually removing the set number of nodes with the lowest scores, multiple subgraphs are obtained from the remaining nodes each time, and the most important subgraph is used as the key subgraph of the control flow graph, specifically, S41. Obtain the actual number of nodes in the attribute control flow graph obtained in step S3 , initialize the ordered node set Vordered used to store nodes sorted by importance to an empty set, initialize the subgraph set subgraphs used to store the subgraph adjacency matrix of the remaining nodes after each iteration to the attribute control flow graph obtained in step S3, and store the indexes of all nodes of the attribute control flow graph in the variable all_node_indices to track the nodes that have not been pruned; S42. According to the set step size, calculate the number of nodes Nstep that need to be pruned in each iteration: ; S43. According to the node scores obtained in the initial learning module, the Nstep nodes with the lowest scores are sequentially added to the ordered node set Vordered, the corresponding indexes of the Nstep nodes with the lowest scores are removed from the variable all_node_indices, and the subgraph set subgraphs is updated: all the incoming and outgoing edges of the Nstep nodes with the lowest scores are removed, and the subgraph adjacency matrix of the remaining nodes is updated and saved as the current subgraph; the above steps are repeated until all the indexes of the nodes in the variable all_node_indices are removed; S44. Reverse the order of nodes in the ordered node set Vordered so that the first node is the most important node for the classification task and the last node is the least important node; at the same time, reverse the order of subgraphs in the subgraph set subgraphs, and use the first subgraph, which is the most important subgraph, as the key subgraph of the control flow graph.

[0013] Further, step S5 is specifically, S51, generate prompt words based on the template-based prompt word automatic generation technology, use the attribute function call graph obtained in step S1 and the attribute control flow graph obtained in step S3 as input data D, use the key subgraph of the function call graph obtained in step S2 and the key subgraph of the control flow graph obtained in step S4 as target labels, and construct a fine-tuning corpus; S52. Based on the generated fine-tuning corpus, use the fine-tuning method DoRA to fine-tune the large language model.

[0014] Further, in step S51, a prompt word is generated, specifically, by designing a prompt word template , where P is a predefined pattern, and N prompt words {t1, t2, ..., t i ,...,t N}.

[0015] Further, step S52, specifically, in the fine-tuning process, fine-tuning the corpus ,in, is the generated i-th prompt word, For the i-th target label, use the optimization objective function: , where θ is the model parameter of the large language model Model; the model parameter θ of the large language model is continuously updated through back propagation until the set number of fine-tuning times is reached.

[0016] The beneficial effects of the present invention are: 1. This meta-learning-based method for mining implicit associations of malicious code genetic information can accurately mine implicit associations of malicious code genetic information, significantly improve the accuracy and efficiency of malicious code analysis, and provide innovative technical support and application directions for the field of malicious code detection and security protection.

[0017] Second, the present invention can accurately extract the genetic features of malicious code. Through the genetic feature extraction model based on sequence-to-sequence mechanism and the genetic feature extraction model based on graph structure, it can respectively perform multi-level analysis on the attribute function call graph and the attribute control flow graph, integrate the features extracted from the attribute function call graph and the attribute control flow graph into the genetic information of the malicious code, and more accurately represent the genetic features of the malicious code, thereby improving the effects of classification, detection and behavior analysis.

[0018] 3. This meta-learning-based method for mining implicit associations of malicious code gene information can deeply and accurately mine implicit association features between malicious codes through template-based prompt word automatic generation technology and fine-tuning methods. Using the fine-tuned large language model, it can effectively build accurate associations of malicious code behavior patterns, provide a reliable basis for malicious code detection and family tracing in complex scenarios, and greatly improve the accuracy and comprehensiveness of implicit association mining. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a schematic diagram of the process of the method for mining implicit associations of malicious code gene information based on meta-learning in an embodiment of the present invention; Figure 2 It is a schematic diagram for explaining a method for mining implicit associations of malicious code gene information based on meta-learning according to an embodiment of the present invention; Figure 3 is a schematic diagram illustrating a gene feature extraction model based on a sequence-to-sequence mechanism in an embodiment; Figure 4 is a schematic diagram illustrating a gene feature extraction model based on a graph structure in an embodiment; Figure 5 Schematic diagram for explaining the sequence-to-sequence model in the embodiment. DETAILED DESCRIPTION

[0020] The preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0021] The embodiment provides a method for mining implicit associations of malicious code gene information based on meta-learning, such as Figure 1 and Figure 2 , including the following steps, S1. Use a disassembly tool to identify and mark the functions in the malicious code, generate a function call graph FCG, and use the generated function call graph to perform feature extraction and preprocessing to obtain an attribute function call graph.

