Malicious code identification method and system based on dynamic multi-expert convolutional network

Abstract

The invention discloses a malicious code identification method and system based on a dynamic multi-expert convolutional network, and relates to the technical field of computer processing. The method comprises the following steps: acquiring to-be-detected data, and preprocessing the to-be-detected data; a malicious code detection model is constructed, the malicious code detection model comprises a plurality of expert branches connected in parallel, and output combinations of different expert branches can be dynamically selected; training the malicious code detection model by using a known data set; and performing malicious code identification on to-be-detected data by utilizing the trained malicious code detection model. According to the method, on the basis of deep learning, automatic classification of unknown malicious software is realized by utilizing an open set recognition technology and a multi-expert decision-making technology.

Description

Technical Field

[0001] The present invention relates to the field of computer processing technology, and in particular to a malicious code identification method and system based on a dynamic multi-expert convolutional network. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development of information technology, malicious code (such as viruses, Trojans, worms, etc.) has become one of the most serious threats to network security. Traditional malicious code detection methods are mainly based on signature matching, behavioral analysis and heuristic detection. Signature matching technology detects by comparing the feature library of known malicious code, but this method cannot effectively identify unknown malicious code. Behavioral analysis determines whether it is malicious behavior by monitoring the execution behavior of the program, but this requires the system to monitor the program in real time with high load and is easily interfered by encryption or obfuscation technology. Heuristic detection relies on analyzing the rules and characteristics of program behavior, but its accuracy and reliability are often limited by the comprehensiveness and accuracy of the rules. Therefore, traditional malicious code detection methods face great limitations, especially when facing new and variant malicious codes.

[0004] Open set recognition is a machine learning task that can cope with unknown categories. Traditional classification models usually assume that all test data comes from known categories (i.e., closed set recognition), but in the real world, especially in malicious code detection, attackers often create new, unknown malicious code samples by constantly changing or encrypting them, which cannot be recognized by existing models. The goal of open set recognition technology is to not only accurately classify known categories, but also effectively identify data of unknown categories. Existing open set recognition methods, such as models based on energy models and deep neural networks, have made some progress, but they still have some challenges, such as misidentification of unknown categories, insufficient model robustness, and dependence on the distribution of training data. Therefore, how to effectively improve the application effect of open set recognition models in malicious code detection, improve recognition accuracy, and reduce misidentification rate is still a hot issue in current research. Summary of the invention

[0005] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a malicious code identification method and system based on a dynamic multi-expert convolutional network, which is based on deep learning and utilizes open set recognition technology and multi-expert decision-making technology to realize automatic classification of unknown malware.

[0006] In order to achieve the above object, the present invention is implemented through the following technical solutions:

[0007] The first aspect of the present invention provides a malicious code identification method based on a dynamic multi-expert convolutional network, comprising the following steps:

[0008] Acquire the data to be detected and pre-process the data to be detected;

[0009] Constructing a malicious code detection model, wherein the malicious code detection model includes multiple parallel expert branches and can dynamically select output combinations of different expert branches;

[0010] Use known data sets to train malicious code detection models;

[0011] Use the trained malicious code detection model to identify malicious code in the data to be detected.

[0012] Furthermore, the specific steps for preprocessing the data to be detected are:

[0013] Convert the data to be detected into a grayscale image. During the conversion process, bytes are mapped to decimal values ​​and stored in a one-dimensional array, where each value corresponds to a pixel in the grayscale image.

[0014] Depending on the file size, the array will be rearranged into an image of fixed width and variable height.

[0015] Furthermore, the specific steps of building a malicious code detection model include:

[0016] Using the feature extractor to perform preliminary feature extraction on the input malicious code sample to obtain a preliminary feature map;

[0017] Use multiple expert branches to further extract features from the preliminary feature map;

[0018] The final feature map is obtained after dynamic weighted fusion of the outputs of different branches, in which the output weights of different expert branches are dynamically adjusted using a gating network.

