Code type detection model training method and code type detection method

Abstract

The embodiment of the invention relates to the technical field of machine learning, in particular to a code type detection model training method and a code type detection method, and the method comprises the steps: dividing a target code file into a training set and a test set; converting the code files in the training set into a vector set based on the similarity among the characters in the training set; extracting a feature vector set from the vector set based on the repetition condition of each character in the total character by using a satin blue kingpin algorithm; classifying the features of the feature vector set according to the features corresponding to different types of codes to form detection standards of the code types; and testing the detection standard by using the test set until the test requirement is met, thereby obtaining the code type detection model. According to the method, the feature vector sets are classified according to the features corresponding to the different types of codes to form the detection standard of the code types, so that the model can automatically learn and recognize the mode of malicious code behaviors, and unknown or variant malicious codes are effectively detected.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of machine learning, and in particular to a method for training a code type detection model and a method for detecting a code type. Background Art

[0002] With the rapid development of information technology, the threat of malicious code (such as viruses, worms, Trojan horses, etc.) to computer systems and networks is increasing. Traditional malicious code detection methods rely on signature matching technology, which requires that known malicious code samples can be identified in advance and added to the database.

[0003] However, this method cannot effectively deal with zero-day attacks and continuously evolving malicious code. Therefore, a more intelligent and adaptive malicious code detection method is needed. Summary of the invention

[0004] The purpose of the present invention is to at least provide a training method for a code type detection model, which can at least solve the technical problem that traditional malicious code detection methods cannot effectively deal with zero-day attacks and continuously evolving malicious codes, and at least achieve the effect of adaptive learning and identification of continuously evolving malicious codes.

[0005] To solve the above technical problems, at least one embodiment of the present application provides a method for training a code type detection model, including:

[0006] Divide the target code files into training sets and test sets;

[0007] Based on the similarity between the characters in the training set, converting the code files in the training set into a vector set;

[0008] Using the Satin Bowerbird algorithm, based on the repetition of each of the characters in the total characters, extracting a feature vector set from the vector set;

[0009] Classifying the features of the feature vector set according to the features corresponding to different types of codes to form a detection standard for the code type;

[0010] The detection standard is tested using the test set until the test requirements are met, thereby obtaining a code type detection model.

[0011] At least one embodiment of the present application further provides a method for detecting a code type, comprising:

[0012] Get the code file to be tested;

[0013] The code file to be tested is detected by using the code type detection model trained using the above-mentioned code type detection model training method.

[0014] At least one embodiment of the present application further provides a training device for a code type detection model, comprising:

[0015] A partitioning module is used to partition the target code file into a training set and a test set;

[0016] A conversion module, used for converting the code files in the training set into a vector set based on the similarity between the characters in the training set;

[0017] An extraction module, configured to extract a feature vector set from the vector set based on the repetition of each character in the total characters by using a satin bowerbird algorithm;

[0018] A classification module, used to classify the features of the feature vector set according to the features corresponding to different types of codes, so as to form a detection standard for the code type;

[0019] The testing module is used to test the detection standard using the test set until the test requirements are met to obtain a code type detection model.

[0020] At least one embodiment of the present application also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned code type detection model training method, or code type detection method.

[0021] At least one embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-mentioned method for training a code type detection model or a method for detecting a code type.

[0022] The embodiments of the present application provide a training method for a code type detection model and a method for detecting a code type. In the training method, the code file is converted into a vector set using the similarity between characters. The character similarity can reflect slight changes in the code, thereby being able to capture the grammatical and structural information in the code, and helping to improve the detection rate of slightly modified malicious code; the satin blue bowerbird algorithm is used to extract a feature vector set. The algorithm is based on the repetition of characters in the total characters, so that those character patterns that frequently appear in malicious code can be highlighted, thereby effectively extracting the features of malicious code. The feature vector set is classified according to the features corresponding to different types of codes to form a detection standard for the code type. This process converts complex code features into clear detection rules, allowing the model to more intuitively determine whether the code is malicious code.

[0023] It is worth mentioning that the step factor in the satin blue bowerbird algorithm is dynamically adjusted according to the selected probability of the target position. When the selected probability of the target position is greater, the step length is smaller, otherwise the step length is larger. This adaptive mechanism enables the algorithm to automatically adjust its search strategy during the search process. For malicious code detection, because malicious code often has complexity and diversity, the algorithm needs to have the ability to jump out of the local optimum to discover potential malicious behavior. Therefore, the satin blue bowerbird algorithm can more flexibly deal with different types of malicious code. As new malicious code features are discovered or data sets change, the algorithm can easily expand and update its feature set and search strategy. The model trained using the method of the present embodiment can adapt to different types of malicious code, whether it is a new malicious code variant or a malicious code that has been obfuscated, it can be accurately identified by the model.

[0024] In some optional embodiments, the target code file includes malicious code.