[0022] In step S1, the malicious code is disassembled using the disassembly tool IDA, and the function call graph FCG is generated using the plug-in or script provided by the disassembly tool IDA. The Word2Vec model is used to convert the assembly instructions of the function call graph into feature vectors. This process includes instruction filtering and CBOW model training. Finally, the function feature vector is obtained by averaging the instruction vector of each function to form an attribute function call graph.

[0023] S2. Construct a gene feature extraction model based on sequence-to-sequence mechanism, use meta-learning to train the feature extraction model based on sequence-to-sequence mechanism, and obtain the trained feature extraction model based on sequence-to-sequence mechanism. The attribute function call graph generated by step S1 is obtained by the trained feature extraction model based on sequence-to-sequence mechanism to obtain the key subgraph of the function call graph.

[0024] In step S2, the feature extraction model based on the sequence-to-sequence mechanism includes a graph attention network GAT, a first leaky linear rectifier function layer, i.e., a first LeakyRELU layer, a first fully connected layer, a second leaky linear rectifier function layer, i.e., a second LeakyRELU layer, a sequence-to-sequence model, and a second fully connected layer, such as Figure 3 : Graph Attention Network (GAT): classifies the attribute function call graph and obtains the attention weights; The first LeakyRELU layer: The node embedding set containing neighbor features of N nodes is calculated by the input attention weights ; The first fully connected layer: The input attribute function calls the current attribute node feature embedding of the N nodes of the graph to obtain the node embedding set The current attribute node feature embedding set of N nodes with the same dimension ; The second LeakyRELU layer: embedding a node set containing neighbor features of the input N nodes and the current attribute node feature embedding set of N nodes The final node feature set of N nodes is obtained by splicing them respectively ; Sequence-to-sequence model: extract global features from the final node feature set of the input N nodes, obtain nodes with attention weights and output them to the key subgraph construction module, generate a global graph vector, and output it to the second fully connected layer; like Figure 5 The sequence-to-sequence model includes a normalized exponential function layer, namely a softmax layer, a weighted average module, a concatenation layer, and a long short-term memory network LSTM.

[0025] Softmax layer: The final node feature in the input final node feature set and the query vector at time step t=0,1,2,...,T , calculate the attention weight of the node ; Weighted average module: Generates the full graph information aggregated from the node features at the current time step ; Concatenation layer: concatenates the query vector at time step t and aggregated full-image information Concatenate and Concat to get the feature vector generated by time step t , and output to the long short-term memory network LSTM; after time step T, the global graph vector is obtained Output to the second fully connected layer; Long Short-Term Memory Network LSTM: feature vector generated by input time step t Get the query vector at time step t+1 , and output to the softmax layer.

[0026] Key subgraph construction module: sort the importance of nodes with attention weights and generate a subgraph sequence sorted by importance as the key subgraph of the control flow graph; The second fully connected layer: calculates the classification probability of the input global graph vector and obtains the classification result.

[0027] The classification results obtained by the second fully connected layer can help verify the effect of the key subgraph of the interpreted control flow graph, because the classification results directly depend on the extracted key subgraph of the control flow graph. If the extracted key subgraph of the control flow graph is a feature with important influence, then these features can improve the classification performance. Therefore, the accuracy of the classification results can be used as an indicator of whether the key subgraph is effective.

[0028] In step S2, the second LeakyRELU layer adds the neighbor features of each node to the current attribute node feature to obtain the final node feature ,in, is the weight of the first fully connected layer, is the current attribute node feature, is the attention weight, is the weight matrix of the kth attention head among the K attention heads in the graph attention network model, is the input feature of the neighbor node. The final node feature set is obtained from the final node feature In the sequence-to-sequence model, the generated attention weights After sorting the nodes, the nodes with the highest attention weight values ​​are the most critical functions. High weights mean that the features of these nodes have a greater impact on the classification results to help explain the classification results of malicious code. The global graph vector is generated by looping from 0, 1, 2, ..., T in the sequence-to-sequence model at time step t. The global graph vector is further input into the second fully connected layer to calculate the classification probability and obtain the classification result. The cross entropy loss function is then used to evaluate the difference between the predicted result and the actual label. The feature extraction model based on the sequence-to-sequence mechanism optimized by the meta-learning framework can quickly adapt to different tasks, significantly improve the generalization ability of feature aggregation and updating, identify the key nodes that have the greatest impact on the classification results of the attribute function call graph, and then obtain the key subgraph of the function call graph, which can improve adaptability and efficiency and ensure flexibility and accuracy when processing different tasks.

