Adversarial sample generation method and device, equipment and medium

Abstract

The invention discloses an adversarial sample generation method and device, equipment and a medium, and relates to the field of machine learning, and the method comprises the steps: determining the fitness of each executable file in a current population based on a file classification model, determining a target function retention operation through employing a return value corresponding to each function retention operation in a current Q table, and obtaining a target function retention operation; performing genetic manipulation on executable files in the current population in combination with the fitness to obtain a new current population; and determining an escape sample from the new current population based on the file classification model to obtain a current escape rate, if the current escape rate is smaller than a threshold value, updating the current Q table and returning to the step of determining the fitness of the executable file, and if the current escape rate is not smaller than the threshold value, taking the current population as an adversarial sample to train the file classification model. According to the method, the performability of the executable file and the consistency of the original function are ensured through the function retention operation, the generation efficiency of the adversarial sample is improved in combination with the genetic algorithm and reinforcement learning, and the probability of finding the optimal solution is increased.

Description

Technical Field

[0001] The present invention relates to the field of machine learning, and in particular to a method, apparatus, device, and medium for generating adversarial samples. Background Art

[0002] With the rapid development and widespread use of the internet, the number of malicious files has increased dramatically, particularly Portable Executable (PE) files on the Windows platform. Furthermore, the development of artificial intelligence (AI) has greatly enhanced the capabilities of malicious files in terms of evasion, propagation, survival, covert communication, and precision attacks. Therefore, training existing file classification models with adversarial examples of malicious files can help improve their accuracy. However, unlike image adversarial examples, malicious file adversarial examples not only need to evade file classification models to escape, but also must ensure executable functionality and consistency with their original functionality.

[0003] Currently, many methods for generating malicious file adversarial samples have a series of limitations. Since most malicious file detection engines are closed source, generating malicious file adversarial samples based on black-box methods is more practical. However, generating malicious file adversarial samples based on black-box methods has the following disadvantages: (1) The convergence speed of generating malicious file adversarial samples is slow, resulting in a long time and low efficiency in generating adversarial samples; (2) A sandbox is required to ensure the executableness of the adversarial samples and the consistency of the original functions; (3) It is easy to fall into local optimal solutions, resulting in a low escape rate. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a method, apparatus, device, and medium for generating adversarial examples. These methods can ensure the executable file's executability and consistency with the original functionality through function-preserving operations, and combine genetic algorithms and reinforcement learning to improve the efficiency of generating adversarial examples and increase the probability of finding the optimal solution. The specific solution is as follows:

[0005] In a first aspect, the present application provides a method for generating adversarial samples, comprising:

[0006] Determine the classification probability of each executable file in the current population based on the file classification model to obtain the corresponding fitness, and use the reward values ​​corresponding to several function-preserving operations in the current Q table to determine the target function-preserving operation;

[0007] Performing a genetic operation on the executable files in the current population based on the fitness using the target function-preserving operation to obtain a new current population; wherein the function-preserving operation is used to modify the features of the executable files while preserving the original functions of the executable files;

[0008] Based on the file classification model, escape samples are determined from the new current population to obtain a current escape rate. If the current escape rate is less than a preset threshold, the current Q table is updated and the process jumps to the step of determining the classification probability of each executable file in the current population based on the file classification model. If the current escape rate is not less than the preset threshold, the current population is used as an adversarial sample to train the file classification model. The escape sample is an executable file whose actual file type is inconsistent with the predicted file type of the file classification model.

[0009] Optionally, before determining the classification probability of each executable file in the current population based on the file classification model, the method further includes:

[0010] Allocating at least one corresponding function-reserving operation to each executable file in the original population based on the plurality of function-reserving operations;

[0011] The at least one function-reserving operation is used to modify the features of the corresponding executable file while retaining the original function of the corresponding executable file, so as to initialize the original population, and the initialized population is determined as the current population.