[0025] In some optional embodiments, converting the code files in the training set into a vector set based on the similarity between the characters in the training set includes:

[0026] Use the embedding module to convert each character into a corresponding character vector;

[0027] Calculating the similarity between the character vectors, and grouping the character vectors according to the similarity;

[0028] Based on the grouping results of each of the character vectors, a vector set of the code files in the training set is generated.

[0029] In this embodiment, the semantic relationship between characters can be captured by the embedding module, and each character is converted into a character vector of fixed dimension. Compared with the traditional string matching method, the vector-based representation is more efficient in calculating similarity. The dimension of the character vector is usually much smaller than the length of the string, so the similarity calculation is faster.

[0030] In some optional embodiments, the calculating the similarity between the character vectors includes:

[0031] The similarity between the character vectors is calculated using the following formula:

[0032]

[0033] Among them, w i character vector representing character i, w j a character vector representing character j, represents a single context character vector, P ikrepresents the probability of character k appearing in the context of character i, P jk It represents the probability of character k appearing in the context of character j.

[0034] In this embodiment, by introducing the context character vector and the probability of occurrence of the character in the context, the method can more accurately capture the semantic information of the character. The semantics of a character depends not only on the character itself, but also on its position in a sentence or paragraph and the surrounding characters. After considering the context information, the similarity calculation between character vectors will be more accurate, which will help to more accurately group the character vectors and generate the vector set of the code file in the subsequent steps.

[0035] In some optional embodiments, the method of extracting a feature vector set from the vector set based on the repetition of each character in the total characters using the Satin Bowerbird algorithm includes:

[0036] Using the Satin Bowerbird algorithm, based on the following fitness value function, in each round of population iteration, the individual with the smallest fitness value is retained, and each individual is used to characterize a characteristic parameter.

[0037]

[0038] Among them, |Fs| represents the fitness value function, λ is the parameter that affects the results of the classification stage, ξ is the error value, Ne is the total number of characters that appear most frequently, and N s is the total number of characters of the code files in the training set;

[0039] The characteristic parameters corresponding to each of the individuals are retained as the characteristic vector set.

[0040] In this example, the fitness value function comprehensively considers the parameters, error values, and character repetitions that affect the results of the classification stage, so that the pros and cons of individuals can be evaluated more accurately. Retaining the individual with the smallest fitness value means that the optimal feature parameter combination is selected, which helps to improve the accuracy of malicious code detection.

[0041] In some optional embodiments, classifying the features of the feature vector set according to the features corresponding to different types of codes includes:

[0042] According to the features corresponding to different types of codes, the features of the feature vector set are classified using a cascade capsule network.

[0043] In this embodiment, the capsule network has a stronger feature representation capability than the traditional convolutional neural network (CNN). Each capsule can represent a specific entity and its attributes. Through the dynamic routing mechanism, the capsule network can better model the hierarchical and spatial relationships in the data. This capability enables the cascade capsule network to more accurately capture the characteristics and frequency of occurrence of malicious code, thereby improving the accuracy of classification.

[0044] In some optional embodiments, the testing the detection standard using the test set until the test requirements are met includes:

[0045] Using the Satin Bowerbird algorithm, the parameters of the cascade capsule network are optimized with the goal of minimizing entropy loss, where the entropy loss is used to characterize the difference between the classification result of the cascade capsule network and the true label;

[0046] An initial code type detection model is established based on the optimized parameters, the test set is identified using the initial code type detection model, and the identified results and the performance of the model are evaluated until the test requirements are met.

[0047] In this embodiment, the parameters of the cascade capsule network are optimized by the Satin Blue Bowerbird algorithm with the goal of minimizing entropy loss, so that the difference between the classification result of the network and the true label can be minimized. As an intelligent optimization algorithm, the Satin Blue Bowerbird algorithm has good global search capabilities and local optimization capabilities, and can find the optimal solution or approximate optimal solution in the parameter space. This helps to improve the classification accuracy of the cascade capsule network, thereby enhancing the performance of the code type detection model. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] One or more embodiments are exemplarily described by the pictures in the corresponding drawings, and these exemplary descriptions do not constitute limitations on the embodiments.

[0049] Figure 1 This is a process of a method for training a code type detection model provided by an embodiment of the present application. Figure 1 ;

[0050] Figure 2 This is a process of a method for training a code type detection model provided by an embodiment of the present application. Figure 2 ;

[0051] Figure 3 It is a schematic diagram of a training device for a code type detection model provided by another embodiment of the present application. DETAILED DESCRIPTION

[0052] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the present application, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can also be implemented. The division of the following embodiments is for the convenience of description, and the specific implementation of the present application should not be construed as any limitation, and the various embodiments can be combined and referenced with each other under the premise of no contradiction.

[0053] In order to solve the technical problem that the above-mentioned traditional malicious code detection method cannot effectively deal with zero-day attacks and continuously evolving malicious codes, the present invention proposes a training method for a code type detection model. The implementation details of the training method for the code type detection model of this embodiment are specifically described below. The following content is only the implementation details provided for the convenience of understanding and is not necessary for the implementation of this solution.