[0029] In step S2, meta-learning is used to train the feature extraction model based on the sequence-to-sequence mechanism, specifically, S21, randomly sample N categories from the attribute function call graph, each category contains K support set samples and several query set samples; S22. On the support set, the base learner starts with the initial global meta-parameters θ provided by the meta-learner and optimizes the task-specific parameters , where α is the base learner learning rate, is the loss gradient of the support set with respect to the initialization parameter θ, is the loss function on the support set, A feature extraction model based on sequence-to-sequence mechanism is adopted for the base learner; S23. On the query set, the meta-learner evaluates the updated model performance of the base learner and optimizes the global meta-parameters through the loss of the query set: , where β is the meta-learner learning rate, is the loss gradient of the query set with respect to the global meta-parameter θ, is the loss function on the query set, and updates the global meta-parameter θ, completing the training after reaching the set number of training times.

[0030] Through steps S21-S23, the training efficiency can be improved, the model can quickly adapt to new tasks, and the adaptability and accuracy of the model to new tasks can be improved.

[0031] S3. Parse the binary file of the malicious code through the disassembly tool to obtain the assembly code, build the calling relationship between functions, generate the control flow graph CFG, and extract the semantic and structural features from the control flow graph CFG to obtain the attribute control flow graph.

[0032] In step S3, the sample assembly file is read and parsed into instructions. Each instruction includes information such as address, opcode and operand. Regular expressions and specific grammar rules are then used to effectively parse the instruction content in the assembly file. Basic blocks are constructed according to the instruction flow in the assembly file, and the basic blocks are connected to form a complete control flow graph. The semantic embedding of each node can be generated by a pre-trained language model such as BERT to obtain the attribute control flow graph ACFG.

[0033] S4. Construct a graph-structure-based gene feature extraction model, use meta-learning to optimize the graph-structure-based gene feature extraction model, obtain an optimized graph-structure-based gene feature extraction model, and use the optimized graph-structure-based gene feature extraction model on the attribute control flow graph generated in step S3 to obtain the key subgraph of the control flow graph.

[0034] In step S4, the graph-based gene feature extraction model includes a graph attention network model classifier, a control flow graph interpreter, i.e., a CFG interpreter, and a key subgraph generation module, such as Figure 4 : Graph attention network model classifier: The node embedding generation component generates node embeddings for the input attribute control flow graph CFG, and the classification component predicts the category of each attribute control flow graph as the class label, and outputs the node embedding and class label to the CFG interpreter; CFG interpreter: includes initial learning module and interpretation module, Initial learning module: The node scoring component calculates the node score from the node embedding, multiplies the node embedding and the node score to get the weighted embedding, and uses the weighted embedding to generate the classification probability through the classification component to obtain the classification result of each node; Explanation module: According to the node scores and the actual number of nodes in the attribute control flow graph, the attribute control flow graph is pruned step by step multiple times. After gradually removing the set number of nodes with the lowest scores, multiple subgraphs are obtained from the remaining nodes each time, and the most important subgraph is used as the key subgraph of the control flow graph. Specifically: S41. Obtain the actual number of nodes in the attribute control flow graph obtained in step S3 , initialize the ordered node set Vordered used to store nodes sorted by importance to an empty set, initialize the subgraph set subgraphs used to store the subgraph adjacency matrix of the remaining nodes after each iteration to the attribute control flow graph obtained in step S3, and store the indexes of all nodes of the attribute control flow graph in the variable all_node_indices to track the nodes that have not been pruned; S42. According to the set step size, calculate the number of nodes Nstep that need to be pruned in each iteration: ; S43. According to the node scores obtained in the initial learning module, the Nstep nodes with the lowest scores are sequentially added to the ordered node set Vordered, the corresponding indexes of the Nstep nodes with the lowest scores are removed from the variable all_node_indices, and the subgraph set subgraphs is updated: all the incoming and outgoing edges of the Nstep nodes with the lowest scores are removed, and the subgraph adjacency matrix of the remaining nodes is updated and saved as the current subgraph; the above steps are repeated until all the indexes of the nodes in the variable all_node_indices are removed; S44. Reverse the order of nodes in the ordered node set Vordered so that the first node is the most important node for the classification task and the last node is the least important node; at the same time, reverse the order of subgraphs in the subgraph set subgraphs, and use the first subgraph, which is the most important subgraph, as the key subgraph of the control flow graph.