[0012] Optionally, the utilizing the target function retention operation and performing a genetic operation on the executable files in the current population based on the fitness to obtain a new current population includes:

[0013] determining a first group of executable files and a second group of executable files from the current population based on the fitness;

[0014] The target function-retaining operation is used to perform a genetic operation on the second group of executable files, and a new current population is determined based on the first group of executable files and the second group of executable files after the genetic operation.

[0015] Optionally, determining the first group of executable files and the second group of executable files from the current population based on the fitness includes:

[0016] Determining, from the current population according to a preset retention ratio, a number of executable files having the smallest difference between the fitness and a preset cutoff value, to obtain a first group of executable files;

[0017] Determining, from the current population, a number of executable files having the largest difference between the fitness and a preset cutoff value according to a preset elimination ratio, to obtain a third group of executable files;

[0018] Remaining executable files other than the first group of executable files and the third group of executable files are determined from the current population to obtain a second group of executable files.

[0019] Optionally, performing a genetic operation on the second group of executable files using the target function retention operation includes:

[0020] determining a current adaptive probability based on the fitness corresponding to each executable file in the second group of executable files;

[0021] The target function preservation operation is utilized and a crossover operation and / or a mutation operation is performed on the second set of executable files based on the current adaptive probability.

[0022] Optionally, determining escape samples from the new current population based on the file classification model to obtain a current escape rate includes:

[0023] Determining, based on the file classification model, predicted file types corresponding to the respective executable files in the new current population, and determining escape samples from the new current population based on consistency between the predicted file types and the actual file types;

[0024] A current escape rate corresponding to the new current population is determined based on the total number of samples of the escape samples.

[0025] Optionally, determining the target function-reserving operation by using the reward values ​​corresponding to the plurality of function-reserving operations in the current Q table includes:

[0026] Determining a target function-retained operation from the plurality of function-retained operations based on the respective selection probabilities corresponding to the plurality of function-retained operations in the current operation selection table; wherein the respective selection probabilities corresponding to the plurality of function-retained operations in the current operation selection table are probabilities determined based on the respective reward values ​​corresponding to the plurality of function-retained operations in the current Q table;

[0027] Accordingly, after updating the current Q table, the method further includes:

[0028] The current operation selection table is updated based on the updated current Q table.

[0029] In a second aspect, the present application provides an adversarial sample generation device, comprising:

[0030] A classification module is used to determine the classification probability of each executable file in the current population based on the file classification model to obtain the corresponding fitness, and to determine the target function-preserving operation using the reward values ​​corresponding to the multiple function-preserving operations in the current Q-table;

[0031] a genetic module, configured to perform a genetic operation on the executable files in the current population using the target function-preserving operation and based on the fitness, so as to obtain a new current population; wherein the function-preserving operation is configured to modify the features of the executable files while preserving the original functions of the executable files;

[0032] An adversarial sample determination module is used to determine escape samples from the new current population based on the file classification model to obtain a current escape rate. If the current escape rate is less than a preset threshold, the current Q table is updated and the process is skipped to the step of determining the classification probability of each executable file in the current population based on the file classification model. If the current escape rate is not less than the preset threshold, the current population is used as an adversarial sample to train the file classification model. The escape sample is an executable file whose actual file type is inconsistent with the file type predicted by the file classification model.

[0033] In a third aspect, the present application provides an electronic device, comprising:

[0034] Memory, used to store computer programs;

[0035] A processor is used to execute the computer program to implement the aforementioned adversarial sample generation method.

[0036] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned adversarial sample generation method when executed by a processor.