[0019] Furthermore, the malicious code detection model includes three expert branches. Expert branch 1 is used to extract local information in the malicious code image, expert branch 2 is used to use dilated convolution to expand the receptive field and capture global features across multiple instructions, and expert branch 3 uses depthwise separable convolution to extract features.

[0020] Furthermore, the specific steps for training the malicious code detection model using known data sets are as follows:

[0021] Obtaining a malicious code binary sample and preprocessing the malicious code binary sample;

[0022] Divide the preprocessed malicious code binary samples into known category sample sets and unknown category sample sets;

[0023] The constructed malicious code detection model is trained using a known category sample set, and the parameters are optimized by minimizing the total loss function;

[0024] Use the unknown category sample set to test the trained sample set.

[0025] Furthermore, the total loss function includes the cross entropy loss function and the attention diversity loss function.

[0026] Furthermore, the Logit value is used to classify the input codes, and a dynamic threshold selection strategy is introduced to reject codes of unknown categories.

[0027] The second aspect of the present invention provides a malicious code identification system based on a dynamic multi-expert convolutional network, comprising:

[0028] A data acquisition module is configured to acquire the data to be detected and pre-process the data to be detected;

[0029] A model building module is configured to build a malicious code detection model, wherein the malicious code detection model includes a plurality of parallel expert branches and is capable of dynamically selecting an output combination of different expert branches;

[0030] A model training module, configured to train a malicious code detection model using a known data set;

[0031] The malicious code identification module is configured to use the trained malicious code detection model to perform malicious code identification on the data to be detected.

[0032] The third aspect of the present invention provides a medium on which a program is stored. When the program is executed by a processor, the steps in the malicious code identification method based on a dynamic multi-expert convolutional network as described in the first aspect of the present invention are implemented.

[0033] The fourth aspect of the present invention provides a device, including a memory, a processor, and a program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps in the malicious code identification method based on a dynamic multi-expert convolutional network as described in the first aspect of the present invention are implemented.

[0034] One or more of the above technical solutions have the following beneficial effects:

[0035] The present invention discloses a malicious code identification method and system based on a dynamic multi-expert convolutional network. First, the present invention can not only accurately identify known categories, but also effectively distinguish unknown category samples through open set recognition technology, thereby avoiding the misclassification problem caused by traditional methods to the greatest extent. Secondly, the dynamic multi-expert convolutional network structure is adopted, and different expert branches are combined to extract information from different feature dimensions, and the contribution of each branch is dynamically adjusted through a gating network to improve the recognition performance and robustness of complex malicious codes. In addition, the diversity loss function introduced by the present invention ensures the complementarity of the features of each expert branch, avoids redundant features, and improves classification accuracy and feature diversity.

[0036] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0038] Figure 1 This is a flow chart of a malicious code identification method based on a dynamic multi-expert convolutional network in Embodiment 1 of the present invention. DETAILED DESCRIPTION

[0039] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0040] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "include" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or their combinations;

[0041] Embodiment 1:

[0042] Embodiment 1 of the present invention provides a malicious code identification method based on a dynamic multi-expert convolutional network, such as Figure 1 As shown, the following steps are included:

[0043] Step 1: Obtain the data to be detected and preprocess the data to be detected.

[0044] Step 1.1: The specific steps for preprocessing the data to be detected are:

[0045] Step 1.1.1: Convert the data to be detected into a grayscale image as the input format of the model. During the conversion process, bytes are mapped to [0-255] decimal values ​​and stored in a one-dimensional array, where each value corresponds to a pixel in the grayscale image.

[0046] Step 1.1.2: Depending on the file size, the array will be rearranged into an image of fixed width and variable height.

[0047] Step 2: Build a malicious code detection model.

[0048] like Figure 1 As shown, the malicious code detection model includes multiple parallel expert branches and can dynamically select the output combination of different expert branches. In the model training stage of the present invention, the input data passes through the feature extractor and is sent to multiple expert branches for feature extraction and classification recognition. The model optimizes the classification accuracy and the diversity of feature extraction through a multi-task learning framework, combined with cross entropy loss and diversity loss functions. During the training process, the Adam optimizer is used for back propagation and parameter optimization. The specific steps are as follows:

[0049] Step 2.1: Use the feature extractor to perform preliminary feature extraction on the input malicious code sample to obtain an extracted preliminary feature map.

