An adversarial sample generation method, device, equipment and medium

Abstract

The application discloses an adversarial sample generation method and device, equipment and medium, and relates to the field of machine learning, comprising: determining the fitness of each executable file in the current population based on a file classification model, determining a target function retention operation using the return value corresponding to each function retention operation in the current Q table, and performing genetic operations on the executable files in the current population based on the fitness to obtain a new current population; determining an escape sample from the new current population based on the file classification model to obtain a current escape rate, if the current escape rate is less than a threshold, updating the current Q table and returning to the step of determining the fitness of the executable file, if the current escape rate is not less than the threshold, taking the current population as an adversarial sample to train the file classification model. The application ensures the executability of the executable file and the consistency of the original function through the function retention operation, and improves the generation efficiency of the adversarial sample and increases the probability of finding the optimal solution by combining the genetic algorithm and the reinforcement learning.

Description

Technical Field

[0001] This invention relates to the field of machine learning, and in particular to a method, apparatus, device, and medium for generating adversarial examples. Background Technology

[0002] With the rapid development and widespread adoption of the internet, the number of malicious files has increased dramatically, especially portable executable (PE) files on the Windows platform. Furthermore, advancements in artificial intelligence (AI) have significantly enhanced the capabilities of malicious files in areas such as evasion, propagation, survival, covert communication, and precise attacks. Therefore, training existing file classification models with adversarial examples of malicious files can help improve their accuracy. However, unlike image adversarial examples, malicious file adversarial examples not only need to bypass file classification models to escape, but also need to ensure the executableness of the malicious file adversarial examples and the consistency of their original functions.

[0003] Currently, many methods for generating adversarial samples for malicious files have a series of limitations. Since most malicious file detection engines are closed-source, the method of generating adversarial samples for malicious files based on black-box methods is more practical. However, generating adversarial samples for malicious files based on black-box methods has the following disadvantages: (1) The convergence speed of generating adversarial samples for malicious files is slow, resulting in long generation time and low efficiency; (2) Sandboxes are required to ensure the executability of adversarial samples and the consistency of the original functions; (3) It is easy to get trapped in local optima, resulting in low escape rate. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a method, apparatus, device, and medium for generating adversarial examples, which can ensure the executability of executable files and the consistency of their original functions through function preservation operations, and improve the efficiency of adversarial example generation by combining genetic algorithms and reinforcement learning, thereby increasing the probability of finding the optimal solution. The specific scheme is as follows:

[0005] Firstly, this application provides a method for generating adversarial examples, including:

[0006] The classification probability of each executable file in the current population is determined based on the file classification model to obtain the corresponding fitness, and the target function retention operation is determined by using the reward values ​​corresponding to several function retention operations in the current Q table.

[0007] The target function preservation operation is used to perform genetic operations on the executable files in the current population based on the fitness to obtain a new current population; wherein, the function preservation operation is used to modify the characteristics of the executable files while preserving the original functions of the executable files;

[0008] Based on the file classification model, escape samples are determined from the new current population to obtain the current escape rate. If the current escape rate is less than a preset threshold, the current Q-table is updated and the process jumps to the step of determining the classification probability of each executable file in the current population based on the file classification model. If the current escape rate is not less than the preset threshold, the current population is used as adversarial samples to train the file classification model. The escape samples are executable files whose actual file type is inconsistent with the predicted file type of the file classification model.

[0009] Optionally, before determining the classification probability of each executable file in the current population based on the file classification model, the method further includes:

[0010] Based on the aforementioned function preservation operations, at least one corresponding function preservation operation is assigned to each executable file in the original population;

[0011] By utilizing the at least one function preservation operation, while preserving the original function of the corresponding executable file, the corresponding executable file is characterized to be modified in order to initialize the original population, and the initialized population is determined as the current population.

[0012] Optionally, the step of utilizing the target function retention operation and performing genetic operations on the executables in the current population based on the fitness to obtain a new current population includes:

[0013] Based on the fitness, a first set of executable files and a second set of executable files are determined from the current population;

[0014] Genetic operations are performed on the second group of executable files using the target function retention operation, and a new current population is determined based on the first group of executable files and the second group of executable files after the genetic operation.