[0037] In the present application, the classification probability of each executable file in the current population is determined based on the file classification model to obtain the corresponding fitness, and the target function retention operation is determined using the reward values ​​corresponding to several function retention operations in the current Q table; the executable files in the current population are genetically operated using the target function retention operation and based on the fitness to obtain a new current population; wherein, the function retention operation is used to modify the characteristics of the executable file and retain the original function of the executable file; based on the file classification model, escape samples are determined from the new current population to obtain the current escape rate; if the current escape rate is less than a preset threshold, the current Q table is updated and the process jumps to the step of determining the classification probability of each executable file in the current population based on the file classification model; if the current escape rate is not less than the preset threshold, the current population is used as an adversarial sample to train the file classification model; the escape sample is an executable file whose actual file type is inconsistent with the predicted file type of the file classification model. As can be seen from the above, the present application modifies the static features of the executable file through the function-retention operation while retaining the original function of the executable file, thereby ensuring the executableness of the executable file after the feature modification and the consistency of the original function. In addition, in the process of generating adversarial samples, the present application determines the target function-retention operation through the reward values ​​corresponding to several function-retention operations in the Q table, so as to use the target function-retention operation and combine it with the fitness of the executable file to perform genetic operations on the executable files in the current population, thereby increasing the diversity of the executable files through genetic operations, increasing the probability of finding the global optimal solution, and improving the escape rate of the current population; at the same time, by continuously updating the Q table through reinforcement learning, the population can autonomously converge towards the direction of the global optimal solution, reducing the generation time of adversarial samples and improving the generation efficiency of adversarial samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0039] Figure 1 This is a flowchart of a method for generating adversarial samples disclosed in this application;

[0040] Figure 2 This is a flowchart of a specific adversarial sample generation method disclosed in this application;

[0041] Figure 3 This is a schematic diagram of the structure of an adversarial sample generation device disclosed in this application;

[0042] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0044] Currently, many methods for generating adversarial samples of malicious files have a series of limitations. Since most malicious file detection engines are closed source, generating adversarial samples of malicious files based on black-box methods is more practical. However, this method also has many problems. To this end, this application provides an adversarial sample generation method that ensures the executableness of executable files and the consistency of their original functions through function-preserving operations, and combines genetic algorithms and reinforcement learning to improve the efficiency of adversarial sample generation and increase the probability of finding the optimal solution.

[0045] See also Figure 1 As shown, the embodiment of the present application discloses a method for generating adversarial samples, including:

[0046] Step S11: Determine the classification probability of each executable file in the current population based on the file classification model to obtain the corresponding fitness, and determine the target function retention operation using the reward values ​​corresponding to the multiple function retention operations in the current Q table.

[0047] In this embodiment, before determining the classification probability of each executable file in the current population based on the file classification model, it is first necessary to assign at least one corresponding function-retention operation to each executable file in the original population based on a number of function-retention operations, and use the at least one function-retention operation to modify the features of the corresponding executable file while retaining the original function of the corresponding executable file, so as to initialize the original population, and determine the initialized population as the current population.

[0048] The function-preserving operation is used to modify the features of an executable file while retaining the original functionality of the executable file. The function-preserving operation is also known as a gene. Each executable file in the original population is assigned at least one corresponding function-preserving operation. That is, for each executable file in the original population, at least one function-preserving operation is selected from an operation selection table and added to the executable file's genome as a gene. This allows the static features of the executable file to be modified based on the genome while retaining the original functionality of the executable file, thereby initializing the original population. In this way, this embodiment uses the function-preserving operation to modify the static features of the executable file while retaining the original functionality of the executable file, thereby ensuring the consistency of the executable file's original functionality with the executable file's modified functionality. This improves efficiency compared to using a sandbox to ensure the consistency of the executable file's original functionality with the executable file's original functionality.

[0049] It should be noted that in order to enable the current population to autonomously converge toward the optimal solution, this embodiment utilizes an operation selection table and a Q-table used in reinforcement learning. The operation selection table includes several function-retaining operations and their corresponding selection probabilities. The selection probability is determined based on the reward values ​​corresponding to each of the several function-retaining operations in the current Q-table. For example, the current selection probability corresponding to a function-retaining operation is the ratio of the reward value corresponding to the function-retaining operation in the current Q-table to the sum of the reward values ​​corresponding to all function-retaining operations in the current Q-table. It is understood that in the initial stage, the reward values ​​of all function-retaining operations in the Q-table are zero, so that when the original population is initialized, all function-retaining operations in the operation selection table are assigned equal selection probabilities. As the Q-table is continuously updated, the reward values ​​in the Q-table change, and the selection probabilities corresponding to the several function-retaining operations in the operation selection table also change. The function-retaining operation with a high selection probability is determined as the target function-retaining operation for subsequent genetic manipulation of the executable file.