[0050] In a specific implementation, the feature extractor is based on the residual network (ResNet) architecture, and first preprocesses the input grayscale image of the malicious code through an initial convolution layer. This layer uses a 3x3 convolution kernel with a stride of 1 to extract preliminary local features of the image, and uses batch normalization and leaky ReLU activation functions to ensure computational stability. The initial convolution operation formula is as follows:

[0051] f conv1 (x)=LeakyReLU(BatchNorm(Conv2d(x;θ conv1 ))).

[0052] Among them, f conv1 (x) is the initial convolution operation function, θ conv1 are the trainable parameters of the initial convolutional layer and x is the input image.

[0053] Next, the input image is further extracted through multiple residual blocks (ResNet Block) to extract mid- and high-level features. Each residual block consists of two layers of 3x3 convolutional layers, and uses shortcut connections to avoid the gradient vanishing problem. The output of the residual block is:

[0054] f residual (x) = ReLU(f conv2 (x)+shortcut(x)).

[0055] Among them, f residual (x) is the residual function, f conv2 (x) is the feature map after two layers of convolution operations, and shortcut(x) is the feature map of the input image x after skip connection.

[0056] Step 2.2: Use multiple expert branches to further extract features from the preliminary feature map.

[0057] The structure of malicious code is usually mapped to certain patterns in the image, such as a specific binary structure, instruction sequence or characteristic byte pattern. In addition, the machine code data of the malicious code has strong local consistency. In view of the above-mentioned characteristics of the malicious code, this embodiment uses standard convolution to extract the malicious code features in the feature map, which can well capture the dependency between adjacent bytes and extract patterns with specific semantics during the code execution process.

[0058] The malicious code detection model set in this embodiment includes three expert branches. Expert branch 1 is used to extract local information in the malicious code image, expert branch 2 is used to use dilated convolution to expand the receptive field and capture global features across multiple instructions, and expert branch 3 uses depthwise separable convolution to extract features. The specific steps are as follows:

[0059] Step 2.2.1: Expert branch 1 uses standard convolution to extract local information from the malicious code image. The convolution operation processes the input feature map X in a sliding window manner through a fixed-size convolution kernel W, and the formula is:

[0060]

[0061] Among them, Y branch1,i,j is the preliminary output of expert branch 1, k is the radius of the convolution kernel, W m,n is the weight of the convolution kernel, X i,j is the pixel value at position (i, j) in the input feature map, and m and n are the offsets between the convolution kernel and the corresponding area of ​​the input feature map in the convolution operation. Through the sliding window mechanism, the model can capture local feature patterns in malicious code images, such as operator patterns, NOP slider sequences, etc.

[0062] In order to alleviate the gradient vanishing problem in deep networks, expert branch 1 uses the design of residual blocks to improve the stability of information transmission and ensure that complex features in malicious code images can be effectively extracted.

[0063] Combined with the residual block design, the output of expert branch 1 is:

[0064] f branch1 (x) = ReLU(Conv2d(x)+x).

[0065] Among them, f branch1 (x) is the output of expert branch 1.

[0066] Step 2.2.2: Expert branch 2 uses dilated convolution to expand the receptive field and capture global features across multiple instructions. The dilated convolution operation expands the receptive field by adjusting the interval of the convolution kernel elements. The formula is:

[0067]

[0068] Among them, Y branch2,i,j is the output of expert branch 2, d is the dilation rate, which controls the interval of the convolution kernel, and W m,n is the weight of the convolution kernel, X i,j is the pixel value of the input feature map (i, j). Dilated convolution can capture behavioral features across multiple instruction sets without increasing computational complexity, and is particularly suitable for cross-region feature extraction in malware.

[0069] Step 2.2.3: Expert branch 3 uses depthwise separable convolution to extract features and reduce computational cost.