[0035] In step S44, after the least important node is removed in each iteration, a new subgraph is generated to gradually reduce the size of the attribute control flow graph. After iterative pruning, a smaller subgraph will be obtained and placed in the subgraph set subgraphs. And so on. Each time, a gradually smaller subgraph will be added to it. Since the node with the lowest score is removed each time, the more important subgraphs are at the end. After the reversal, the first one is the most important subgraph.

[0036] In step S4, the node representation is adjusted by the node score through the initial learning module, and the model can give priority to the nodes that have a greater impact on the classification, thereby reducing the interference of irrelevant or unimportant nodes, and ultimately making the classification effect more accurate and robust. The process of using meta-learning to optimize the graph-based gene feature extraction model is the same as steps S21-S23. Combined with the optimization of the meta-learning framework, it can improve the adaptability to different tasks and improve the training efficiency.

[0037] S5. Using the key subgraph of the function call graph obtained in step S3 and the key subgraph of the control flow graph obtained in step S4, a template-based prompt word automatic generation technology is used to obtain a fine-tuning corpus, and the large language model is fine-tuned to obtain a fine-tuned large language model. The fine-tuned large language model is used to perform implicit association mining of malicious code gene information.

[0038] S51. Generate prompt words using template-based prompt word automatic generation technology, use the attribute function call graph obtained in step S1 and the attribute control flow graph obtained in step S3 as input data D, use the key subgraph of the function call graph obtained in step S2 and the key subgraph of the control flow graph obtained in step S4 as target labels, and construct a fine-tuning corpus.

[0039] In step S51, a prompt word is generated, specifically, by designing a prompt word template , where P is a predefined pattern, and N prompt words {t1, t2, ..., t i ,...,t N}.

[0040] S52: fine-tune the large language model using the fine-tuning method DoRA according to the generated fine-tuning corpus. Specifically, during the fine-tuning process, the fine-tuning corpus ,in, is the generated i-th prompt word, For the i-th target label, use the optimization objective function: , where θ is the model parameter of the large language model Model; the model parameter θ of the large language model is continuously updated through back propagation until the set number of fine-tuning times is reached.

[0041] In step S5, the large language model is fine-tuned according to the automatically generated prompt words to accurately mine the implicit associations of malicious code, improve the performance of the model in malicious code detection and behavior analysis, and improve the ability to identify and process new malicious code. The fine-tuning method DoRA enhances the representation ability of the model in specific domain tasks to improve its understanding of implicit associations and complex semantics, so that the model can better adapt to specific domain tasks and significantly improve the responsiveness to task requirements and the effect of implicit association mining. The fine-tuned large language model can be provided by the user with a graph representation of malicious code to obtain the corresponding key subgraph.

[0042] This meta-learning-based method for mining implicit associations of malicious code genetic information can accurately mine implicit associations of malicious code genetic information, significantly improve the accuracy and efficiency of malicious code analysis, and provide innovative technical support and application directions for the field of malicious code detection and security protection.

[0043] This meta-learning-based method for mining implicit associations of malicious code gene information first generates a function call graph FCG and a control flow graph CFG through a disassembly tool, and then obtains an attribute function call graph and an attribute control flow graph. The attribute function call graph is classified using a graph attention network, and the genetic features of malicious code are extracted to obtain the key subgraphs of the function call graph. The attribute control flow graph is identified through the Sequence-to-Sequence mechanism under the meta-learning framework, the node scoring component and the embedding generation component are optimized, and the control flow graph is gradually pruned to generate the key subgraphs of the control flow graph. Finally, by automatically generating prompt words and fine-tuning the large language model, accurate mining of implicit associations in malicious code and recognition of behavioral patterns are achieved. This method has the following advantages: by combining the semantic and structural information of the function call graph FCG and the control flow graph CFG, the malicious code features are mined at multiple levels to achieve a more comprehensive and accurate analysis; it can adapt quickly: based on the key node identification and subgraph generation mechanism of the meta-learning framework, it can quickly adapt to different types of malicious code tasks without complex adjustments for each task; it can classify efficiently: using graph neural networks to classify malicious code, from feature extraction to behavior pattern analysis, it has high computational efficiency and prediction accuracy; strong scalability: it can adapt to new malicious code detection needs by adjusting model parameters or fine-tuning pre-trained large models, and supports implicit association mining of large-scale malicious code samples.