[0050] After initializing the original population to obtain the current population, a file classification model can be used to determine the classification probability of each executable file. The file classification model is used to score the input executable file to obtain a corresponding classification probability, namely the fitness. Based on the fitness, it can be determined whether the executable file is malicious or benign. The fitness can also be used in subsequent genetic operations. In this embodiment, MalConv (Malicious Convolutional Neural Network, a deep learning model for detecting adversarial malicious code) can be selected as the file classification model.

[0051] It should be noted that the fitness value of the executable file is [0, 1.0]. Taking the preset cutoff value of 0.5 as an example, if the fitness of the executable file is between [0, 0.5], the executable file is determined to be a malicious file. If the fitness of the executable file is between [0.5, 1.0], the executable file is determined to be a benign file.

[0052] Step S12: performing a genetic operation on the executable files in the current population based on the fitness using the target function-preserving operation to obtain a new current population; wherein the function-preserving operation is used to modify the features of the executable files and preserve the original functions of the executable files.

[0053] In this embodiment, after determining the fitness of each executable file in the current population based on the file classification model, a first group of executable files and a second group of executable files can be determined from the current population based on the fitness, and the second group of executable files can be genetically operated using the target function retention operation, and a new current population can be determined based on the first group of executable files and the second group of executable files after the genetic operation.

[0054] Specifically, the executable files in the current population can be divided into three groups according to the fitness of each executable file; among them, the first group of executable files is a number of executable files selected from the current population according to a preset retention ratio, and the difference between the fitness and the preset cutoff value is the smallest. Since the fitness of these executable files is close to the preset cutoff value, they are easier to be determined as escape samples, and therefore are retained; the third group of executable files is a number of executable files selected from the current population according to a preset elimination ratio, and the difference between the fitness and the preset cutoff value is the largest. Since the fitness of these executable files is far from the preset cutoff value, they are not easily determined as escape samples, and therefore are eliminated; the second group of executable files is the executable files remaining in the current population after removing the first and third groups of executable files, and is used for performing genetic operations to obtain richer and more diverse executable files.

[0055] Furthermore, for performing genetic operations on the second group of executable files using the target function retention operation, the current adaptive probability can be first determined based on the fitness corresponding to each executable file in the second group of executable files, and the target function retention operation can be used and based on the current adaptive probability, the second group of executable files can be subjected to crossover operations and / or mutation operations.

[0056] It is understood that after the crossover and / or mutation operations described above, the second set of executable files retains its original functionality but changes its characteristics, potentially causing the file classification model to classify the resulting executable files as benign files instead of malicious files, or vice versa. Furthermore, the first set of executable files and the second set of executable files after the genetic operation are merged to form a new current population, so that the new current population contains more executable files with fitness values ​​close to the preset cutoff value.

[0057] Step S13: determining escape samples from the new current population based on the file classification model to obtain a current escape rate; if the current escape rate is less than a preset threshold, updating the current Q table and jumping to the step of determining the classification probability of each executable file in the current population based on the file classification model; if the current escape rate is not less than the preset threshold, using the current population as an adversarial sample to train the file classification model; the escape sample is an executable file whose actual file type is inconsistent with the predicted file type of the file classification model.

[0058] In this embodiment, escape samples are first determined from the new current population based on the file classification model to obtain the current escape rate, where the escape sample refers to an executable file whose actual file type is a malicious file but is predicted to be a benign file by the file classification model, or an executable file whose actual file type is a benign file but is predicted to be a malicious file by the file classification model.

