Open set physical information system malicious software classification method
By extracting FCG and embedded text features of malware, combining graph representation and text representation algorithms, cross-feature features are generated and classifier and decoder networks are trained, and the threshold method is used to detect unknown malware, solving the problem that the existing technology is difficult to identify new malware, and achieving high accuracy and universal malware classification.
Patent Information
- Application Number
- CN202411674695.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-21
- Publication Date
- 2025-03-07
AI Technical Summary
Existing physical information system malware classification methods are difficult to identify new types of malware and cannot effectively detect and classify unknown categories of malware.
Disassembly tools are used to extract FCG features and embedded text features of malware, and converted them into feature vectors through unsupervised graph representation algorithms and text representation algorithms. Cross features are generated by combining cross networks and DNN networks, classifier networks and decoder networks are trained, and unknown category detectors are built using the threshold method to realize the identification of unknown malware.
It realizes fine-grained malware classification across architectures, significantly improves the accuracy and generality of the model, can detect unknown malware, and enhances the security of the system.
Smart Images
Figure CN119577766A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of network security, and in particular relates to a malware classification method for an open set physical information system. Background Art
[0002] Malware classification for open-set cyber-physical systems (CPS) refers to the ability to identify and classify known and unknown malware in a cyber-physical system environment. Unlike traditional closed-set classification tasks, open-set classification tasks require models to not only be able to identify known classes of malware, but also be able to detect and reject unseen, unknown classes of malware.
[0003] The necessity of malware classification for physical information systems is to provide important reference and basis for dealing with security threats brought by these malware. Through detailed analysis and classification of the attack methods, propagation methods, infection targets and other characteristics of malware in physical information systems, we can better understand the nature of these threats and formulate more effective detection and defense strategies.
[0004] At present, the research on the classification of physical cyber system malware at home and abroad focuses on building classification models using machine learning methods, but most of these models are based on closed data sets and cannot identify malware of untrained categories, making them difficult to apply to actual network environments where new variants often appear. Therefore, it is necessary to design and provide a new open set physical cyber system malware classification system that provides a finer classification level for malware and can detect unknown malware. Summary of the invention
[0005] In order to overcome the deficiencies in the prior art, the inventors have conducted intensive research and provided an open set physical information system malware classification method to solve the problem that physical information system malware classification and existing physical information system malware classification methods are difficult to identify new malware.
[0006] The technical solution provided by the present invention is as follows:
[0007] In a first aspect, a method for classifying malware in an open set of physical cyber systems includes:
[0008] Use disassembly tools to extract FCG features and embedded text features from the malware program;
[0009] Use unsupervised graph representation algorithm and text representation algorithm to convert FCG features and embedded text features into feature vectors respectively;
[0010] The feature vectors converted from FCG features and embedded text features are concatenated and input into the cross network and DNN network to mine the deep associations between features and generate cross features;
[0011] The classifier network is trained using cross-features of known malware. The classifier network consists of an encoder and a Sigmoid activation layer. The encoder reduces the dimension of the input features to obtain latent features, which are then input into the Sigmoid activation layer to generate classification probabilities and preliminary prediction labels. The encoder parameters are fixed, and the latent features are concatenated with the one-hot encoding of the prediction labels as input to train the decoder. The decoder outputs the reconstruction error.
[0012] According to the performance differences of different malware categories in classification probability and reconstruction error, an unknown category detector is constructed using the threshold method to distinguish physical cyber system malware of known and unknown categories.
[0013] The FCG features and embedded text features of the malware to be classified are extracted, converted into feature vectors and cross features are generated. The features are input into the classification model composed of the classifier network, decoder and unknown category detector to obtain the classification results of the physical information system malware.
[0014] In a second aspect, a training method for an open set physical cyber system malware classification model includes:
[0015] Use disassembly tools to extract FCG features and embedded text features from the malware program;
[0016] Use unsupervised graph representation algorithm and text representation algorithm to convert FCG features and embedded text features into feature vectors respectively;
[0017] The feature vectors converted from FCG features and embedded text features are concatenated and input into the cross network and DNN network to mine the deep associations between features and generate cross features;
[0018] The classifier network is trained using cross-features of known malware. The classifier network consists of an encoder and a Sigmoid activation layer. The encoder reduces the dimension of the input features to obtain latent features, which are then input into the Sigmoid activation layer to generate classification probabilities and preliminary prediction labels. The encoder parameters are fixed, and the latent features are concatenated with the one-hot encoding of the prediction labels as input to train the decoder. The decoder outputs the reconstruction error.
