File type identification method and device

Abstract

The present application provides a file type identification method and device, the method comprising: obtaining a target file to be identified; sampling the target file to obtain a sampling block, the sampling block containing information characterizing the structure of the target file; converting the sampling block into a file vector; obtaining input information based on the file vector and a prompt template, the prompt template is used to stimulate the knowledge related to the output file structure of a large language model by using a prompt learning method; inputting the input information into the large language model to obtain a structural feature representation of the target file; inputting the structural feature representation into a classification network to obtain the type of the target file, wherein the classification network is trained based on an initial classification network using a small number of training files. A small sample file can train an accurate classification network according to the processing order of sampling, vector conversion, adding a prompt template, inputting a large language model, and inputting a classification network, and the target file can also accurately identify the file type according to this.

Description

Technical Field

[0001] The present application relates to the field of electronic information technology, and in particular to a file type identification method, a file type identification device, an electronic device, and a computer-readable storage medium. Background Art

[0002] File type identification refers to determining the type of a file based on its characteristics.

[0003] At present, deep learning methods are mainly used for file type recognition. Specifically, multiple training samples are prepared. The training samples are files of known types. And an initial deep learning model is constructed. Next, multiple training samples are substituted into the initial deep learning model to train the initial deep learning model, thereby obtaining a final deep learning model. When the type of the target file needs to be identified, the target file is input into the final deep learning model. The output of the final deep learning model is the type of the target file, thereby realizing the target file type recognition.

[0004] However, in the training of deep learning models, a large number of training samples are required to ensure that the final deep learning model has a high degree of accuracy. For scenarios with fewer training samples, for example, if there are not enough known types of files due to objective conditions, if a small number of file samples are used to train the initial deep learning model, the final deep learning model will not be accurate enough due to insufficient training, thereby reducing the accuracy of file type recognition. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a file type recognition method, a file type recognition device, an electronic device, and a computer-readable storage medium to improve the accuracy of file type recognition in a scenario with a small number of training samples.

[0006] In order to solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0007] The first aspect of the present application provides a file type identification method, the method comprising: obtaining a target file to be identified; sampling the target file to obtain a sampling block, wherein the sampling block contains information characterizing the structure of the target file; converting the sampling block into a file vector; obtaining input information based on the file vector and a prompt template, wherein the prompt template is used to stimulate a large language model (LLM) to output knowledge related to the file structure using a prompt learning method; inputting the input information into the large language model to obtain a structural feature representation of the target file; inputting the structural feature representation into a classification network to obtain the type of the target file, wherein the classification network is trained based on an initial classification network using a small sample number of training files.

[0008] Compared with the prior art, the file type identification method provided in the first aspect of the present application can train an accurate classification network even with a small number of training files by sampling, vector conversion, adding prompt templates, inputting a large language model, and inputting a classification network. The target file to be identified also follows the processing order of sampling, vector conversion, adding prompt templates, inputting a large language model, and inputting a classification network, so that the file type can be accurately identified. In a small sample scenario, the accuracy of file type identification is improved.

[0009] In some modified implementations of the first aspect of the present application, sampling the target file to obtain sampling blocks includes: sampling the head, middle and tail of the target file according to a fixed number of bytes to obtain a head sampling block, a middle sampling block and a tail sampling block.

[0010] By sampling at the head, middle and tail of the target file, comprehensive sampling can be performed simply and conveniently, and each sampling is based on a fixed number of bytes to achieve standardized sampling, thereby improving the accuracy and efficiency of file type identification.

[0011] In some modified implementations of the first aspect of the present application, sampling is performed at the head, middle and tail of the target file according to a fixed number of bytes to obtain a head sampling block, a middle sampling block and a tail sampling block, including: if the number of bytes of the target file is greater than or equal to three times the fixed number of bytes, a head spare block and a tail spare block greater than the fixed number of bytes are obtained from the head and tail of the target file respectively, and continuous zero values ​​at the head and tail of the target file are deleted to obtain a first non-zero data area; continuous zero values ​​at the head of the head spare block are deleted; starting from the first non-zero value position after the deletion, a fixed number of bytes of data are sequentially obtained to obtain a head sampling block; If the number of bytes of the data remaining after deleting consecutive zero values ​​is less than the fixed number of bytes, the tail of the head spare block after deletion is padded with zeros to the fixed number of bytes to obtain a head sampling block; the consecutive zero values ​​at the tail of the tail spare block are deleted; starting from the first non-zero value position after deletion, the fixed number of bytes of data are sequentially obtained to obtain a tail sampling block; if the number of bytes of the data remaining after deleting consecutive zero values ​​is less than the fixed number of bytes, the head of the tail spare block after deletion is padded with zeros to the fixed number of bytes to obtain a tail sampling block; starting from the middle position of the first non-zero data area, half of the fixed number of bytes of data are sequentially obtained on both sides to obtain a middle sampling block.