[0059] To calculate the current escape rate, a file classification model can be used to determine the predicted file type corresponding to each executable file in the new current population, and based on the consistency between the predicted file type and the actual file type, escape samples with inconsistent predicted file types and actual file types are determined from the new current population. The total number of escape samples is counted, and then the current escape rate is calculated based on the ratio of the total number of escape samples to the total number of executable files in the current population.

[0060] Furthermore, the current escape rate obtained above is compared with a preset threshold. If the current escape rate is lower than the preset threshold, it indicates that the number of escape samples in the current population needs to be increased, and therefore the current population needs to be further optimized. Specifically, the reward values ​​corresponding to the respective function retention operations are recalculated based on the Q-learning function to update the current Q table, and then the current operation selection table is updated based on the updated current Q table, and the process jumps to step S11 to determine the classification probability of each executable file in the current population based on the file classification model to continue optimizing the current population. If the current escape rate is not lower than the preset threshold, the current population can be directly used as an adversarial sample to train the model. In this way, this embodiment uses the current population whose current escape rate is not lower than the preset threshold as an adversarial sample for further training the file classification model, which can enable the file classification model to better identify and process malicious files, thereby improving the overall performance and robustness of the model.

[0061] It should be noted that the escape rate calculation can be performed in a black box case. If the escape rate reaches the preset threshold, the optimization of the current population will be terminated, thereby obtaining an adversarial sample. If the escape rate does not reach the preset threshold, the reinforcement learner is entered, and the Q learning function is used to update the current Q table. The selection probabilities corresponding to the several function-retention operations are determined according to the reward values ​​corresponding to the several function-retention operations in the updated current Q table, so as to update the current operation selection table for continuing to optimize the current population.

[0062] As can be seen from the above, the present application modifies the static features of the executable file through the function-retention operation while retaining the original function of the executable file, thereby ensuring the executableness of the executable file after the feature modification and the consistency of the original function. In addition, in the process of generating adversarial samples, the present application determines the target function-retention operation through the reward values ​​corresponding to several function-retention operations in the Q table, so as to use the target function-retention operation and combine it with the fitness of the executable file to perform genetic operations on the executable files in the current population, thereby increasing the diversity of the executable files through genetic operations, increasing the probability of finding the global optimal solution, and improving the escape rate of the current population; at the same time, by continuously updating the Q table through reinforcement learning, the population can autonomously converge towards the direction of the global optimal solution, reducing the generation time of adversarial samples and improving the generation efficiency of adversarial samples.

[0063] See also Figure 2 As shown, the adversarial sample generation method disclosed in this application is illustrated by taking the MalConv model as the file classification model, the fitness value of the executable file as [0, 1.0], the preset boundary value as 0.5, and 8 function retention operations as an example.

[0064] First, the Q-table and operation selection table are initialized. The reward value of each function-preserving operation in the initialized Q-table is 0, and the selection probability of each function-preserving operation in the initialized operation selection table is equal. Next, the population is initialized. Specifically, based on the eight function-preserving operations in the initialized operation selection table, at least one function-preserving operation is selected for each executable file in the original population. This function-preserving operation is then added as a gene to the corresponding executable file's genome. This gene modifies the executable file's static features while preserving the original functionality of the executable file, thereby initializing the original population. The initialized population is then determined as the current population.

[0065] After initializing the original population to obtain the current population, the current population is input into the MalConv model to use the MalConv model to determine the classification probability of each executable file in the current population to obtain the fitness of each executable file. Further, according to a preset retention ratio v, several executable files with the smallest difference between their fitness and a preset cutoff value of 0.5 are determined from the current population to obtain a first group of executable files, i.e., the fitness of the first group of executable files is close to the preset cutoff value; according to a preset elimination ratio w, several executable files with the largest difference between their fitness and the preset cutoff value of 0.5 are determined from the current population to obtain a third group of executable files, i.e., the fitness of the third group of executable files is far from the preset cutoff value, and the third group of executable files is eliminated; and the remaining executable files other than the first and third groups of executable files are determined from the current population to obtain a second group of executable files, i.e., the second group of executable files is the files in the current population that are between the first and third groups of executable files.