[0070] Specifically, the features of malicious code are often distributed in multiple channels, which may represent different feature types, such as static features, dynamic behavior features, etc. Deep convolution extracts features from each channel separately, allowing the model to more accurately analyze each feature dimension of the malware.

[0071] Depthwise convolution applies convolution kernels to each channel separately without performing calculations across channels. The formula for depthwise convolution is:

[0072]

[0073] in, is the output of channel c, where c is the channel index of the input feature map, is the convolution kernel applied to channel c. Depthwise convolution improves computational efficiency by reducing the amount of computation.

[0074] Then, point-by-point convolution (1x1 convolution) is used to fuse the features of different channels. The formula is:

[0075]

[0076] Among them, Y branch3,i,j is the output of expert branch 3, C is the number of channels, W(c) is a 1x1 convolution kernel, is the characteristic of each channel.

[0077] Step 2.3: The outputs of different branches are dynamically weighted and fused to obtain the final feature map, where the output weights of different expert branches are dynamically adjusted using a gating network.

[0078] In a specific implementation, in order to improve the adaptability and robustness of the model, the gating network dynamically selects the outputs of different convolutional branches. The core of the gating network is to calculate the score g of each branch through a fully connected layer. q , the formula is:

[0079] g q =G(F(X)).

[0080] Among them, G(F) is the fully connected layer, F(X) is the global feature extracted by the shared layer, q represents the branch index, q = 1, 2, 3. The score is normalized by the Softmax function to generate the weight α of each branch q :

[0081]

[0082] Among them, T is the temperature parameter, which is used to smooth the weight. The gating network is finally based on the weight α q The output of each branch is weighted and summed to generate the final output feature map, where q and p are different branch indexes used to distinguish two branches, q = 1, 2, 3; p = 1, 2, 3:

[0083] Y out =α 1 Y branch1 +α 2 Y branch2 +α 3 Y branch3 .

[0084] Step 3: Use known datasets to train the malicious code detection model.

[0085] Step 3.1: Obtain a malicious code binary sample and preprocess the malicious code binary sample.

[0086] In this embodiment, the steps of preprocessing the malicious code binary sample are the same as the steps of preprocessing the data to be detected:

[0087] Step 3.1.1: Convert the malicious code binary sample to grayscale image as the input format of the model. During the conversion process, bytes are mapped to [0-255] decimal values ​​and stored in a one-dimensional array, where each value corresponds to a pixel in the grayscale image.

[0088] Step 3.1.2: Depending on the file size, the array will be rearranged into an image of fixed width and variable height.

[0089] Step 3.2: Divide the preprocessed malicious code binary samples into known category sample sets and unknown category sample sets.

[0090] In addition, the present invention provides a unified data processing pipeline to ensure the compatibility of different types of input data and convert them into consistent feature representations. In the data input stage, the data is divided into known and unknown categories, the known categories are used as training samples, and the unknown categories are used for testing and model validation.

[0091] Step 3.3: Use the known category sample set to train the constructed malicious code detection model and optimize the parameters by minimizing the total loss function.

[0092] During training, the model optimizes parameters by minimizing the total loss function. The total loss function includes the cross entropy loss function and the attention diversity loss function:

[0093] Step 3.3.1: Classification loss (cross entropy loss).

[0094]

[0095] Among them, L cls represents the cross entropy loss, N is the number of samples, y k is the one-hot representation of the true label of the sample, is the predicted probability distribution of the model, k represents the sample index, c represents the probability distribution index, and C represents the number of probability distributions.

[0096] Step 3.3.2: Diversity loss (attention diversity loss).

[0097]

[0098] Among them, L div represents the attention diversity loss, N is the number of samples, KL(·||·) represents the Kullback-Leibler divergence, β 1 and β g are the attention weights of different branches, and l and g represent the attention weight indexes of different branches.

[0099] The total loss function is:

[0100] L total =λ 1 L cls +λ 2 L div

[0101] Among them, L total is the total loss, λ 1 and λ 2 is the weight coefficient of classification loss and diversity loss.