[0054] Embodiment 1:

[0055] The training method of the code type detection model of this embodiment can be applied to electronic devices with communication, computing and data storage capabilities. The specific process can be as follows: Figure 1 As shown, including:

[0056] Step 110, dividing the target code file into a training set and a test set;

[0057] In this embodiment, the target code file needs to be divided into a training set and a test set. Usually, the training set is used to train the model, while the test set is used to evaluate the performance of the model. In order to ensure the generalization ability of the model, the training set and the test set should be independent and as representative as possible.

[0058] The specific process is as follows:

[0059] Collect target code files, including known malicious code and benign code; divide the target code files into training sets and test sets according to requirements and data volume. For example, 70% of the data can be used as a training set and 30% of the data can be used as a test set; ensure that the distribution of malicious code and benign code in the training set and the test set is consistent to avoid data bias.

[0060] For example, suppose 1,000 target code files are collected, of which 500 are malicious code and 500 are benign code. These files can be randomly divided into 700 training set files (350 malicious code and 350 benign code) and 300 test set files (150 malicious code and 150 benign code).

[0061] Step 120, based on the similarity between the characters in the training set, convert the code files in the training set into a vector set;

[0062] In this example, the code files in the training set need to be converted into vector sets for subsequent processing. This process involves character embedding and similarity calculation. The details are as follows:

[0063] Use character embedding technology to convert characters in code files into character vectors;

[0064] To calculate the similarity between character vectors, you can use cosine similarity, Euclidean distance and other measurement methods;

[0065] According to the similarity, the code files are converted into vector sets. For example, each code file can be represented as a vector, where each element of the vector represents the similarity score between character vectors.

[0066] For example: a code file "int main(){return 0;}" uses character embedding technology to convert each character (such as 'i', 'n', 't', etc.) into a character vector. Then, the similarity between these character vectors is calculated and the results are stored in a vector. For example, the first element in the vector may represent the similarity score between the characters 'i' and 'n', the second element may represent the similarity score between the characters 'n' and 't', and so on. In the end, we can get a vector representing the code file. The vectors of each code file are combined to form a vector set.

[0067] Step 130, using a satin bowerbird algorithm, based on the repetition of each of the characters in the total characters, extracting a feature vector set from the vector set;

[0068] In this embodiment, the satin blue bowerbird algorithm is used to extract a feature vector set from a vector set. The satin blue bowerbird algorithm is an intelligent optimization algorithm that can automatically search for an optimal solution or a near-optimal solution. The implementation process is as follows:

[0069] Initialize the parameters of the Satin Bowerbird algorithm, such as population size, number of iterations, mutation rate, etc.

[0070] Each vector in the vector set is regarded as an individual, and the fitness value of the individual is calculated according to the repetition of each character in the total characters;

[0071] Sort individuals according to their fitness values, and select individuals with higher fitness values ​​as parents for crossover and mutation operations;

[0072] Through continuous iteration, the fitness value of the individual is gradually optimized until the stopping condition is met (such as reaching the maximum number of iterations or the fitness value no longer improves);

[0073] A feature vector set is extracted from the final individuals.

[0074] For example, there is a vector set that contains multiple vectors representing code files. Use the Satin Bowerbird algorithm to search and optimize these vectors. The elements of each vector (i.e., the similarity score between character vectors) can be used as the characteristics of the individual, and the fitness value of the individual can be calculated based on these characteristics. Then, individuals with higher fitness values ​​are selected for crossover and mutation operations to generate new individuals. Through continuous iteration, a population containing the optimal feature vector set is obtained.

[0075] Step 140, classifying the features of the feature vector set according to the features corresponding to different types of codes to form a detection standard for the code type;

[0076] In this embodiment, the features of the feature vector set are classified to form a detection standard for the code type. This process can be achieved through machine learning algorithms (such as support vector machines, random forests, etc.) or deep learning models (such as neural networks, convolutional neural networks, etc.). The details are as follows:

[0077] Select an appropriate machine learning algorithm or deep learning model and train the model based on the feature vector set;

[0078] Verify and tune the trained model to ensure that its performance meets the requirements;

[0079] Use the trained model to classify the features in the feature vector set to form a detection standard for code types.

[0080] For example, a support vector machine is selected as a classifier and trained using a feature vector set. During the training process, methods such as cross-validation are used to evaluate the performance of the model, and the model is tuned based on the evaluation results. Finally, a trained support vector machine model is obtained, which can classify the features in the feature vector set and output the detection criteria for malicious code and benign code.

[0081] Step 150, using the test set to test the detection standard until the test requirements are met, thereby obtaining a code type detection model.