[0044] This meta-learning-based method for mining hidden associations of malicious code gene information uses the graph attention network GAT to obtain the representation of the malicious code graph structure data, and further adopts the meta-learning paradigm to jointly obtain the feature representation of the attribute control flow graph and attribute function call graph of the malicious code to train the family classifier of the malicious code (to achieve malicious code attribution analysis based on graph features), and uses the graph interpreter to mine the key nodes of the attribute control flow graph and attribute function call graph of the malicious code by evaluating the importance of the nodes. The text generation capability based on templates and large language models is used to batch build the malicious code hidden association mining corpus according to the above key subgraph mining results. Finally, the fine-tuning method DoRA is used to significantly improve the performance of the large language model in the task of mining hidden associations of malicious code, achieving an accuracy rate of 93.53% for hidden association mining.

[0045] This meta-learning-based method for mining hidden associations of malicious code gene information extracts features from the graph structure of malicious code through the graph attention network GAT; it uses the meta-learning framework to combine control flow graphs and function call graphs to mine key subgraphs and classify families. By combining graph neural networks, meta-learning, and large language model fine-tuning technology, it can achieve accurate mining of hidden associations in malicious code, with efficient feature extraction capabilities and high mining accuracy.

[0046] The present invention can accurately extract the genetic features of malicious code. Through the genetic feature extraction model based on sequence-to-sequence mechanism and the genetic feature extraction model based on graph structure, it is possible to respectively analyze the attribute function call graph and the attribute control flow graph at multiple levels, integrate the features extracted from the attribute function call graph and the attribute control flow graph into the genetic information of the malicious code, and more accurately represent the genetic features of the malicious code, thereby improving the effects of classification, detection and behavior analysis. And by using disassembly tools and graph neural network GNN, the structural relationship between malicious codes is fully analyzed, and the behavior pattern of malicious codes is deeply mined from semantic and topological characteristics, greatly improving the accuracy and comprehensiveness of feature extraction.

[0047] This meta-learning-based method for mining implicit associations of malicious code gene information can deeply and accurately mine implicit association features between malicious codes through template-based prompt word automatic generation technology and meta-learning-based fine-tuning methods. Using the fine-tuned large language model, it can effectively build accurate associations of malicious code behavior patterns, provide a reliable basis for malicious code detection and family tracing in complex scenarios, and greatly improve the accuracy and comprehensiveness of implicit association mining.

[0048] In this meta-learning-based method for mining the hidden association of malicious code gene information, the malicious code gene information is a characteristic attribute set extracted from malware, which is used to identify and classify malware. Hidden associations are manifested as structural patterns of key subgraphs in function call graphs or control flow graphs. Key subgraphs are explicit carriers of hidden associations, and in the joint analysis of function call graphs and control flow graphs, they together provide strong support for understanding and detecting malicious code. The method of the present invention has the advantages of high-precision mining of hidden associations of malicious code gene information, fast model adaptability, strong graph structure analysis capabilities, and good scalability, and can significantly improve the efficiency and accuracy of malicious code analysis and classification. It can realize the mining of hidden associations of malicious code gene information, the revelation of dynamic behavior patterns, and the deep mining of malicious code family associations. The present invention can realize efficient and accurate classification and analysis of malicious code, and provides intelligent threat detection, resource optimization management, and hidden association mining capabilities for the field of network security.

[0049] This meta-learning-based method for mining implicit associations of malicious code gene information is based on a gene feature extraction model based on a sequence-to-sequence mechanism. It can quickly identify key nodes in the attribute function call graph that affect the classification results. It uses a subgraph pruning method based on node scoring and embedding generation to dynamically optimize the importance ranking, thereby greatly improving the efficiency of mining implicit associations of malicious code families in multi-task scenarios.

[0050] This meta-learning-based method for mining implicit associations of malicious code gene information combines the semantic features and graph structure features of the attribute control flow graph. Through the classification task of the graph attention network, it can effectively improve the adaptability of the model. Even in a complex and changeable code environment, it can still maintain a high classification performance and has the robustness to accurately classify multiple malware families.