[0102] Step 3.3.3: Use Adam optimizer to train the model and minimize the total loss function L total To update the network parameters. During the training process, dynamically adjust λ 1 and λ 2 to ensure that the model achieves a balance between classification accuracy and feature diversity.

[0103] Step 3.4: Use the Logit value to classify the input code, and introduce a dynamic threshold selection strategy to reject the code of unknown category.

[0104] Unlike Softmax output, Logit value, as the unnormalized score of model output, can more directly reflect the activation strength of each category. Since Logit value is not normalized, it can retain more realistic category preference information, especially in open set recognition, Logit value can better reflect the "uncertainty" of the model to unknown samples. Therefore, Logit value provides a more accurate judgment basis for the model, avoiding the false high confidence prediction caused by the Softmax normalization process.

[0105] Specifically, the maximum Logit value is used to indicate how strongly the model believes that the input sample belongs to a certain category:

[0106]

[0107] Among them, Logit(x) i is the Logit value of the input sample x in the i-th category, and mls is the maximum value of the Logit values ​​of all categories.

[0108] In order to achieve effective rejection of unknown categories, the present invention introduces a dynamic threshold selection strategy. Since the open set recognition model not only needs to distinguish known categories, but also needs to identify and reject unknown categories, the method of this embodiment only contacts known data and does not contact unknown data during the training process, and uses a dynamic threshold selection strategy to distinguish known categories from unknown categories. By calculating the Logit value output by the model and combining it with a threshold that matches the target true positive rate (TPR), it is possible to accurately determine whether a sample is a known category or should be classified as an unknown category.

[0109] The specific approach is to calculate the ROC curve (receiver operating characteristic curve) and select the threshold closest to the target true positive rate (TPR) of 0.95. This threshold is used to distinguish samples of known categories from samples of unknown categories. This dynamic threshold selection strategy ensures that the model can accurately identify unknown categories while maintaining high classification accuracy of known categories at high TPR. By selecting a suitable threshold, the model can significantly reduce the risk of misclassifying unknown samples as known categories when faced with them.

[0110] Step 3.5: Use the unknown category sample set to test the trained sample set.

[0111] Step 4: Use the trained malicious code detection model to identify malicious code on the data to be detected.

[0112] Step 5: Evaluate and verify.

[0113] This embodiment conducts experiments on two public malware datasets, including the Malware Classification Challenge (BIG2015) and the Malige dataset. The BIG 2015 dataset is released by Microsoft. It consists of 10,868 publicly available labeled malware instances with binary and disassembled files from 9 families. The Malige dataset contains a total of 9,339 malware instances covering 25 families. The malware binary sequences are grouped into 8-bit vectors and then presented in the form of grayscale images.

[0114] The performance of open-set malware recognition can be evaluated through two parallel tasks, including multi-family classification and unknown detection.

[0115] Multi-family classification: The goal of multi-family classification is to classify malware instances belonging to known families as accurately as possible. Its performance is evaluated by the classification accuracy CAcc, which is defined as follows:

[0116]

[0117] Among them, N instance is the total number of malware instances in the test, N correct is the number of correctly classified malware instances. This definition corresponds to the traditional accuracy of most malware classification models.

[0118] Unknown detection: The goal of unknown detection is to detect malware instances belonging to a newly emerged unknown family with high accuracy. In order to calculate the detection accuracy D Acc, it is necessary to consider both known and unknown families of malware instances in the test. First, the true positive rate TPR of known family instances is calculated. (K) , the formula is as follows:

[0119]

[0120] Among them, TP (K) and FN (K) represent true positives and false negatives of known families, respectively.