[0082] In this embodiment, the test set is used to test the detection standard of malicious code to ensure its performance in actual applications. If the test results do not meet the requirements, the model needs to be further tuned and improved. The details are as follows:

[0083] Use the code files in the test set to test the detection criteria for malicious code;

[0084] Evaluate the performance of the model based on the test results, including accuracy, recall, F1 score and other indicators;

[0085] If the test results do not meet the requirements, further tune and improve the model, such as adjusting model parameters, adding features, etc.

[0086] Repeat the testing and improvement process until the test requirements are met; apply the final code type detection model to the actual environment for monitoring and detection.

[0087] For example, 300 test set files were used to test the detection criteria for malicious code. During the test, indicators such as the accuracy, recall, and F1 score of the model were calculated, and the model was evaluated based on these indicators. If the test results do not meet the requirements (for example, the accuracy is less than 90%), the model is further tuned and improved. For example, try to add more features, adjust model parameters, or use a more complex model structure to improve the performance of the model. Then, the model is tested again using the test set, and iterative improvements are made based on the test results. Finally, when the model meets the test requirements (for example, the accuracy is higher than 95%), it can be applied to the actual environment for monitoring and detection.

[0088] In summary, the training method of the code type detection model provided in this embodiment converts the code file into a vector set by using the similarity between characters. The character similarity can reflect the slight changes in the code, so that the grammatical and structural information in the code can be captured, which helps to improve the detection rate of slightly modified malicious code; the satin blue bowerbird algorithm is used to extract the feature vector set. The algorithm is based on the repetition of characters in the total characters, so that those character patterns that frequently appear in malicious codes can be highlighted, thereby effectively extracting the characteristics of malicious codes. The feature vector set is classified according to the features corresponding to different types of codes to form a detection standard for the code type. This process converts complex code features into clear detection rules, so that the model can more intuitively determine whether the code is malicious code.

[0089] It is worth mentioning that the step factor in the satin blue bowerbird algorithm is dynamically adjusted according to the selected probability of the target position. When the selected probability of the target position is greater, the step length is smaller, otherwise the step length is larger. This adaptive mechanism enables the algorithm to automatically adjust its search strategy during the search process. For malicious code detection, because malicious code often has complexity and diversity, the algorithm needs to have the ability to jump out of the local optimum to discover potential malicious behavior. Therefore, the satin blue bowerbird algorithm can more flexibly deal with different types of malicious code. As new malicious code features are discovered or data sets change, the algorithm can easily expand and update its feature set and search strategy. The model trained using the method of the present embodiment can adapt to different types of malicious code, whether it is a new malicious code variant or a malicious code that has been obfuscated, it can be accurately identified by the model.

[0090] In some embodiments, converting the code files in the training set into a vector set based on the similarity between the characters in the training set includes: using an embedding module to convert each character into a corresponding character vector; calculating the similarity between each of the character vectors, and grouping each of the character vectors according to the similarity; and generating a vector set of the code files in the training set based on the grouping results of each of the character vectors.

[0091] In this embodiment, an embedding module (such as a pre-trained language model such as Word2Vec, BERT, GPT, or a custom character embedding layer) is used to convert each character in the code file into a corresponding character vector. A character vector is a fixed-length numerical array that can capture the semantic and grammatical relationships between characters.

[0092] For example, iterate over each character in each code file in the training set and convert it into a character vector using the Word2Vec module. Store the converted character vectors in an appropriate data structure, such as a list or matrix, for subsequent processing.

[0093] Taking the code snippet “int main(){return 0;}” as an example, this module converts the character “i” into the vector [0.1, 0.2, ..., 0.9] (just an example, the actual vector length and value may be different), the character “n” into the vector [0.2, 0.1, ..., 0.8], and so on.

[0094] Next, the similarity between the character vectors is calculated, and the character vectors are grouped according to the similarity. The similarity can be calculated by measuring methods such as cosine similarity, Euclidean distance, Manhattan distance, etc. Then, based on the similarity value, the character vectors can be grouped so that the character vectors in each group are closer in semantics or syntax.

[0095] For example: Choose an appropriate similarity measure. For each character vector, calculate its similarity with other character vectors in the training set. Group character vectors based on a similarity threshold or clustering algorithm (such as K-means, DBSCAN, etc.). Consider using more complex clustering methods such as hierarchical clustering or graph clustering to capture the complex relationships between characters.

[0096] Continuing with the example above, the similarity between the vectors of the characters "i" and "n" is calculated, assuming it is 0.8 (high similarity). At the same time, the similarity between the vectors of "i" and "{" is also calculated, assuming it is 0.2 (low similarity). Based on these similarity values, "i" and "n" can be grouped into one group, and "{" can be grouped into another group.

[0097] Afterwards, based on the grouping results of each character vector, a vector set of the code files in the training set is generated. This process can be implemented in a variety of ways, for example: for each group, the average or weighted average of all character vectors in the group is calculated as the representative vector of the group. For each code file, according to the group to which the characters it contains belong, the representative vectors of these groups are combined or concatenated to form the vector representation of the code file. The vector representations of all code files are stored in an appropriate data structure, such as a matrix or a sparse matrix, for subsequent feature extraction and classification.