[0066] A current adaptive probability u is determined based on the fitness corresponding to each executable file in the second group of executable files; a function retention operation with the highest current selection probability in the operation selection table is used to retain the second group of executable files based on the current adaptive probability u, and the second group of executable files after the crossover operation and / or mutation operation is merged with the first group of executable files to obtain a new current population.

[0067] The new current population is input into the MalConv model for detection to obtain the current escape rate corresponding to the new current population. If the current escape rate is less than the preset threshold of 0.8, the current Q table is updated based on the Q-learning function, and the current operation selection table is updated based on the updated current Q table. The process then jumps back to the above step of using the MalConv model to determine the classification probability of each executable file in the current population. If the current escape rate is not less than the preset threshold of 0.8, the new current population is used as an adversarial sample, and the adversarial sample is used to optimize the training of the MalConv model.

[0068] As can be seen from the above, this embodiment uses the MalConv model as an example to illustrate the adversarial sample generation method disclosed in this application. By selecting at least one function-preserving operation from an operation selection table for each executable file and adding the function-preserving operation as a gene to the executable file's genome, the static features of the executable file are modified based on the genome while preserving the original functionality of the executable file. This improves efficiency compared to using a sandbox to ensure the executable and original functionality of the sample. Furthermore, during the adversarial sample generation process, this embodiment determines the target function-preserving operation based on the reward values ​​corresponding to the function-preserving operations in the Q table. This target function-preserving operation is then used in conjunction with the fitness of the executable files to perform genetic operations on the executable files in the current population. This genetic operation increases the diversity of the executable files, increases the probability of finding a global optimal solution, and improves the escape rate of the current population. Furthermore, by continuously updating the Q table through reinforcement learning, the population can autonomously converge toward the global optimal solution, reducing the time required to generate adversarial samples and improving the efficiency of adversarial sample generation.

[0069] See also Figure 3 As shown, the embodiment of the present application also discloses an adversarial sample generation device, including:

[0070] A classification module 11 is configured to determine the classification probability of each executable file in the current population based on the file classification model to obtain a corresponding fitness, and determine a target function-retention operation using the reward values ​​corresponding to the multiple function-retention operations in the current Q-table;

[0071] a genetic module 12, configured to perform a genetic operation on the executable files in the current population based on the fitness using the target function-preserving operation to obtain a new current population; wherein the function-preserving operation is configured to modify the features of the executable files while preserving the original functions of the executable files;

[0072] The adversarial sample determination module 13 is used to determine escape samples from the new current population based on the file classification model to obtain a current escape rate. If the current escape rate is less than a preset threshold, the current Q table is updated and the process jumps to the step of determining the classification probability of each executable file in the current population based on the file classification model. If the current escape rate is not less than the preset threshold, the current population is used as an adversarial sample to train the file classification model. The escape sample is an executable file whose actual file type is inconsistent with the predicted file type of the file classification model.

[0073] As can be seen from the above, the present application modifies the static features of the executable file through the function-retention operation while retaining the original function of the executable file, thereby ensuring the executableness of the executable file after the feature modification and the consistency of the original function. In addition, in the process of generating adversarial samples, the present application determines the target function-retention operation through the reward values ​​corresponding to several function-retention operations in the Q table, so as to use the target function-retention operation and combine it with the fitness of the executable file to perform genetic operations on the executable files in the current population, thereby increasing the diversity of the executable files through genetic operations, increasing the probability of finding the global optimal solution, and improving the escape rate of the current population; at the same time, by continuously updating the Q table through reinforcement learning, the population can autonomously converge towards the direction of the global optimal solution, reducing the generation time of adversarial samples and improving the generation efficiency of adversarial samples.