[0019] According to the differences in classification probability and reconstruction error between different types of malware, an unknown category detector is constructed using the threshold method to distinguish physical information system malware of known and unknown classes, and complete the training of the classification model composed of the classifier network, decoder and unknown category detector.
[0020] In combination with the first or second aspect, in the step of using an unsupervised graph representation algorithm and a text representation algorithm to convert the FCG features and the embedded text features into feature vectors respectively, the Graph2Vec algorithm and the FastText representation algorithm are used to convert the FCG features and the embedded text features into feature vectors respectively.
[0021] In combination with the first or second aspect, the step of concatenating the feature vectors converted from the FCG features and the embedded text features, inputting the feature vectors into the cross network and the DNN network to mine the deep association between the features, and generating the cross feature comprises:
[0022] The cross network learns the low-order linear representation of the cross features, and the output of the lth layer of the cross network As shown below:
[0023]
[0024] in, represents the input of the lth layer of the cross network, is the output of layer l, is the weight matrix and bias matrix of the lth layer of the cross network;
[0025] The DNN network learns the high-order linear representation of cross-features, and the output of the DNN layer l As shown below:
[0026]
[0027] in, represents the input of the lth layer of DNN, are the weight matrix and bias matrix of the lth layer in the DNN, and f(·) is the activation function of the DNN network;
[0028] The cross feature is a combination of the cross network and the DNN network output.
[0029] In combination with the first or second aspect, the step of constructing an unknown category detector using a threshold method based on the performance differences of different categories of malware in classification probability and reconstruction error to distinguish physical information system malware of known and unknown categories includes:
[0030] The empirical threshold set of reconstruction errors for different known categories of malware is denoted as The empirical threshold set of classification probability is recorded as Where k represents the malware category, and m is the number of known malware categories;
[0031] If the classification probability of the malware to be classified output by the classification model is greater than the empirical threshold of the classification probability of the malware of the corresponding category and less than the empirical threshold of the reconstruction error of the malware of the corresponding category, then the malware to be classified is a known category malware and the category is determined according to the output result of the classification model; otherwise, the malware to be classified is classified as an unknown category malware, and the expression is shown in the following formula:
[0032]
[0033] Among them, y is the preliminary classification label and y' is the final classification label.
[0034] In a third aspect, an open set physical information system malware classification device includes:
[0035] one or more processors;
[0036] a storage device for storing one or more programs,
[0037] When the one or more programs are executed by the one or more processors, the one or more processors implement the open set physical information system malware classification method described in the first aspect.
[0038] In a fourth aspect, a readable storage medium stores a computer program, which, when executed by a processor, implements the open set physical information system malware classification method described in the first aspect.
[0039] In a fifth aspect, a computer program product is provided, the computer program product comprising: a computer program (also referred to as code, or instruction), which, when executed, executes the open set physical information system malware classification method described in the first aspect.
[0040] According to the present invention, a method for classifying malware in an open set physical information system has the following characteristics:
[0041] Beneficial effects:
[0042] (1) The present invention provides an open set of physical information system malware classification method, which comprehensively utilizes multiple features and adopts a feature cross-method to deeply explore its deep-level associations, thereby achieving cross-architecture fine-grained classification and significantly improving the accuracy and versatility of the model;
[0043] (2) The present invention provides an open set physical information system malware classification method, which combines the classification probability and reconstruction error of the sample and uses the decision mechanism of the threshold method to distinguish unknown class samples; the detected unknown class malware can help identify and repair security vulnerabilities in the system and enhance overall security;
[0044] (3) The present invention provides an open set physical information system malware classification method, which can dynamically adjust the threshold according to the specific situation of the malware to be tested, maintain the high accuracy of the classification result, and improve the versatility of the classification model. BRIEF DESCRIPTION OF THE DRAWINGS
[0045] Figure 1 This is the framework diagram of the open set CPS malware classification method;
[0046] Figure 2 Preprocessing process for CPS malware;
[0047] Figure 3 Examples of CPS malware features. The left image shows embedded text features, and the right image shows FCG features.