[0121] Then calculate the true negative rate TNR(U) of the unknown family instance, the formula is as follows:

[0122]

[0123] Among them, TN (U) and FP (U) Represent the true negative and false positive of unknown families respectively. Detection accuracy D Acc The calculation formula is:

[0124]

[0125] The experimental results are shown in Table 1 and Table 2:

[0126] Table 1 Comparison results on the BIG2015 dataset

[0127]

[0128] Table 2 Comparison results on the BIG2015 dataset

[0129]

[0130] As can be seen from the above table, in the DMECNet advancedness comparison experiment for the BIG2015 dataset, this embodiment selected a variety of classical machine learning (CML), deep learning (DL), and extreme value theory (EVT)-based methods as benchmark models, including Drew et al., OpenMax, EVM, etc., a total of 14 competitors, among which the method of Guo et al. is the most advanced. Each method was tested on the BIG2015 dataset to evaluate its performance in known class classification accuracy (C_Acc%) and unknown class detection accuracy (D_Acc%). The comparison results on the BIG 2015 dataset are shown in Table 2. It can be seen that the model of the present invention outperforms all competitors, with the highest accuracy of classification and detection (if the competitor is applicable), which are 99.25% and 95.23% respectively. In addition, two observations can be made. First, although the segmentation of the dataset in this embodiment sacrifices more training data as test data (known and unknown), that is, only 6900 instances corresponding to about 63% of the entire dataset are used for training, the model of the present invention can still obtain the best results. Secondly, compared with other methods, DMECNet has significant effects. Even compared with the most advanced method (Guo et al.), the classification rate and detection rate of this embodiment are improved. Among them, the detection rate is about 2.5% higher than the most advanced method, which fully proves the effectiveness of the model of the present invention.

[0131] Similarly, in the DMECNet advanced comparative experiment for the Malimg dataset, the methods selected in this embodiment include a series of classical machine learning (CML) and deep learning (DL) methods, which are used for the known class classification and unknown class detection tasks of the Malimg dataset. Classical machine learning methods (CML) such as Nataraj et al., Burnaev et al., Kalash et al., etc., mainly rely on traditional static features and classification techniques to classify known classes, but lack the ability to cope with open set tasks. Deep learning methods (DL) such as SoftMax-DNNs, tGAN, OpenMax and other deep learning models improve the performance of classification and detection through deep neural networks (DNN) or generative adversarial networks (GAN). Extreme value theory (EVT) methods such as EVM use extreme value distribution theory to handle the detection of unknown categories. Combination methods: such as MCNN and IMCFN, they improve detection performance through multi-task learning or combining multiple feature extraction methods. The comparison results on the Malimg dataset are shown in Table 2. It can also be observed that the model of the present invention also obtains the best results in classification and detection (if applicable to competitors) accuracy, which are 99.32% and 94.36% respectively. Compared with the most advanced MDENet, the detection accuracy is improved by 3.71% while maintaining a high classification rate.

[0132] Experimental results show that on multiple public data sets (such as BIG2015 and Malimg), the model of the present invention outperforms existing classical machine learning, deep learning and extreme value theory-based methods in terms of classification accuracy and unknown category detection accuracy, demonstrating excellent performance. In general, the present invention has significant advantages in improving the accuracy of malicious code open set detection, reducing computational complexity, and enhancing robustness, and is suitable for complex and variable malicious code open set identification tasks.

[0133] Embodiment 2:

[0134] Embodiment 2 of the present invention provides a malicious code identification system based on a dynamic multi-expert convolutional network, including:

[0135] A data acquisition module is configured to acquire the data to be detected and pre-process the data to be detected;

[0136] A model building module is configured to build a malicious code detection model, wherein the malicious code detection model includes a plurality of parallel expert branches and is capable of dynamically selecting an output combination of different expert branches;

[0137] A model training module, configured to train a malicious code detection model using a known data set;

[0138] The malicious code identification module is configured to use the trained malicious code detection model to perform malicious code identification on the data to be detected.

[0139] Embodiment three:

[0140] Embodiment 3 of the present invention provides a medium on which a program is stored. When the program is executed by a processor, the steps of the malicious code identification method based on a dynamic multi-expert convolutional network as described in Embodiment 1 of the present invention are implemented.

[0141] Embodiment 4:

[0142] Embodiment 4 of the present invention provides a device, including a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, the steps in the malicious code identification method based on a dynamic multi-expert convolutional network as described in Embodiment 1 of the present invention are implemented.