[0074] In some specific implementations, the adversarial sample generation device may further include:

[0075] an operation selection module, configured to assign at least one corresponding function-reserved operation to each executable file in the original population based on the plurality of function-reserved operations;

[0076] The population initialization module is used to utilize the at least one function retention operation to modify the characteristics of the corresponding executable file while retaining the original function of the corresponding executable file, so as to initialize the original population and determine the initialized population as the current population.

[0077] In some specific embodiments, the genetic module 12 may specifically include:

[0078] a file determination submodule, configured to determine a first group of executable files and a second group of executable files from the current population based on the fitness;

[0079] The population determination submodule is configured to perform a genetic operation on the second group of executable files using the target function retention operation, and determine a new current population based on the first group of executable files and the second group of executable files after the genetic operation.

[0080] In some specific implementations, the file determination submodule may specifically include:

[0081] a first file determining unit, configured to determine, from the current population, a plurality of executable files having the smallest difference between the fitness and a preset cutoff value according to a preset retention ratio, to obtain a first group of executable files;

[0082] a second file determining unit, configured to determine, from the current population, a number of executable files having the largest difference between the fitness and a preset cutoff value according to a preset elimination ratio, to obtain a third group of executable files;

[0083] The third file determining unit is configured to determine the remaining executable files except the first group of executable files and the third group of executable files from the current population to obtain a second group of executable files.

[0084] In some specific implementations, the population determination submodule may specifically include:

[0085] a probability determination unit, configured to determine a current adaptive probability based on the fitness corresponding to each executable file in the second group of executable files;

[0086] A genetic operation unit is configured to utilize the target function retention operation and perform a crossover operation and / or a mutation operation on the second group of executable files based on the current adaptive probability.

[0087] In some specific implementations, the adversarial sample determination module 13 may specifically include:

[0088] a sample determination unit, configured to determine, based on the file classification model, a predicted file type corresponding to each executable file in the new current population, and determine an escape sample from the new current population based on consistency between the predicted file type and the actual file type;

[0089] An escape rate determining unit is configured to determine a current escape rate corresponding to the new current population based on a total number of escape samples.

[0090] In some specific implementations, the classification module 11 may specifically include:

[0091] An operation determination unit is used to determine a target function retention operation from the several function retention operations based on the selection probabilities corresponding to the several function retention operations in the current operation selection table; wherein the selection probabilities corresponding to the several function retention operations in the current operation selection table are probabilities determined based on the reward values ​​corresponding to the several function retention operations in the current Q table.

[0092] Accordingly, the adversarial sample generation device may further include:

[0093] A selection table updating unit is configured to update the current operation selection table based on the updated current Q table.

[0094] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0095] Figure 4 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the adversarial example generation method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0096] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0097] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0098] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20. It can be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs that can be used to implement the adversarial sample generation method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs that can be used to perform other specific tasks.

[0099] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned method for generating adversarial examples. The specific steps of this method can be referred to the corresponding content disclosed in the aforementioned embodiments and will not be repeated here.

[0100] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0101] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0102] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0103] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0104] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for generating adversarial samples, characterized in that: include: Determine the classification probability of each executable file in the current population based on the file classification model to obtain the corresponding fitness, and determine the target function retention operation using the reward values ​​corresponding to several function retention operations in the current Q table; Performing genetic operations on the executable files in the current population based on the fitness using the target function-retaining operation to obtain a new current population; wherein the function-retaining operation is used to modify the features of the executable files and retain the original functions of the executable files; Based on the file classification model, escape samples are determined from the new current population to obtain a current escape rate. If the current escape rate is less than a preset threshold, the current Q table is updated and the process jumps to the step of determining the classification probability of each executable file in the current population based on the file classification model. If the current escape rate is not less than the preset threshold, the current population is used as an adversarial sample to train the file classification model. The escape sample is an executable file whose actual file type is inconsistent with the predicted file type of the file classification model.