[0098] For example, there are three groups, each representing a different character category (such as a keyword, an identifier, or a symbol). For the code file "int main(){return 0;}", the average value of the character vectors in each group is calculated as the representative vector of the group. Then, these representative vectors are concatenated or combined to form the vector representation of the code file. If the representative vector of the first group is [0.5, 0.6, ...], the representative vector of the second group is [0.7, 0.5, ...], and the representative vector of the third group is [0.2, 0.1, ...], then the vector representation of the code file is [0.5, 0.6, ..., 0.7, 0.5, ..., 0.2, 0.1, ...].

[0099] In some possible embodiments, the calculating the similarity between the character vectors includes:

[0100] The similarity between the character vectors is calculated using the following formula:

[0101]

[0102] Among them, w i character vector representing character i, w j a character vector representing character j, represents a single context character vector, Pik represents the probability of character k appearing in the context of character i, P jk It represents the probability of character k appearing in the context of character j.

[0103] A separate context character vector refers to a vector representation generated for a single character in a specific context to capture the semantic and contextual information of the character in a specific context. By introducing context character vectors and the probability of occurrence of characters in context, the semantic information of characters can be captured more accurately. The semantics of a character depends not only on the character itself, but also on its position in a sentence or paragraph and the surrounding characters. After considering the context information, the similarity calculation between character vectors will be more accurate, which will help to more accurately group character vectors and generate vector sets of code files in subsequent steps.

[0104] In some possible embodiments, the extracting a feature vector set from the vector set based on the repetition of each character in the total characters using the satin blue bowerbird algorithm includes: using the satin blue bowerbird algorithm based on the following fitness value function, in each round of population iteration, retaining the individual with the smallest fitness value, each of the individuals is used to characterize a feature parameter,

[0105]

[0106] Among them, |F s | represents the fitness value function, λ is the parameter that affects the results of the classification stage, ξ is the error value, N e N is the total number of characters that appear most frequently. s is the total number of characters of the code files in the training set;

[0107] The characteristic parameters corresponding to each of the individuals are retained as the characteristic vector set.

[0108] In this embodiment, the fitness value function comprehensively considers the parameters, error values, and character repetitions that affect the results of the classification stage, so that the pros and cons of individuals can be evaluated more accurately. Retaining the individual with the smallest fitness value means selecting the optimal feature parameter combination, which helps to improve the accuracy of malicious code detection.

[0109] In some optional embodiments, classifying the features of the feature vector set according to the features corresponding to different types of codes includes: classifying the features of the feature vector set using a cascade capsule network according to the features corresponding to different types of codes.

[0110] In this embodiment, in order to improve the accuracy and robustness of classification, the Cascaded Capsule Network (CCN) in deep learning is used to classify the feature vector set. The Cascaded Capsule Network combines the advantages of the Convolutional Neural Network (CNN) and the Capsule Network, and can more effectively capture the characteristics of malicious code and accurately classify it. The specific classification process is as follows:

[0111] 1) Extract the features of malicious code from the feature vector set and perform appropriate preprocessing.

[0112] Features may include structural features, grammatical features, semantic features, and statistical features of the code (such as character frequency, function call frequency, etc.). Preprocessing includes normalizing the feature vector set to ensure that different features are numerically at the same magnitude. If the feature vector set contains high-dimensional data, consider using dimensionality reduction techniques (such as PCA, t-SNE, etc.) to reduce the dimensionality of the data while retaining key information.

[0113] For example, there is a feature vector set that contains features of multiple malicious code samples. These features may include keyword frequencies, function call sequences, control flow graphs, etc. In the preprocessing stage, these features are normalized and high-dimensional features are reduced to appropriate dimensions.

[0114] 2) Constructing a cascade capsule network

[0115] Construct a cascade capsule network to classify a set of feature vectors. The cascade capsule network consists of multiple capsule layers, each of which contains multiple capsule units that can capture the spatial relationship and hierarchical structure between features. Choose appropriate activation function and loss function to train the capsule network. For example, you can use the Squash activation function and the Margin Loss loss function.

[0116] During the training process, the back-propagation algorithm is used to update the weights and biases of the capsule network.

[0117] For example, a cascade capsule network with two capsule layers is constructed. The first capsule layer contains multiple primary capsule units to capture the basic features of malicious code. The second capsule layer contains fewer advanced capsule units to capture more complex features and patterns. The Squash activation function is used to activate the capsule units, and the Margin Loss loss function is used to optimize the network.

[0118] 3) Optimize the model

[0119] After building the cascade capsule network, use the training data to train the network and optimize it. The training data includes multiple malicious code samples and their corresponding labels (such as malware type, attack method, etc.). Divide the training data into training set and validation set to verify the model during the training process. Use appropriate optimization algorithms (such as Adam, SGD, etc.) to train the capsule network. During the training process, monitor the model's loss value and accuracy, so that the training parameters and network structure can be adjusted in time.