[0015] Optionally, determining the first set of executable files and the second set of executable files from the current population based on the fitness includes:

[0016] Based on a preset retention ratio, a number of executable files with the smallest difference between the fitness and the preset threshold value are determined from the current population to obtain a first set of executable files;

[0017] Based on a preset elimination ratio, a number of executable files with the largest difference between their fitness and a preset threshold value are determined from the current population to obtain a third group of executable files;

[0018] The remaining executable files, excluding the first group of executable files and the third group of executable files, are determined from the current population to obtain the second group of executable files.

[0019] Optionally, the genetic operation performed on the second group of executable files using the target function preservation operation includes:

[0020] The current adaptive probability is determined based on the fitness of each executable file in the second group of executable files;

[0021] The target function is retained and crossover and / or mutation operations are performed on the second group of executables based on the current adaptive probability.

[0022] Optionally, determining escape samples from the new current population based on the file classification model to obtain the current escape rate includes:

[0023] Based on the file classification model, the predicted file type corresponding to each executable file in the new current population is determined, and escape samples are determined from the new current population based on the consistency between the predicted file type and the actual file type.

[0024] The current escape rate corresponding to the new current population is determined based on the total number of escaped samples.

[0025] Optionally, determining the target function retention operation using the reward values ​​corresponding to several function retention operations in the current Q table includes:

[0026] Based on the selection probabilities corresponding to the several function retention operations in the current operation selection table, a target function retention operation is determined from the several function retention operations; wherein, the selection probabilities corresponding to the several function retention operations in the current operation selection table are probabilities determined based on the reward values ​​corresponding to the several function retention operations in the current Q table;

[0027] Accordingly, after updating the current Q table, the process also includes:

[0028] The current operation selection table is updated based on the updated current Q table.

[0029] Secondly, this application provides an adversarial sample generation apparatus, comprising:

[0030] The classification module is used to determine the classification probability of each executable file in the current population based on the file classification model in order to obtain the corresponding fitness, and to determine the target function retention operation by using the reward values ​​corresponding to several function retention operations in the current Q table.

[0031] A genetic module is used to perform genetic operations on executable files in the current population based on the fitness and the target function preservation operation to obtain a new current population; wherein, the function preservation operation is used to modify the characteristics of the executable file while preserving the original function of the executable file;

[0032] The adversarial example determination module is used to determine escape samples from the new current population based on the file classification model to obtain the current escape rate. If the current escape rate is less than a preset threshold, the current Q-table is updated and the process jumps to the step of determining the classification probability of each executable file in the current population based on the file classification model. If the current escape rate is not less than the preset threshold, the current population is used as adversarial examples to train the file classification model. The escape samples are executable files whose actual file type is inconsistent with the predicted file type of the file classification model.

[0033] Thirdly, this application provides an electronic device, comprising:

[0034] Memory, used to store computer programs;

[0035] A processor is used to execute the computer program to implement the aforementioned adversarial example generation method.

[0036] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned adversarial sample generation method.

[0037] In this application, the classification probability of each executable file in the current population is determined based on a file classification model to obtain the corresponding fitness. A target function retention operation is determined using the reward values ​​corresponding to several function retention operations in the current Q-table. Genetic operations are then performed on the executable files in the current population based on the target function retention operation and the fitness to obtain a new current population. The function retention operation modifies the characteristics of the executable file while retaining its original function. Escape samples are determined from the new current population based on the file classification model to obtain the current escape rate. If the current escape rate is less than a preset threshold, the current Q-table is updated, and the process jumps to the step of determining the classification probability of each executable file in the current population based on the file classification model. If the current escape rate is not less than the preset threshold, the current population is used as an adversarial sample to train the file classification model. The escape sample is an executable file whose actual file type is inconsistent with the predicted file type of the file classification model. As shown above, this application modifies the static features of the executable file while preserving its original functionality through function-preserving operations, thus ensuring the consistency between the executable file's executability and its original functionality after feature modification. Furthermore, in the adversarial example generation process, this application determines the target function-preserving operation by using the reward values ​​corresponding to several function-preserving operations in the Q-table. This target function-preserving operation, combined with the executable file's fitness, is used to perform genetic operations on the executable files in the current population. This genetic operation increases the diversity of executable files, increases the probability of finding the global optimum, and improves the escape rate of the current population. Simultaneously, by continuously updating the Q-table through reinforcement learning, the population can autonomously converge towards the global optimum, reducing the adversarial example generation time and improving the efficiency of adversarial example generation. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0039] Figure 1 This is a flowchart of an adversarial sample generation method disclosed in this application;