[0051] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A method for mining implicit associations of malicious code gene information based on meta-learning, characterized by: The following steps are included: S1. Use a disassembly tool to identify and mark functions in the malicious code, generate a function call graph FCG, and use the generated function call graph to perform feature extraction and preprocessing to obtain an attribute function call graph; S2, constructing a gene feature extraction model based on a sequence-to-sequence mechanism, using meta-learning to train the feature extraction model based on the sequence-to-sequence mechanism, and obtaining a trained feature extraction model based on the sequence-to-sequence mechanism, and obtaining a key subgraph of the function call graph by the attribute function call graph generated by step S1 through the trained feature extraction model based on the sequence-to-sequence mechanism; S3. Parse the binary file of the malicious code through a disassembly tool to obtain the assembly code, build the calling relationship between functions, generate a control flow graph CFG, and extract semantic and structural features from the control flow graph CFG to obtain an attribute control flow graph; S4, constructing a graph-structure-based gene feature extraction model, optimizing the graph-structure-based gene feature extraction model using meta-learning, obtaining an optimized graph-structure-based gene feature extraction model, and using the optimized graph-structure-based gene feature extraction model on the attribute control flow graph generated in step S3 to obtain a key subgraph of the control flow graph; S5. Using the key subgraph of the function call graph obtained in step S3 and the key subgraph of the control flow graph obtained in step S4, a template-based prompt word automatic generation technology is used to obtain a fine-tuning corpus, and the large language model is fine-tuned to obtain a fine-tuned large language model. The fine-tuned large language model is used to perform implicit association mining of malicious code gene information.

2. The method for mining hidden associations of malicious code gene information based on meta-learning as claimed in claim 1, characterized in that: In step S2, the feature extraction model based on the sequence-to-sequence mechanism includes a graph attention network GAT, a first leaky linear rectifier function layer, i.e., a first LeakyRELU layer, a first fully connected layer, a second leaky linear rectifier function layer, i.e., a second LeakyRELU layer, a sequence-to-sequence model, and a second fully connected layer. Graph Attention Network (GAT): classifies the attribute function call graph and obtains the attention weights; The first LeakyRELU layer: The node embedding set containing neighbor features of N nodes is calculated by the input attention weight; The first fully connected layer: The current attribute node feature embeddings of the N nodes of the graph are called by the input attribute function to obtain the current attribute node feature embedding set of N nodes that is consistent with the dimension of the node embedding set; The second LeakyRELU layer: concatenates the node embedding set containing neighbor features and the current attribute node feature embedding set to obtain the final node feature set of N nodes; Sequence-to-sequence model: extract global features from the final node feature set of the input N nodes, obtain nodes with attention weights and output them to the key subgraph construction module, generate a global graph vector, and output it to the second fully connected layer; Key subgraph construction module: sort the importance of nodes with attention weights and generate a subgraph sequence sorted by importance as the key subgraph of the control flow graph; The second fully connected layer: calculates the classification probability of the input global graph vector and obtains the classification result.

3. The method for mining hidden associations of malicious code gene information based on meta-learning as claimed in claim 2, characterized in that: The sequence-to-sequence model includes a normalized exponential function layer, namely a softmax layer, a weighted average module, a concatenation layer, and a long short-term memory network LSTM. Softmax layer: The final node feature in the input final node feature set and the query vector at time step t=0,1,2,...,T , calculate the attention weight of the node ; Weighted average module: Generates the full graph information aggregated from the node features at the current time step ; Concatenation layer: concatenates the query vector at time step t and aggregated full-image information Concatenate and Concat to get the feature vector generated by time step t , and output to the long short-term memory network LSTM; after time step T, the global graph vector is obtained Output to the second fully connected layer; Long Short-Term Memory Network LSTM: feature vector generated by input time step t Get the query vector at time step t+1 , and output to the softmax layer.

4. The method for mining hidden associations of malicious code gene information based on meta-learning as claimed in claim 1, characterized in that: In step S2, meta-learning is used to train the feature extraction model based on the sequence-to-sequence mechanism, specifically, S21, randomly sample N categories from the attribute function call graph, each category contains K support set samples and several query set samples; S22. On the support set, the base learner starts with the initial global meta-parameters θ provided by the meta-learner and optimizes the task-specific parameters , where α is the base learner learning rate, is the loss gradient of the support set with respect to the initialization parameter θ, is the loss function on the support set, A feature extraction model based on sequence-to-sequence mechanism is adopted for the base learner; S23. On the query set, the meta-learner evaluates the updated model performance of the base learner and optimizes the global meta-parameters through the loss of the query set: , where β is the meta-learner learning rate, is the loss gradient of the query set with respect to the global meta-parameter θ, is the loss function on the query set, and updates the global meta-parameter θ, completing the training after reaching the set number of training times.