[0143] The steps involved in the above embodiments 2, 3 and 4 correspond to the method embodiment 1. For the specific implementation methods, please refer to the relevant description part of embodiment 1.

[0144] Those skilled in the art should understand that the modules or steps of the present invention described above can be implemented by a general-purpose computer device, or alternatively, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. The present invention is not limited to any specific combination of hardware and software.

[0145] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. A malicious code identification method based on a dynamic multi-expert convolutional network, characterized in that: The following steps are involved: Acquire the data to be detected and pre-process the data to be detected; Constructing a malicious code detection model, wherein the malicious code detection model includes multiple parallel expert branches and can dynamically select output combinations of different expert branches; Use known data sets to train malicious code detection models; Use the trained malicious code detection model to identify malicious code in the data to be detected.

2. The malicious code identification method based on dynamic multi-expert convolutional network as claimed in claim 1, characterized in that: The specific steps for preprocessing the data to be detected are: Convert the data to be detected into a grayscale image. During the conversion process, bytes are mapped to decimal values ​​and stored in a one-dimensional array, where each value corresponds to a pixel in the grayscale image. Depending on the file size, the array will be rearranged into an image of fixed width and variable height.

3. The malicious code identification method based on dynamic multi-expert convolutional network as claimed in claim 1, characterized in that: The specific steps to build a malicious code detection model include: Using the feature extractor to perform preliminary feature extraction on the input malicious code sample to obtain a preliminary feature map; Use multiple expert branches to further extract features from the preliminary feature map; The final feature map is obtained after dynamic weighted fusion of the outputs of different branches, in which the output weights of different expert branches are dynamically adjusted using a gating network.

4. The malicious code identification method based on dynamic multi-expert convolutional network as claimed in claim 3 is characterized in that: The malicious code detection model consists of three expert branches. Expert branch 1 is used to extract local information in the malicious code image. Expert branch 2 is used to use dilated convolution to expand the receptive field and capture global features across multiple instructions. Expert branch 3 uses depthwise separable convolution to extract features.

5. The malicious code identification method based on dynamic multi-expert convolutional network as claimed in claim 1, characterized in that: The specific steps for training a malicious code detection model using a known data set are: Obtaining a malicious code binary sample and preprocessing the malicious code binary sample; Divide the preprocessed malicious code binary samples into known category sample sets and unknown category sample sets; The constructed malicious code detection model is trained using a known category sample set, and the parameters are optimized by minimizing the total loss function; Use the unknown category sample set to test the trained sample set.

6. The malicious code identification method based on dynamic multi-expert convolutional network as claimed in claim 5, characterized in that: The total loss function includes the cross entropy loss function and the attention diversity loss function.

7. The malicious code identification method based on dynamic multi-expert convolutional network as claimed in claim 1, characterized in that: The Logit value is used to classify the input code, and a dynamic threshold selection strategy is introduced to reject the code of unknown category.

8. The malicious code identification system based on dynamic multi-expert convolutional network is characterized by: include: A data acquisition module is configured to acquire the data to be detected and pre-process the data to be detected; A model building module is configured to build a malicious code detection model, wherein the malicious code detection model includes a plurality of parallel expert branches and is capable of dynamically selecting an output combination of different expert branches; A model training module, configured to train a malicious code detection model using a known data set; The malicious code identification module is configured to use the trained malicious code detection model to perform malicious code identification on the data to be detected.

9. A computer-readable storage medium, characterized in that: A plurality of instructions are stored therein, and the instructions are suitable for being loaded by a processor of a terminal device and executing the malicious code identification method based on a dynamic multi-expert convolutional network described in any one of claims 1 to 7.

10. A terminal device, characterized in that: It includes a processor and a computer-readable storage medium, the processor is used to implement each instruction; the computer-readable storage medium is used to store multiple instructions, and the instructions are suitable for being loaded by the processor and executing the malicious code identification method based on a dynamic multi-expert convolutional network as described in any one of claims 1-7.

Images