[0040] Figure 2 This is a flowchart of a specific adversarial example generation method disclosed in this application;

[0041] Figure 3 This is a schematic diagram of the structure of an adversarial sample generation device disclosed in this application;

[0042] Figure 4 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0043] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0044] Current methods for generating adversarial examples of malicious files suffer from a number of limitations. Furthermore, since most malicious file detection engines are closed-source, generating adversarial examples based on black-box methods is more practical. However, this black-box approach also has several problems. To address these issues, this application provides an adversarial example generation method that ensures the executability of the executable file and the consistency of its original functionality through function preservation operations. It also combines genetic algorithms and reinforcement learning to improve the efficiency of adversarial example generation and increase the probability of finding the optimal solution.

[0045] See Figure 1 As shown in the figure, this application discloses an adversarial example generation method, including:

[0046] Step S11: Determine the classification probability of each executable file in the current population based on the file classification model to obtain the corresponding fitness, and determine the target function retention operation by using the reward values ​​corresponding to several function retention operations in the current Q table.

[0047] In this embodiment, before determining the classification probability of each executable file in the current population based on the file classification model, it is first necessary to assign at least one corresponding function preservation operation to each executable file in the original population based on several function preservation operations, and use at least one function preservation operation to modify the features of the corresponding executable file while preserving the original function of the corresponding executable file, so as to initialize the original population, and determine the initialized population as the current population.

[0048] In this implementation, the function-preserving operation modifies the characteristics of the executable file while retaining its original functionality. This function-preserving operation is essentially a gene. At least one function-preserving operation is assigned to each executable file in the original population. Specifically, for each executable file in the original population, at least one function-preserving operation is selected from the operation selection table and added as a gene to the executable file's genome. This allows the static characteristics of the executable file to be modified while preserving its original functionality, thereby initializing the original population. In this way, this embodiment modifies the static characteristics of the executable file while retaining its original functionality through the function-preserving operation, ensuring the consistency between the executable file's executability after feature modification and its original functionality. Compared to using a sandbox to ensure the consistency between executable file executability and its original functionality, this method improves efficiency.

[0049] It should be noted that, to enable the current population to autonomously converge towards the optimal solution, this embodiment uses an operation selection table and a Q-table from reinforcement learning. The operation selection table includes several function-preserving operations and their corresponding selection probabilities. These probabilities are determined based on the reward values ​​corresponding to the function-preserving operations in the current Q-table. For example, the current selection probability for a particular function-preserving operation is the ratio of the reward value corresponding to that operation in the current Q-table to the sum of the reward values ​​corresponding to all function-preserving operations in the current Q-table. It is understood that initially, the reward values ​​for all function-preserving operations in the Q-table are zero, so that all function-preserving operations in the operation selection table are assigned equal selection probabilities when initializing the original population. As the Q-table is continuously updated, the reward values ​​in the Q-table change, and the selection probabilities corresponding to the function-preserving operations in the operation selection table also change. Function-preserving operations with high selection probabilities are identified as target function-preserving operations for subsequent genetic operations on the executable file.

[0050] After initializing the original population to obtain the current population, a file classification model can be used to determine the classification probability of each executable file. This model scores the input executable files to obtain their corresponding classification probabilities, i.e., fitness. Based on the fitness, it can be determined whether an executable file is malicious or benign. The fitness can also be used for subsequent genetic operations. In this embodiment, MalConv (Malicious Convolutional Neural Network, a deep learning model for detecting adversarial malicious code) can be selected as the file classification model.

[0051] It should be noted that the fitness of an executable file is set to [0, 1.0]. Taking the preset threshold of 0.5 as an example, if the fitness of an executable file is between [0, 0.5], it is determined to be a malicious file; if the fitness of an executable file is between [0.5, 1.0], it is determined to be a benign file.

[0052] Step S12: Using the target function preservation operation and based on the fitness, perform genetic operations on the executable files in the current population to obtain a new current population; wherein, the function preservation operation is used to modify the characteristics of the executable files while preserving the original functions of the executable files.

[0053] In this embodiment, after determining the fitness of each executable file in the current population based on the file classification model, a first group of executable files and a second group of executable files can be determined from the current population based on the fitness. Then, a genetic operation is performed on the second group of executable files using the target function retention operation. Finally, a new current population is determined based on the first group of executable files and the second group of executable files after the genetic operation.