[0120] 4) Classification and evaluation

[0121] After training the cascade capsule network, use the test data to evaluate the classification performance of the model. The test data should include multiple unknown malicious code samples, which should be different from the malicious code samples in the training data. Visualization tools such as confusion matrix and ROC curve can be used to more intuitively evaluate the performance of the model.

[0122] In this embodiment, the capsule network has a stronger feature representation capability than the traditional convolutional neural network (CNN). Each capsule can represent a specific entity and its attributes. Through the dynamic routing mechanism, the capsule network can better model the hierarchical and spatial relationships in the data. This capability enables the cascade capsule network to more accurately capture the characteristics and frequency of occurrence of malicious code, thereby improving the accuracy of classification.

[0123] In some optional embodiments, the detection standard is tested using the test set until the test requirements are met, including: using the Satin Bowerbird algorithm to optimize the parameters of the cascade capsule network with the goal of minimizing entropy loss, and the entropy loss is used to characterize the difference between the classification results of the cascade capsule network and the true label; establishing an initial code type detection model based on the optimized parameters, using the initial code type detection model to identify the test set, and evaluating the identified results and the performance of the model until the test requirements are met.

[0124] In this embodiment, the process of optimizing parameters using the Satin Bowerbird algorithm is as follows:

[0125] Step 1: Initialize parameters

[0126] Randomly initialize the parameters of the cascade capsule network (such as weights and biases), as well as the relevant parameters of the Satin Bowerbird algorithm (such as population size, number of iterations, search space, etc.).

[0127] Step 2: Define the fitness function

[0128] Entropy loss is used as the fitness function, which is used to characterize the difference between the classification results of the cascade capsule network and the true label. The smaller the entropy loss, the better the classification performance of the model.

[0129] Step 3: Build the nest

[0130] In the search space, each individual Satin Bowerbird represents a possible parameter combination (i.e., a nest). According to the fitness function, the fitness value of each nest is calculated.

[0131] Step 4: Update the nest

[0132] According to the fitness value, high-quality nests (i.e., parameter combinations) are selected for crossover and mutation operations to generate new nests (i.e., new parameter combinations).

[0133] Step 5: Iterative Optimization

[0134] Repeat steps 3 and 4 until the preset number of iterations is reached or the stopping condition is met (such as the fitness value no longer changes significantly).

[0135] For example: There is a cascade capsule network whose parameters include multiple weight matrices and bias vectors. Use the Satin Bowerbird algorithm to optimize these parameters. First, randomly initialize these parameters and set the relevant parameters of the algorithm (such as population size of 50 and number of iterations of 100). Then, use the training set to train the network, and use the validation set to calculate the fitness value (i.e., entropy loss) of each nest. Next, select high-quality nests according to the fitness value for crossover and mutation operations to generate new nests. Finally, repeat this process until the preset number of iterations is reached or the fitness value no longer changes significantly.

[0136] By optimizing the parameters of the cascade capsule network with the goal of minimizing entropy loss through the Satin Bowerbird algorithm, the difference between the network's classification results and the true label can be minimized. As an intelligent optimization algorithm, the Satin Bowerbird algorithm has good global search and local optimization capabilities, and can find the optimal solution or approximate optimal solution in the parameter space. This helps to improve the classification accuracy of the cascade capsule network, thereby enhancing the performance of the code type detection model.

[0137] Embodiment 2:

[0138] Based on the above embodiments, this embodiment provides an application example. Figure 2 As shown, a training method for a code type detection model is provided, including:

[0139] Step 210, divide the target code file into a training set and a validation set. Divide the code file into two different training and testing data sets, with the training set accounting for 80% and the testing set accounting for 20%.

[0140] Step 220, using a vector embedding module to convert the code file into a vector set.

[0141] Since the machine cannot directly recognize code characters, an embedding module is used to convert code characters into vectors represented by numbers. The objective function is used to calculate the ratio of the similarity probabilities between each code character, so that similar characters can be grouped as a preprocessing for the following steps.

[0142] The objective function is as follows:

[0143]

[0144] Among them, w i character vector representing character i, w j a character vector representing character j, represents a single context character vector, P ik represents the probability of character k appearing in the context of character i, P jk It represents the probability of character k appearing in the context of character j.

[0145] Step 230, using the Satin Bowerbird algorithm to extract features from the vector set to reduce the dimension.

[0146] The Satin Bowerbird algorithm is used to extract representative features from the vector set obtained in step 230 based on the fitness value function for classification in subsequent steps. The fitness value function is as follows:

[0147]

[0148] Among them, |F s | represents the fitness value function, λ is the parameter that affects the results of the classification stage, ξ is the error value, N e N is the total number of characters that appear most frequently. s is the total number of characters in the code files in the training set.