[0048] Figure 4 Figure 2 is the framework diagram of the open set CPS malware classification model. DETAILED DESCRIPTION
[0049] The following detailed description of the present invention will make the features and advantages of the present invention more clear and explicit.
[0050] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.
[0051] The present invention provides an open set of physical information system malware classification method, the implementation process is as follows Figure 1 As shown in the figure. In the CPS malware preprocessing step, the disassembly tool IDAPro is first used to extract the sample's function call graph (FCG) features and embedded text features, and then unsupervised graph representation algorithms and text representation algorithms are used to map them to vector space. In order to mine the deep association of multi-dimensional features, the feature cross method is finally introduced to fuse FCG features and embedded text features to generate high-dimensional features and enhance the generalization ability of the model.
[0052] In the open set CPS malware classification step, the cross features are used as input, and the encoder network is trained as a malware classifier to reduce the data dimension and calculate the classification probability. Then the decoder network is trained to increase the data dimension, generate reconstruction features close to the input features, and calculate the reconstruction error. Combining the classification probability threshold and the reconstruction error, the threshold method is used to construct an unknown category detector to obtain the final open set classification result.
[0053] 1. CPS malware pre-processing
[0054] The framework of CPS malware preprocessing is as follows Figure 2As shown in the figure, it consists of three parts. 1) Feature extraction part, extracts FCG features and embedded text features from the malware program through static disassembly. 2) Feature representation part, uses Graph2Vec algorithm and FastText representation algorithm to represent the original features as feature vectors. 3) Feature intersection part, uses cross network and DNN network to mine the deep correlation between features and generate cross features.
[0055] (1) Feature extraction
[0056] For each sample binary file, we first use the disassembly tool IDAPro to reverse analyze it and extract FCG features and embedded text features, such as Figure 3 As shown in the figure. The FCG feature describes the calling relationship of the functions used by CPS malware from the structural level, while the embedded text feature reveals the implementation details inside the function from the content level. The FCG feature complements the embedded text feature and enhances the cross-architecture generalization ability of the feature.
[0057] (2) Feature Representation
[0058] For the FCG features of CPS malware, the Graph2Vec algorithm is used for feature representation. According to the connection relationship between nodes, the embedded information of the nodes in the FCG is aggregated, and each high-dimensional FCG feature is converted into a low-dimensional vector with a fixed length. For example, the vector length is fixed to 32, which is convenient for subsequent training of deep neural networks. These vectors capture the unique structural information and call relationships in each FCG feature, thereby distinguishing different categories of CPS malware.
[0059] In view of the embedded text features of CPS malware, the FastText algorithm is introduced for feature representation to generate a vector of length 32. Compared with the simple bag-of-words model, the FastText algorithm not only considers the information of the word itself, but also captures the association and contextual information between words through n-gram features, which can better capture the differences between similar texts and improve the generalization ability of the text learning model.
[0060] (3) Feature Crossover
[0061] After the FCG and embedded text features of each CPS malware are represented as feature vectors, if only a simple splicing method is adopted, the deep connection between these different perspective features cannot be mined. The present invention introduces a deep neural network to capture the high-level feature representation between different features, and simulates the explicit cross-relationship between features with the help of a cross network. Compared with the simple feature splicing method, the feature cross-network strategy can mine the feature patterns of malware at a deeper level, thereby more accurately obtaining the essential differences between different categories of malware. The specific process is as follows:
[0062] The FCG feature vector and the embedded text feature vector are concatenated and the concatenated feature is recorded as x0. The low-order linear representation of the feature is learned through the cross network. The cross network superimposes the original feature with the hierarchical output of each layer through a series of cross layers. This process is similar to the expansion of a polynomial, thereby simulating the linear relationship between features. The output of the lth layer of the cross network is As shown in formula (1):
[0063]
[0064] in, represents the input of the lth layer of the cross network, is the output of layer l, is the weight matrix and bias matrix of the lth layer of the cross network.
[0065] The final output of the cross network is recorded as x c , is the low-order linear information between the features learned by the model.
[0066] High-order nonlinear cross-information is learned through DNN. The output of the first layer of DNN is As shown in formula (2):
[0067]
[0068] in, represents the input of the lth layer of DNN, is the weight matrix and bias matrix of the lth layer in the DNN, and f(·) is the activation function of the DNN network, such as the Softplus activation function.