[0054] Specifically, executable files in the current population can be divided into three groups based on their fitness. The first group consists of executable files selected from the current population with the smallest difference between their fitness and a preset threshold, retained according to a preset retention ratio. These executable files are more likely to be identified as escape samples because their fitness is close to the preset threshold, and therefore are retained. The third group consists of executable files selected from the current population with the largest difference between their fitness and a preset threshold, selected according to a preset elimination ratio. These executable files are less likely to be identified as escape samples because their fitness is far from the preset threshold, and therefore are eliminated. The second group consists of the executable files remaining in the current population after removing the first and third groups, used for genetic operations to obtain a richer and more diverse set of executable files.

[0055] Furthermore, for genetic operations on the second group of executable files using the target function retention operation, the current adaptive probability can be determined first based on the fitness of each executable file in the second group of executable files, and then crossover and / or mutation operations can be performed on the second group of executable files using the target function retention operation and based on the current adaptive probability.

[0056] Understandably, after the aforementioned crossover and / or mutation operations, the original functionality of the second group of executable files remains unchanged, but their characteristics are altered. This means that the executable files resulting from the crossover and / or mutation operations may be classified as either malicious or benign files by the file classification model. Furthermore, the first group of executable files and the second group of executable files after the genetic operation are merged to obtain a new current population, ensuring that the new current population contains more executable files with fitness values ​​close to the preset threshold.

[0057] Step S13: Based on the file classification model, determine escape samples from the new current population to obtain the current escape rate. If the current escape rate is less than a preset threshold, update the current Q table and jump to the step of determining the classification probability of each executable file in the current population based on the file classification model. If the current escape rate is not less than the preset threshold, use the current population as adversarial samples to train the file classification model. The escape samples are executable files whose actual file type is inconsistent with the predicted file type of the file classification model.

[0058] In this embodiment, escape samples are first determined from the new current population based on the file classification model to obtain the current escape rate. Here, an escape sample refers to an executable file whose actual file type is malicious but is predicted as a benign file by the file classification model, or an executable file whose actual file type is benign but is predicted as a malicious file by the file classification model.

[0059] To calculate the current escape rate, a file classification model can be used to determine the predicted file type corresponding to each executable file in the new current population. Based on the consistency between the predicted file type and the actual file type, escape samples whose predicted file type and actual file type are inconsistent can be identified from the new current population. The total number of escape samples is counted. Then, the current escape rate is calculated based on the ratio of the total number of escape samples to the total number of executable files in the current population.

[0060] Furthermore, the current escape rate obtained above is compared with a preset threshold. If the current escape rate is lower than the preset threshold, it indicates that the number of escaped samples in the current population needs to be increased. Therefore, the current population needs to be further optimized. Specifically, based on the Q-Learning function, the reward values ​​corresponding to several function retention operations are recalculated to update the current Q-table. Then, the current operation selection table is updated based on the updated current Q-table, and the process jumps to step S11, which determines the classification probability of each executable file in the current population based on the file classification model, to further optimize the current population. If the current escape rate is not lower than the preset threshold, the current population can be directly used as adversarial samples to train the model. In this way, by using the current population with a current escape rate not lower than the preset threshold as adversarial samples for further training of the file classification model, this embodiment can enable the file classification model to better identify and process malicious files, thereby improving the overall performance and robustness of the model.

[0061] It should be noted that the escape rate calculation can be performed in a black-box environment. If the escape rate reaches a preset threshold, the optimization of the current population will terminate, thus obtaining adversarial examples. If the escape rate does not reach the preset threshold, the system enters the reinforcement learner, uses the Q-learning function to update the current Q-table, and determines the selection probabilities corresponding to several function retention operations based on the reward values ​​corresponding to several function retention operations in the updated current Q-table, so as to update the current operation selection table for further optimization of the current population.

[0062] As shown above, this application modifies the static features of the executable file while preserving its original functionality through function-preserving operations, thus ensuring the consistency between the executable file's executability and its original functionality after feature modification. Furthermore, in the adversarial example generation process, this application determines the target function-preserving operation by using the reward values ​​corresponding to several function-preserving operations in the Q-table. This target function-preserving operation, combined with the executable file's fitness, is used to perform genetic operations on the executable files in the current population. This genetic operation increases the diversity of executable files, increases the probability of finding the global optimum, and improves the escape rate of the current population. Simultaneously, by continuously updating the Q-table through reinforcement learning, the population can autonomously converge towards the global optimum, reducing the adversarial example generation time and improving the efficiency of adversarial example generation.