[0012] When the target file is long, sampling is performed at the head, middle and tail of the target file respectively. When sampling, the continuous zero values ​​at the beginning are removed, and when the number of sampled bytes is insufficient, it is padded with zero values, so as to achieve accurate and meaningful sampling of each part of the target file, thereby improving the accuracy of file type recognition.

[0013] In some modified implementations of the first aspect of the present application, sampling is performed at the head, middle and tail of the target file according to a fixed number of bytes to obtain a head sampling block, a middle sampling block and a tail sampling block, including: if the number of bytes of the target file is less than three times the fixed number of bytes, the continuous zero values ​​at the head and tail of the target file are deleted to obtain a second non-zero data area; starting from the head of the second non-zero data area, the data of the fixed number of bytes are sequentially obtained to obtain a head sampling block; if the number of bytes of the data in the second non-zero data area is less than the fixed number of bytes, the tail of the second non-zero data area is padded with zeros to the fixed number of bytes. to obtain a head sampling block; starting from the tail of the second non-zero data area, sequentially obtain data of a fixed number of bytes to obtain a tail sampling block; when the number of bytes of the data in the second non-zero data area is less than the fixed number of bytes, pad the head of the second non-zero data area with zeros to the fixed number of bytes to obtain a tail sampling block; starting from the middle position of the second non-zero data area, sequentially obtain half of the fixed number of bytes on both sides to obtain a middle sampling block; if the number of bytes of the data in the second non-zero data area is less than the fixed number of bytes, symmetrically pad the two sides of the second non-zero data area with zeros to the fixed number of bytes to obtain a middle sampling block.

[0014] When the target file is short, first delete the consecutive zero values ​​at the head and tail of the target file, then start sampling from the head, tail and middle respectively, use the part that is less than the fixed number of bytes, and then fill it with zero values ​​to achieve standard length sampling of each part in the target file, thereby improving the accuracy of file type recognition.

[0015] In some modified implementations of the first aspect of the present application, the sampling block is a binary data modality, and converting the sampling block into a file vector includes: dividing the sampling block of the binary data modality into multiple byte groups according to a specified number of bytes; inputting the multiple byte groups into a multilayer perceptron (Multilayer Perceptron, MLP) to obtain a file vector of a preset dimension corresponding to each byte group, the preset dimension being the dimension corresponding to the vector input into the large language model, and the multilayer perceptron is used to convert the binary data modality into a natural language modality.

[0016] First, the sampling block is divided into multiple byte groups according to the specified number of bytes, and then each byte group is converted into a vector of a preset dimension. This can reduce the complexity of aligning with the input vector of the large language model, improve the accuracy of vector alignment, and thus improve the accuracy of file type recognition.

[0017] In some modified implementations of the first aspect of the present application, the numerical value corresponding to the specified number of bytes is smaller than the numerical value corresponding to the preset dimension.

[0018] The number of bytes in each byte group is smaller than the input dimension of the large language model, so that each byte in the sampling block is fully aligned with the input of the large language model, thereby improving the accuracy of file type recognition.

[0019] In some modified implementations of the first aspect of the present application, input information is obtained based on the file vector and the prompt template, including: inputting the prompt template into the embedding layer of the large language model to obtain an embedding vector, the prompt template is used to stimulate the large language model to output knowledge related to the file structure at the mask position using a prompt learning method; the embedding vector is concatenated with the file vector to obtain the input information.

[0020] After the prompt template and the file vector are input into the large language model, the prompt template first passes through the embedding layer of the large language model, is converted into binary data, and then is processed together with the file vector through the large language model. Once an error occurs in the prompt template, it can be easily detected before it is input into the large language model, ensuring that the prompt template is input correctly, thereby improving the accuracy of file type recognition.

[0021] In some modified implementations of the first aspect of the present application, input information is input into a large language model to obtain a structural feature representation of the target file, including: inputting the input information into the large language model to obtain a multi-layer latent vector output by the large language model at a mask position; using an attention mechanism to select a latent vector of a key layer from the multi-layer latent vector, and determining the selected latent vector of the key layer as the structural feature representation of the target file.

[0022] The attention mechanism is used to select several key layers of latent vectors from the multi-layer latent vectors output at the mask position of the large language model as structural feature representations. While ensuring the accuracy of file type recognition, the data processing amount of the classification network can be reduced, thereby improving the efficiency of file type recognition.