[0069] The output of the last layer of DNN is denoted as x d , is the high-order nonlinear interaction information finally learned by the DNN model. The cross feature is x c and x d The combination of is represented by x, as shown in formula (3):
[0070] x=[x c ;x d ] (3)
[0071] 2. Open Set CPS Malware Classification
[0072] The preprocessing process maps CPS malware into feature vectors through feature representation and feature intersection. This section uses the feature vector as input to build and train an open set CPS malware classification model.
[0073] (1) Model framework
[0074] The open set CPS malware classification model based on deep learning has an overall design framework as follows Figure 4 shown.
[0075] The training process of this model is mainly divided into two stages, namely classifier network training and reconstruction network training. Traditional conditional autoencoder training often updates the network parameters of the encoder and decoder at the same time. The difference of this method is that the modified encoder is first trained to act as a classifier for known classes. Specifically, the encoder reduces the dimension of the input features to obtain latent features, and then inputs the latent features into the Sigmoid activation layer to generate classification probabilities and preliminary prediction labels. Next, the parameters of the encoder are fixed, and the latent features are concatenated with the one-hot encoding of the predicted label as input to train the decoder to obtain the reconstruction error.
[0076] During the training process, we only use samples of known classes. Under the constraints of the loss function, the model will only have a good learning effect on samples of known classes. When the input feature comes from a known class, the classifier will try to classify it correctly and output a larger classification probability; otherwise, the prediction result of the Sigmoid classifier will be wrong, and the classification probability will be lower. Similarly, no matter what category the input feature comes from, the decoder will try to generate features similar to the input feature and calculate the reconstruction error between the two. If the input feature belongs to a known category, the model will output features that are highly similar to the input feature, otherwise it will output relatively unfamiliar features.
[0077] Finally, according to the performance differences of different categories of samples in classification probability and reconstruction error, the threshold method is used to construct an unknown category detector to distinguish CPS malware samples of known and unknown classes.
[0078] (2) Classifier network construction
[0079] First, the classification network is trained to preliminarily distinguish known malicious samples. The classifier network consists of an encoder and a Sigmoid activation layer. The encoder is responsible for learning the abstract rules of the input features and mapping them into low-dimensional latent features. The Sigmoid activation layer is responsible for classification and outputs classification probabilities and preliminary classification labels.
[0080] The loss function of the classifier network uses the cross entropy loss commonly used in multi-classification tasks. The smaller the cross entropy loss, the closer the model prediction is to the true label distribution. By minimizing the cross entropy loss, the model learns the parameter weights that map the input to the correct category probability distribution. The cross entropy loss is expressed as formula (4).
[0081]
[0082] Where n represents the number of samples, m represents the number of categories; y is the symbol 0 or 1, which takes 1 when the true category of sample i is j, otherwise it takes 0; p represents the predicted probability that sample i belongs to category j.
[0083] In addition, the L2 regularization term is introduced on the basis of the cross entropy loss to prevent overfitting and improve the generalization ability of the model. At this time, the total loss function is shown in formula (5).
[0084]
[0085] Among them, λ1 is the regularization coefficient, w l are the parameters of the model.
[0086] (3) Reconstruction of network construction
[0087] The parameters of the trained classifier are frozen, and the latent features and preliminary predicted labels of each malware sample are calculated. The one-hot encoding of the label and the latent features are then concatenated and input into the decoder network, and the decoder generates a high-dimensional reconstructed feature x′.
[0088] The reconstruction loss L of the decoder network Recon As shown in formula (6).
[0089]
[0090] Where MSE(·) represents the mean square error, which is used to measure the distance between the reconstructed features and the original features, and N is the number of malware samples.
[0091] (4) Construction of unknown category detector
[0092] For each CPS malicious sample x to be tested, in addition to its preliminary classification label y, two important information can be obtained: classification probability p and reconstruction error re. Combining these two types of information, the threshold method is used to determine the unknown class.
[0093] Since the model has different representation capabilities for different categories of CPS malicious samples and the intrinsic data characteristics of different categories of samples are different, it is impossible to set a unified threshold for all categories. In order to solve the problem of difficult to unify the threshold, according to the distribution of reconstruction error and classification probability of each category, after removing outliers, a suitable empirical threshold combination is set for each malware category. The empirical threshold set of reconstruction error is denoted as The empirical threshold set of classification probability is recorded as Where k represents the malware category and m is the number of known malware categories. In this model, the features of known malware categories usually show higher classification probability and smaller reconstruction error, while the features of unknown malware categories show lower classification probability and larger reconstruction error. Therefore, for any sample x to be tested, it can be classified according to formula (7).