2. The adversarial sample generation method according to claim 1, characterized in that: Before determining the classification probability of each executable file in the current population based on the file classification model, the method further includes: Allocating at least one corresponding function-reserving operation to each executable file in the original population based on the plurality of function-reserving operations; The at least one function retaining operation is used to modify the features of the corresponding executable file while retaining the original function of the corresponding executable file, so as to initialize the original population, and the initialized population is determined as the current population.

3. The adversarial sample generation method according to claim 1, characterized in that: The using the target function retention operation and performing a genetic operation on the executable files in the current population based on the fitness to obtain a new current population includes: determining a first group of executable files and a second group of executable files from the current population based on the fitness; The target function retention operation is used to perform a genetic operation on the second group of executable files, and a new current population is determined based on the first group of executable files and the second group of executable files after the genetic operation.

4. The adversarial sample generation method according to claim 3, characterized in that: The determining the first group of executable files and the second group of executable files from the current population based on the fitness comprises: Determining, from the current population, a number of executable files having the smallest difference between the fitness and a preset cutoff value according to a preset retention ratio, to obtain a first group of executable files; Determining, from the current population, a number of executable files having the largest difference between the fitness and a preset cutoff value according to a preset elimination ratio, to obtain a third group of executable files; Remaining executable files except the first group of executable files and the third group of executable files are determined from the current population to obtain a second group of executable files.

5. The adversarial sample generation method according to claim 3, characterized in that: The performing genetic operation on the second group of executable files by using the target function retention operation includes: Determining a current adaptive probability based on the fitness corresponding to each executable file in the second group of executable files; The target function preservation operation is utilized and a crossover operation and / or a mutation operation is performed on the second set of executable files based on the current adaptive probability.

6. The adversarial sample generation method according to claim 1, characterized in that: The step of determining the escape sample from the new current population based on the file classification model to obtain the current escape rate includes: Determine the predicted file types corresponding to the executable files in the new current population based on the file classification model, and determine the escape sample from the new current population according to the consistency between the predicted file type and the actual file type; A current escape rate corresponding to the new current population is determined based on the total number of samples of the escape samples.

7. The adversarial sample generation method according to any one of claims 1 to 6, characterized in that: The method of determining the target function-reserving operation by using the reward values ​​corresponding to the plurality of function-reserving operations in the current Q table includes: Based on the selection probabilities respectively corresponding to the several function-reserved operations in the current operation selection table, determining the target function-reserved operation from the several function-reserved operations; wherein the selection probabilities respectively corresponding to the several function-reserved operations in the current operation selection table are probabilities determined based on the reward values ​​respectively corresponding to the several function-reserved operations in the current Q table; Correspondingly, after updating the current Q table, the method further includes: The current operation selection table is updated based on the updated current Q table.

8. An adversarial sample generation device, characterized in that: include: A classification module, used to determine the classification probability of each executable file in the current population based on the file classification model to obtain the corresponding fitness, and determine the target function retention operation using the reward values ​​corresponding to the multiple function retention operations in the current Q table; A genetic module, used to perform a genetic operation on the executable files in the current population using the target function-retaining operation and based on the fitness, so as to obtain a new current population; wherein the function-retaining operation is used to modify the features of the executable files and retain the original functions of the executable files; An adversarial sample determination module is used to determine escape samples from the new current population based on the file classification model to obtain a current escape rate. If the current escape rate is less than a preset threshold, the current Q table is updated and the process is jumped to the step of determining the classification probability of each executable file in the current population based on the file classification model. If the current escape rate is not less than the preset threshold, the current population is used as an adversarial sample to train the file classification model. The escape sample is an executable file whose actual file type is inconsistent with the predicted file type of the file classification model.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the adversarial sample generation method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program; wherein, when the computer program is executed by a processor, the adversarial sample generation method according to any one of claims 1 to 7 is implemented.

Images