5. The method for mining hidden associations of malicious code gene information based on meta-learning according to any one of claims 1 to 4, characterized in that: In step S4, the graph-based gene feature extraction model includes a graph attention network model classifier, a control flow graph interpreter (CFG interpreter) and a key subgraph generation module. Graph attention network model classifier: The node embedding generation component generates node embeddings for the input attribute control flow graph CFG, and the classification component predicts the category of each attribute control flow graph as the class label, and outputs the node embedding and class label to the CFG interpreter; CFG interpreter: includes initial learning module and interpretation module, Initial learning module: The node scoring component calculates the node score from the node embedding, multiplies the node embedding and the node score to get the weighted embedding, and uses the weighted embedding to generate the classification probability through the classification component to obtain the classification result of each node; Explanation module: According to the node scores and the actual number of nodes in the attribute control flow graph, the attribute control flow graph is pruned step by step for multiple times. After gradually removing a set number of nodes with the lowest scores, multiple subgraphs are obtained from the remaining nodes each time, and the most important subgraph is used as the key subgraph of the control flow graph.

6. The method for mining hidden associations of malicious code gene information based on meta-learning as claimed in claim 5, characterized in that: In the interpretation module, the attribute control flow graph is pruned step by step multiple times according to the node scores and the actual number of nodes in the attribute control flow graph. After gradually removing the set number of nodes with the lowest scores, multiple subgraphs are obtained from the remaining nodes each time. The most important subgraph is used as the key subgraph of the control flow graph, specifically, S41. Obtain the actual number of nodes in the attribute control flow graph obtained in step S3 , initialize the ordered node set Vordered used to store nodes sorted by importance to an empty set, initialize the subgraph set subgraphs used to store the subgraph adjacency matrix of the remaining nodes after each iteration to the attribute control flow graph obtained in step S3, and store the indexes of all nodes of the attribute control flow graph in the variable all_node_indices to track the nodes that have not been pruned; S42. According to the set step size, calculate the number of nodes Nstep that need to be pruned in each iteration: ； S43. According to the node scores obtained in the initial learning module, the Nstep nodes with the lowest scores are sequentially added to the ordered node set Vordered, the corresponding indexes of the Nstep nodes with the lowest scores are removed from the variable all_node_indices, and the subgraph set subgraphs is updated: all the incoming and outgoing edges of the Nstep nodes with the lowest scores are removed, and the subgraph adjacency matrix of the remaining nodes is updated and saved as the current subgraph; the above steps are repeated until all the indexes of the nodes in the variable all_node_indices are removed; S44. Reverse the order of nodes in the ordered node set Vordered so that the first node is the most important node for the classification task and the last node is the least important node; at the same time, reverse the order of subgraphs in the subgraph set subgraphs, and use the first subgraph, which is the most important subgraph, as the key subgraph of the control flow graph.

7. The method for mining hidden associations of malicious code gene information based on meta-learning according to any one of claims 1 to 4, characterized in that: Step S5, specifically, S51, generate prompt words based on the template-based prompt word automatic generation technology, use the attribute function call graph obtained in step S1 and the attribute control flow graph obtained in step S3 as input data D, use the key subgraph of the function call graph obtained in step S2 and the key subgraph of the control flow graph obtained in step S4 as target labels, and construct a fine-tuning corpus; S52. Based on the generated fine-tuning corpus, use the fine-tuning method DoRA to fine-tune the large language model.

8. The method for mining hidden associations of malicious code gene information based on meta-learning as claimed in claim 7, characterized in that: In step S51, a prompt word is generated, specifically, by designing a prompt word template , where P is a predefined pattern, and N prompt words {t1, t2, ..., t i ,...,t N }.

9. The method for mining hidden associations of malicious code gene information based on meta-learning as claimed in claim 7, characterized in that: Step S52, specifically, during the fine-tuning process, fine-tune the corpus ,in, is the i-th prompt word generated, For the i-th target label, use the optimization objective function: , where θ is the model parameter of the large language model Model; the model parameter θ of the large language model is continuously updated through back propagation until the set number of fine-tuning times is reached.

Images