[0094]
[0095] Among them, y is the preliminary classification label and y' is the final classification label.
[0096] Based on the trained model, the specific process of the open set CPS malware classification method is as follows: 1) Input the sample x to be tested into the classifier network to generate hidden features z; 2) Calculate the maximum classification probability p and the preliminary predicted label y; 3) Concatenate the one-hot encoding of the preliminary predicted label y and the hidden feature z as the input of the decoder network to generate a reconstructed sample x′, and calculate the reconstruction error re = MSE(x, x'); 4) Combine the classification probability and reconstruction error, and compare them with the preset threshold. Samples that do not exceed the threshold range will output their family labels, while the remaining samples will be classified as unknown classes.
[0097] The present invention also provides an open set physical information system malware classification device, comprising:
[0098] one or more processors;
[0099] a storage device for storing one or more programs,
[0100] When the one or more programs are executed by the one or more processors, the one or more processors implement the open set physical information system malware classification method described above.
[0101] The present invention also provides a readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned open set physical information system malware classification method.
[0102] The readable storage medium includes, but is not limited to, various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.
[0103] The present invention also provides a computer program product, which includes: a computer program (also referred to as code, or instruction), which executes the above-mentioned open set physical information system malware classification method when the computer program is run.
[0104] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, microwave, etc.) mode to another website site, computer, server or data center.
[0105] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.
[0106] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and product can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.
[0107] The present invention has been described in detail above in conjunction with specific implementations and exemplary examples, but these descriptions cannot be understood as limiting the present invention. Those skilled in the art understand that, without departing from the spirit and scope of the present invention, a variety of equivalent substitutions, modifications or improvements may be made to the technical solution of the present invention and its implementation methods, all of which fall within the scope of the present invention. The scope of protection of the present invention shall be subject to the attached claims.
[0108] The contents not described in detail in the specification of the present invention belong to the common knowledge of those skilled in the art.
Claims
1. A method for classifying malware in an open set of physical cyber systems, characterized in that: include: Use disassembly tools to extract FCG features and embedded text features from the malware program; Use unsupervised graph representation algorithm and text representation algorithm to convert FCG features and embedded text features into feature vectors respectively; The feature vectors converted from FCG features and embedded text features are concatenated and input into the cross network and DNN network to mine the deep associations between features and generate cross features; The classifier network is trained using cross-features of known malware. The classifier network consists of an encoder and a Sigmoid activation layer. The encoder reduces the dimension of the input features to obtain latent features, which are then input into the Sigmoid activation layer to generate classification probabilities and preliminary prediction labels. The encoder parameters are fixed, and the latent features are concatenated with the one-hot encoding of the prediction labels as input to train the decoder. The decoder outputs the reconstruction error. According to the performance differences of different malware categories in classification probability and reconstruction error, an unknown category detector is constructed using the threshold method to distinguish physical cyber system malware of known and unknown categories. FCG features and embedded text features of the malware to be classified are extracted, converted into feature vectors and cross features are generated. The features are input into the classification model composed of the classifier network, decoder and unknown category detector to obtain the classification results of the physical information system malware.
2. The open set physical information system malware classification method according to claim 1, characterized in that: In the step of using an unsupervised graph representation algorithm and a text representation algorithm to convert the FCG features and the embedded text features into feature vectors respectively, the Graph2Vec algorithm and the FastText representation algorithm are used to convert the FCG features and the embedded text features into feature vectors respectively.
3. The open set physical information system malware classification method according to claim 1, characterized in that: The step of concatenating the feature vectors converted from the FCG features and the embedded text features, inputting the feature vectors into the cross network and the DNN network to mine the deep association between the features, and generating the cross feature comprises: The low-order linear representation of the cross feature is learned through the cross network, and the output x of the lth layer of the cross network is l c +1 As shown below: in, represents the input of the lth layer of the cross network, is the output of layer l, is the weight matrix and bias matrix of the lth layer of the cross network; The DNN network learns the high-order linear representation of cross-features, and the output of the DNN layer l As shown below: in, represents the input of the lth layer of DNN, are the weight matrix and bias matrix of the lth layer in the DNN, and f(·) is the activation function of the DNN network; The cross feature is a combination of the cross network and the DNN network output.