[0149] The steps of the Satin Bowerbird algorithm are as follows.

[0150] Step 231, randomly initialize the population. The algorithm randomly creates an initial population containing NB courtship booths, and the tth courtship booth is The dimension corresponding to each individual is N, and the current number of iterations is t.

[0151] Step 232, using the fitness function above to calculate the fitness value of each individual, and then calculate the proportion of this fitness value in the total fitness value of the group, which represents the probability of the individual being selected in the selection process. The probability of being selected is calculated using formula (1), fit i Represents the fitness value of the i-th courtship booth.

[0152]

[0153] Step 233, eliteization and population update. Eliteization is to retain the best solution at each stage of the algorithm optimization process. Experienced male satin bowerbirds will build better courtship pavilions, so they will be selected by female birds. This courtship pavilion is the elite courtship pavilion in the population, that is, x elite,k Since the elite courtship pavilion has the highest adaptability, it can influence the construction of other male bird courtship pavilions. In each cycle of the algorithm, the position of the courtship pavilion is updated according to formula (3):

[0154]

[0155] in, is the k-th dimension component of the i-th courtship pavilion iterated to the t-th generation. jk The location of the courtship booth is randomly selected by a roulette wheel procedure. elite,k is the position of the elite, which is saved in each cycle of the algorithm. In fact, the elite position is the position of the courtship booth with the highest fitness in the current iteration.

[0156]

[0157] In the calculation formula (4), the parameter λ k is the step size factor, α is the maximum step size, p j is the attraction probability obtained by calculating formula (1), 0≤p j ≤1. The step size is inversely proportional to the attraction probability of the courtship pavilion. j When p is 0, the maximum step size is α; when p j When it is 1, the minimum step size is α / 2.

[0158] Step 234, individual mutation. When male satin bowerbirds build mating pavilions on the ground, they may be attacked by other animals. Many times, strong male satin bowerbirds will steal the nesting materials of weak male satin bowerbirds or even destroy their mating pavilions. Therefore, at the end of each cycle of the algorithm, a certain probability mutation will be introduced into the population. In this step, random changes are applied to x with a certain probability. ik During the mutation process, x ik According to the normal distribution (N), it is randomly changed as shown in formula (5):

[0159]

[0160] The calculation formula of σ is as follows:

[0161] σ=z*(varmax -var min ) (7)

[0162] Among them, var max and var min are assigned to the variable x i The parameter z is the scaling factor.

[0163] Step 235, combine the old and new populations. In this stage, at the end of each cycle, the original old population and the new mutant population are evaluated separately. After the evaluation, the two populations are combined, and the individuals in the combined population are sorted according to their fitness values. In this cycle, the individuals with the smallest fitness value are retained, and other individuals that do not meet the requirements are eliminated. In this algorithm, if the conditions for loop termination are not met, steps 232 and 234 are continued until the loop ends.

[0164] Step 240, using a cascade capsule network to classify the features extracted in step 230.

[0165] Classification divides malicious code characters into different groups according to the features corresponding to different types of codes. The test code file input later can be compared with the malicious code group obtained by training to determine whether the code is malicious. The specific implementation process is similar to that in Example 1, and will not be repeated here to avoid repetition.

[0166] Step 250: Optimize the parameters of the cascade capsule network using the Satin Bowerbird algorithm.

[0167] The Satin Bowerbird algorithm of step 230 is used to optimize the parameters of the cascade capsule network, and the following objective function is used to optimize the entropy_loss parameter to minimize the entropy loss and make the classification result more accurate.

[0168] fitness value=minimazation(p entropy_loss )

[0169] Step 260, using the optimized parameters to establish the final code type detection model, and to identify and classify the test set data, and to evaluate the results after identification and the performance of the model.

[0170] The established model can automatically learn and identify patterns of malicious behavior, thereby effectively detecting unknown or variant malicious code.

[0171] Embodiment three:

[0172] In this embodiment, a method for detecting a code type is provided, including:

[0173] Get the code file to be tested;

[0174] The code file to be tested is detected using a code type detection model trained according to the code type detection model training method in any of the above embodiments.

[0175] The code type detection method of this embodiment can effectively detect unknown or variant malicious codes. It has strong adaptability and can continuously improve the detection capability with the update of data sets and retraining of models. It reduces the reliance on expert knowledge and reduces the labor cost of malicious code detection.

[0176] Embodiment 4:

[0177] Another embodiment of the present application relates to a training device for a code type detection model. The implementation details of the training device for a code type detection model of this embodiment are specifically described below. The following content is only for the convenience of understanding the implementation details provided, and is not necessary for the implementation of this solution. The schematic diagram of the training device for a code type detection model of this embodiment can be as follows: Figure 3 As shown, it includes a division module 310, a conversion module 320, an extraction module 330, a classification module 340 and a testing module 350.