[0063] See Figure 2 As shown, taking the MalConv model as the file classification model, the fitness value of the executable file as [0, 1.0], the preset threshold value as 0.5, and the number of functions to be retained as 8 as an example, the adversarial sample generation method disclosed in this application is illustrated.

[0064] First, the Q-table and operation selection table are initialized. In the initialized Q-table, the reward value for each function-preserving operation is 0, and the selection probability for each function-preserving operation in the initialized operation selection table is equal. Next, the population is initialized. Specifically, based on the eight function-preserving operations in the initialized operation selection table, at least one function-preserving operation is selected for each executable file in the original population. This function-preserving operation is added as a gene to the corresponding executable file's genome. This genome modifies the static characteristics of the executable file while preserving its original function, thereby initializing the original population. The initialized population is then designated as the current population.

[0065] After initializing the original population to obtain the current population, the current population is input into the MalConv model to determine the classification probability of each executable file in the current population, thereby obtaining the fitness of each executable file. Further, based on a preset retention ratio v, several executable files with the smallest difference between their fitness and a preset threshold of 0.5 are selected from the current population to obtain the first group of executable files, meaning the fitness of the first group of executable files is close to the preset threshold. Based on a preset elimination ratio w, several executable files with the largest difference between their fitness and the preset threshold of 0.5 are selected from the current population to obtain the third group of executable files, meaning the fitness of the third group of executable files is far from the preset threshold, and the third group of executable files is eliminated. The remaining executable files, excluding the first and third groups of executable files, are selected from the current population to obtain the second group of executable files, meaning the second group of executable files consists of files in the current population that fall between the first and third groups of executable files.

[0066] The current adaptive probability u is determined based on the fitness of each executable file in the second group of executable files; the function with the highest current selection probability in the operation selection table is retained, and crossover and / or mutation operations are performed on the second group of executable files based on the current adaptive probability u; the second group of executable files after crossover and / or mutation operations are merged with the first group of executable files to obtain a new current population.

[0067] The new current population is input into the MalConv model for detection to obtain the current escape rate corresponding to the new current population. If the current escape rate is less than the preset threshold of 0.8, the current Q-table is updated based on the Q-learning function, and the current operation selection table is updated based on the updated current Q-table. The process then jumps back to the steps described above, which use the MalConv model to determine the classification probability of each executable file in the current population. If the current escape rate is not less than the preset threshold of 0.8, the new current population is used as an adversarial example, and the MalConv model is optimized and trained using the adversarial example.

[0068] As can be seen from the above, this embodiment uses the MalConv model for specific file classification as an example to elaborate on the adversarial example generation method disclosed in this application. By selecting at least one function-preserving operation from the operation selection table for each executable file and adding the function-preserving operation as a gene to the executable file's genome, the static features of the executable file are modified according to the genome while preserving the original function of the executable file. Compared with using a sandbox to ensure the consistency of the sample's executability and original function, this method improves efficiency. Furthermore, in the adversarial example generation process, this embodiment determines the target function-preserving operation by using the reward values ​​corresponding to several function-preserving operations in the Q-table. The target function-preserving operation is then used in conjunction with the fitness of the executable file to perform genetic operations on the executable files in the current population. This genetic operation increases the diversity of the executable files, increases the probability of finding the global optimum, and improves the escape rate of the current population. At the same time, by continuously updating the Q-table through reinforcement learning, the population can autonomously converge towards the global optimum, reducing the adversarial example generation time and improving the adversarial example generation efficiency.

[0069] See Figure 3 As shown in the embodiments, this application also discloses an adversarial sample generation device, including:

[0070] Classification module 11 is used to determine the classification probability of each executable file in the current population based on the file classification model to obtain the corresponding fitness, and to determine the target function retention operation by using the reward values ​​corresponding to several function retention operations in the current Q table.