4. The open set physical information system malware classification method according to claim 1, characterized in that: The step of constructing an unknown category detector using a threshold method based on the performance differences of different categories of malware in classification probability and reconstruction error to distinguish physical information system malware of known and unknown categories includes: The empirical threshold set of reconstruction errors for different known categories of malware is denoted as The empirical threshold set of classification probability is recorded as Where k represents the malware category, and m is the number of known malware categories; If the classification probability of the malware to be classified output by the classification model is greater than the empirical threshold of the classification probability of the malware of the corresponding category and less than the empirical threshold of the reconstruction error of the malware of the corresponding category, then the malware to be classified is a known category malware and the category is determined according to the output result of the classification model; otherwise, the malware to be classified is classified as an unknown category malware, and the expression is shown in the following formula: Among them, y is the preliminary classification label and y' is the final classification label.
5. A training method for an open set of physical cyber system malware classification models, characterized in that: include: Use disassembly tools to extract FCG features and embedded text features from the malware program; Use unsupervised graph representation algorithm and text representation algorithm to convert FCG features and embedded text features into feature vectors respectively; The feature vectors converted from FCG features and embedded text features are concatenated and input into the cross network and DNN network to mine the deep associations between features and generate cross features; The classifier network is trained using cross-features of known malware. The classifier network consists of an encoder and a Sigmoid activation layer. The encoder reduces the dimension of the input features to obtain latent features, which are then input into the Sigmoid activation layer to generate classification probabilities and preliminary prediction labels. The encoder parameters are fixed, and the latent features are concatenated with the one-hot encoding of the prediction labels as input to train the decoder. The decoder outputs the reconstruction error. According to the differences in classification probability and reconstruction error between different types of malware, an unknown category detector is constructed using the threshold method to distinguish physical information system malware of known and unknown classes, and complete the training of the classification model composed of the classifier network, decoder and unknown category detector.
6. The method for training an open set physical cyber system malware classification model according to claim 5, characterized in that: In the step of using an unsupervised graph representation algorithm and a text representation algorithm to convert the FCG features and the embedded text features into feature vectors respectively, the Graph2Vec algorithm and the FastText representation algorithm are used to convert the FCG features and the embedded text features into feature vectors respectively.
7. The method for training an open set physical cyber system malware classification model according to claim 5, characterized in that: The step of concatenating the feature vectors converted from the FCG features and the embedded text features, inputting the feature vectors into the cross network and the DNN network to mine the deep association between the features, and generating the cross feature comprises: The cross network learns the low-order linear representation of the cross features, and the output of the lth layer of the cross network As shown below: in, represents the input of the lth layer of the cross network, is the output of layer l, is the weight matrix and bias matrix of the lth layer of the cross network; The DNN network learns the high-order linear representation of cross-features, and the output of the DNN layer l As shown below: in, represents the input of the lth layer of DNN, are the weight matrix and bias matrix of the lth layer in the DNN, and f(·) is the activation function of the DNN network; The cross feature is a combination of the cross network and the DNN network output.
8. The method for training an open set physical cyber system malware classification model according to claim 5, characterized in that: The step of constructing an unknown category detector using a threshold method based on the performance differences of different categories of malware in classification probability and reconstruction error to distinguish physical information system malware of known and unknown categories includes: The empirical threshold set of reconstruction errors for different known categories of malware is denoted as The empirical threshold set of classification probability is recorded as Where k represents the malware category, and m is the number of known malware categories; If the classification probability of the malware to be classified output by the classification model is greater than the empirical threshold of the classification probability of the malware of the corresponding category and less than the empirical threshold of the reconstruction error of the malware of the corresponding category, then the malware to be classified is a known category malware and the category is determined according to the output result of the classification model; otherwise, the malware to be classified is classified as an unknown category malware, and the expression is shown in the following formula: Among them, y is the preliminary classification label and y' is the final classification label.
9. A readable storage medium, characterized in that: A computer program is stored thereon, and when the program is executed by a processor, the open set physical information system malware classification method as described in any one of claims 1 to 4 is implemented.
10. A computer program product, characterized in that The computer program product comprises: a computer program, which, when executed, executes the open set physical information system malware classification method as claimed in any one of claims 1 to 4.