[0178] A partitioning module 310 is used to partition the target code file into a training set and a test set;

[0179] A conversion module 320, configured to convert the code files in the training set into a vector set based on the similarity between the characters in the training set;

[0180] An extraction module 330 is used to extract a feature vector set from the vector set based on the repetition of each character in the total characters by using a satin bowerbird algorithm;

[0181] A classification module 340, for classifying the features of the feature vector set according to the features corresponding to different types of codes, to form a detection standard for the code type;

[0182] The testing module 350 is used to test the detection standard using the test set until the test requirements are met to obtain a code type detection model.

[0183] It is worth mentioning that all modules involved in this embodiment are logic modules. In practical applications, a logic unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, in order to highlight the innovative part of this application, this embodiment does not introduce units that are not closely related to solving the technical problems proposed by this application, but this does not mean that there are no other units in this embodiment.

[0184] Embodiment five:

[0185] Another embodiment of the present application relates to an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the training method of the code type detection model in the above-mentioned embodiments, or the code type detection method.

[0186] Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor.

[0187] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0188] Embodiment six:

[0189] Another embodiment of the present application relates to a computer-readable storage medium storing a computer program, which implements the above method embodiment when executed by a processor.

[0190] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as: ROM), random access memory (Random Access Memory, referred to as: RAM), disk or optical disk and other media that can store program codes.

[0191] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A method for training a code type detection model, characterized in that: include: Divide the target code files into training sets and test sets; Based on the similarity between the characters in the training set, converting the code files in the training set into a vector set; Using the Satin Bowerbird algorithm, based on the repetition of each of the characters in the total characters, extracting a feature vector set from the vector set; Classifying the features of the feature vector set according to the features corresponding to different types of codes to form a detection standard for the code type; The detection standard is tested using the test set until the detection standard meets the test requirements, thereby obtaining a code type detection model.

2. The method for training a code type detection model according to claim 1, characterized in that: The target code file includes malicious code.

3. The method for training a code type detection model according to claim 1, characterized in that: The converting the code files in the training set into a vector set based on the similarity between the characters in the training set comprises: Use the embedding module to convert each character into a corresponding character vector; Calculating the similarity between the character vectors, and grouping the character vectors according to the similarity; Based on the grouping results of each of the character vectors, a vector set of the code files in the training set is generated.

4. The method for training a code type detection model according to claim 3, characterized in that: The calculating the similarity between the character vectors comprises: The similarity between the character vectors is calculated using the following formula: Among them, w i character vector representing character i, w j a character vector representing character j, represents a single context character vector, P ik represents the probability of character k appearing in the context of character i, P jk It represents the probability of character k appearing in the context of character j.

5. The method for training a code type detection model according to claim 1, characterized in that: The method of using the Satin Bowerbird algorithm to extract a feature vector set from the vector set based on the repetition of each character in the total characters includes: Using the Satin Bowerbird algorithm, based on the following fitness value function, in each round of population iteration, the individual with the smallest fitness value is retained, and each individual is used to characterize a characteristic parameter. Among them, |F s | represents the fitness value function, λ is the parameter that affects the results of the classification stage, ξ is the error value, N e N is the total number of characters that appear most frequently. s is the total number of characters of the code files in the training set; The characteristic parameters corresponding to each of the individuals are retained as the characteristic vector set.

6. The method for training a code type detection model according to claim 1, characterized in that: The classifying the features of the feature vector set according to the features corresponding to different types of codes includes: According to the features corresponding to different types of codes, the features of the feature vector set are classified using a cascade capsule network.

7. The method for training a code type detection model according to claim 6, characterized in that: The testing of the detection standard using the test set until the test requirements are met includes: Using the Satin Bowerbird algorithm, the parameters of the cascade capsule network are optimized with the goal of minimizing entropy loss, where the entropy loss is used to characterize the difference between the classification result of the cascade capsule network and the true label; An initial code type detection model is established based on the optimized parameters, the test set is identified using the initial code type detection model, and the identified results and the performance of the model are evaluated until the test requirements are met.

8. A method for detecting a code type, characterized in that: include: Get the code file to be tested; The code file to be tested is detected using a code type detection model trained by the code type detection model training method according to any one of claims 1 to 7.

9. A training device for a code type detection model, characterized in that: include: A partitioning module is used to partition the target code file into a training set and a test set; A conversion module, used for converting the code files in the training set into a vector set based on the similarity between the characters in the training set; An extraction module, configured to extract a feature vector set from the vector set based on the repetition of each character in the total characters by using a satin bowerbird algorithm; A classification module, used to classify the features of the feature vector set according to the features corresponding to different types of codes, so as to form a detection standard for the code type; The testing module is used to test the detection standard using the test set until the test requirements are met to obtain a code type detection model.

10. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the training method of the code type detection model as described in any one of claims 1 to 7, or the code type detection method as described in claim 8.

11. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements the method for training a code type detection model as described in any one of claims 1 to 7, or the method for detecting a code type as described in claim 8.

Images