[0071] Genetic module 12 is used to perform genetic operations on executable files in the current population based on the fitness and the target function preservation operation to obtain a new current population; wherein, the function preservation operation is used to modify the characteristics of the executable file while preserving the original function of the executable file;

[0072] The adversarial sample determination module 13 is used to determine escape samples from the new current population based on the file classification model to obtain the current escape rate. If the current escape rate is less than a preset threshold, the current Q table is updated and the process jumps to the step of determining the classification probability of each executable file in the current population based on the file classification model. If the current escape rate is not less than the preset threshold, the current population is used as adversarial samples to train the file classification model. The escape samples are executable files whose actual file type is inconsistent with the predicted file type of the file classification model.

[0073] As shown above, this application modifies the static features of the executable file while preserving its original functionality through function-preserving operations, thus ensuring the consistency between the executable file's executability and its original functionality after feature modification. Furthermore, in the adversarial example generation process, this application determines the target function-preserving operation by using the reward values ​​corresponding to several function-preserving operations in the Q-table. This target function-preserving operation, combined with the executable file's fitness, is used to perform genetic operations on the executable files in the current population. This genetic operation increases the diversity of executable files, increases the probability of finding the global optimum, and improves the escape rate of the current population. Simultaneously, by continuously updating the Q-table through reinforcement learning, the population can autonomously converge towards the global optimum, reducing the adversarial example generation time and improving the efficiency of adversarial example generation.

[0074] In some specific embodiments, the adversarial example generation device may further include:

[0075] An operation selection module is used to assign at least one corresponding function retention operation to each executable file in the original population based on the aforementioned function retention operations.

[0076] The population initialization module is used to modify the characteristics of the corresponding executable file while preserving the original functions of the corresponding executable file using the at least one function preservation operation, so as to initialize the original population and determine the initialized population as the current population.

[0077] In some specific embodiments, the genetic module 12 may specifically include:

[0078] The file determination submodule is used to determine a first group of executable files and a second group of executable files from the current population based on the fitness.

[0079] The population determination submodule is used to perform genetic operations on the second group of executable files using the target function retention operation, and to determine a new current population based on the first group of executable files and the second group of executable files after the genetic operation.

[0080] In some specific implementations, the document determination submodule may specifically include:

[0081] The first file determination unit is used to determine, according to a preset retention ratio, a number of executable files from the current population with the smallest difference between the fitness and the preset boundary value, so as to obtain a first set of executable files;

[0082] The second file determination unit is used to determine, according to a preset elimination ratio, several executable files with the largest difference between fitness and preset threshold value from the current population, so as to obtain a third set of executable files;

[0083] The third file determination unit is used to determine the remaining executable files from the current population, excluding the first group of executable files and the third group of executable files, to obtain the second group of executable files.

[0084] In some specific implementations, the population determination submodule may specifically include:

[0085] The probability determination unit is used to determine the current adaptive probability based on the fitness of each executable file in the second group of executable files.

[0086] A genetic operation unit is used to perform crossover and / or mutation operations on the second set of executables based on the target function retention operation and the current adaptive probability.

[0087] In some specific embodiments, the adversarial example determination module 13 may specifically include:

[0088] The sample determination unit is used to determine the predicted file type corresponding to each executable file in the new current population based on the file classification model, and to determine escape samples from the new current population based on the consistency between the predicted file type and the actual file type.

[0089] An escape rate determination unit is used to determine the current escape rate corresponding to the new current population based on the total number of escaped samples.

[0090] In some specific embodiments, the classification module 11 may specifically include:

[0091] An operation determination unit is used to determine a target function retention operation from the plurality of function retention operations based on the selection probabilities corresponding to the plurality of function retention operations in the current operation selection table; wherein, the selection probabilities corresponding to the plurality of function retention operations in the current operation selection table are probabilities determined based on the reward values ​​corresponding to the plurality of function retention operations in the current Q table.

[0092] Accordingly, the adversarial example generation device may further include:

[0093] The selection table update unit is used to update the current operation selection table based on the updated current Q table.

[0094] Furthermore, embodiments of this application also disclose an electronic device, Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0095] Figure 4 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the adversarial example generation method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0096] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0097] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0098] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the adversarial sample generation method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0099] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned adversarial example generation method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0100] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0101] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0102] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0103] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0104] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for generating adversarial examples, characterized in that, include: The classification probability of each executable file in the current population is determined based on the file classification model to obtain the corresponding fitness, and the target function retention operation is determined by using the reward values ​​corresponding to several function retention operations in the current Q table. The target function preservation operation is used to perform genetic operations on the executable files in the current population based on the fitness to obtain a new current population; wherein, the function preservation operation is used to modify the characteristics of the executable files while preserving the original functions of the executable files; Based on the file classification model, escape samples are determined from the new current population to obtain the current escape rate. If the current escape rate is less than a preset threshold, the current Q-table is updated and the process jumps to the step of determining the classification probability of each executable file in the current population based on the file classification model. If the current escape rate is not less than the preset threshold, the current population is used as adversarial samples to train the file classification model. The escape samples are executable files whose actual file type is inconsistent with the predicted file type of the file classification model. The step of utilizing the target function retention operation and performing genetic operations on the executable files in the current population based on the fitness to obtain a new current population includes: Based on the fitness, a first set of executable files and a second set of executable files are determined from the current population; Genetic operations are performed on the second group of executable files using the target function retention operation, and a new current population is determined based on the first group of executable files and the second group of executable files after the genetic operation. The step of determining the target function retention operation by utilizing the reward values ​​corresponding to several function retention operations in the current Q table includes: Based on the selection probabilities corresponding to the several function retention operations in the current operation selection table, a target function retention operation is determined from the several function retention operations; wherein, the selection probabilities corresponding to the several function retention operations in the current operation selection table are probabilities determined based on the reward values ​​corresponding to the several function retention operations in the current Q table; Accordingly, after updating the current Q table, the process also includes: The current operation selection table is updated based on the updated current Q table.

2. The adversarial example generation method according to claim 1, characterized in that, Before determining the classification probability of each executable file in the current population based on the file classification model, the method further includes: Based on the aforementioned function preservation operations, at least one corresponding function preservation operation is assigned to each executable file in the original population; By utilizing the at least one function preservation operation, while preserving the original function of the corresponding executable file, the corresponding executable file is characterized to be modified in order to initialize the original population, and the initialized population is determined as the current population.

3. The adversarial example generation method according to claim 1, characterized in that, The step of determining the first set of executable files and the second set of executable files from the current population based on the fitness includes: Based on a preset retention ratio, a number of executable files with the smallest difference between the fitness and the preset threshold value are determined from the current population to obtain a first set of executable files; Based on a preset elimination ratio, a number of executable files with the largest difference between their fitness and a preset threshold value are determined from the current population to obtain a third group of executable files; The remaining executable files, excluding the first group of executable files and the third group of executable files, are determined from the current population to obtain the second group of executable files.

4. The adversarial example generation method according to claim 1, characterized in that, The genetic operation performed on the second group of executable files using the target function preservation operation includes: The current adaptive probability is determined based on the fitness of each executable file in the second group of executable files; The target function is retained and crossover and / or mutation operations are performed on the second group of executables based on the current adaptive probability.

5. The adversarial example generation method according to claim 1, characterized in that, The step of determining escape samples from the new current population based on the file classification model to obtain the current escape rate includes: Based on the file classification model, the predicted file type corresponding to each executable file in the new current population is determined, and escape samples are determined from the new current population based on the consistency between the predicted file type and the actual file type. The current escape rate corresponding to the new current population is determined based on the total number of escaped samples.

6. An adversarial sample generation device, characterized in that, The apparatus is used to implement the adversarial sample generation method as described in any one of claims 1 to 5, the apparatus comprising: The classification module is used to determine the classification probability of each executable file in the current population based on the file classification model in order to obtain the corresponding fitness, and to determine the target function retention operation by using the reward values ​​corresponding to several function retention operations in the current Q table. A genetic module is used to perform genetic operations on executable files in the current population based on the fitness and the target function preservation operation to obtain a new current population; wherein, the function preservation operation is used to modify the characteristics of the executable file while preserving the original function of the executable file; The adversarial example determination module is used to determine escape samples from the new current population based on the file classification model to obtain the current escape rate. If the current escape rate is less than a preset threshold, the current Q-table is updated and the process jumps to the step of determining the classification probability of each executable file in the current population based on the file classification model. If the current escape rate is not less than the preset threshold, the current population is used as adversarial examples to train the file classification model. The escape samples are executable files whose actual file type is inconsistent with the predicted file type of the file classification model.

7. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the adversarial example generation method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, Used to store a computer program; wherein, when the computer program is executed by a processor, it implements the adversarial sample generation method as described in any one of claims 1 to 5.

Images