[0023] In some modified implementations of the first aspect of the present application, before obtaining the target file to be identified, the method also includes: obtaining a small sample number of multiple training files, the types of the multiple training files are known; sampling the multiple training files to obtain a training block corresponding to each training file; the training block contains information characterizing the structure of the corresponding training file; based on each training block, the prompt template and the type of the multiple training files, the initial multi-layer perceptron, the initial large language model and the initial classification network are respectively trained to obtain a multi-layer perceptron, a large language model and a classification network for converting the sampled blocks into file vectors.

[0024] In the case of small samples, the initial multi-layer perceptron, large language model, and classification network are trained by sampling training files, aligning vectors, and adding prompt templates, so as to obtain accurate multi-layer perceptron, large language model, and classification network, thereby achieving accurate identification of file types.

[0025] In some changed implementation modes of the first aspect of the present application, after obtaining a plurality of training files with a small sample size, the method further includes: grouping the plurality of training files according to type, wherein the types of the training files in the same group are the same; determining whether the number of training files in each group is the same; if so, executing the step of sampling the plurality of training files to obtain a training block corresponding to each training file; if not, outputting a prompt message, wherein the prompt message is used to prompt that the number of training files in each group be adjusted to be the same, and sampling the training files after the adjusted number to obtain a training block corresponding to each training file.

[0026] Only when the number of training files in each type is consistent, and then using each group of training files for training, can we avoid the problem that some groups cannot map the corresponding features due to fewer training files, achieve accurate training of the model, and thus improve the accuracy of file type recognition.

[0027] According to a second aspect of the present application, there is provided a file type identification device, which includes: an acquisition module, which is used to acquire a target file to be identified; a sampling module, which is used to sample the target file to obtain a sampling block, wherein the sampling block contains information that characterizes the structure of the target file; an alignment module, which is used to convert the sampling block into a file vector; an excitation module, which is used to obtain input information based on the file vector and a prompt template, wherein the prompt template is used to stimulate a large language model to output knowledge related to the file structure using a prompt learning method; a selection module, which is used to input the input information into the large language model to obtain a structural feature representation of the target file; and an identification module, which is used to input the structural feature representation into a classification network to obtain the type of the target file, wherein the classification network is trained based on an initial classification network using a small number of training files.

[0028] The third aspect of the present application provides an electronic device, which includes: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other through the bus; and the processor is used to call program instructions in the memory to execute the method in the first aspect.

[0029] A fourth aspect of the present application provides a computer-readable storage medium, the storage medium comprising: a stored program; wherein, when the program is running, the device where the storage medium is located is controlled to execute the method in the first aspect.

[0030] The file type identification device provided in the second aspect, the electronic device provided in the third aspect, and the computer-readable storage medium provided in the fourth aspect of the present application have the same or similar beneficial effects as the file type identification method provided in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become easy to understand. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0032] Figure 1 The following is a flowchart of the file type identification method in the embodiment of the present application. Figure 1 ;

[0033] Figure 2 The following is a flowchart of the file type identification method in the embodiment of the present application. Figure 2 ;

[0034] Figure 3 This is a schematic diagram of sampling in the embodiment of this application. Figure 1 ;

[0035] Figure 4 This is a schematic diagram of sampling in the embodiment of this application. Figure 2 ;

[0036] Figure 5 This is a schematic diagram of sampling in the embodiment of this application. Figure 3 ;

[0037] Figure 6 The following is a flowchart of the file type identification method in the embodiment of the present application. Figure 3 ;

[0038] Figure 7 The structure of the file type identification device in the embodiment of the present application is shown as follows: Figure 1 ;

[0039] Figure 8 The structure of the file type identification device in the embodiment of the present application is shown as follows: Figure 2 ;

[0040] Fig. 9 Schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0041] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0042] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0043] At present, deep learning models are mainly used to identify file types. A large number of training files are required to train deep learning models. When the number of training files is small, the accuracy of the deep learning model will be insufficient, thereby reducing the accuracy of file type identification.

[0044] In view of this, the embodiments of the present application provide a file type identification method, a file type identification device, an electronic device, and a computer-readable storage medium. When the number of training files is small, the training files can be sampled, vector aligned with the input of a large language model, and prompt templates can be added to stimulate the knowledge related to the output file structure of the large language model, etc., and the initial classification network can be trained, so as to sample the target files to be identified, vector aligned with the input of a large language model, and prompt templates can be added to stimulate the knowledge related to the output file structure of the large language model, and the classification network can be used to accurately obtain the file type. In the case of a small sample, accurate identification of file types can be achieved.

[0045] First, the file type identification method provided in the embodiment of the present application is described in detail.

[0046] Figure 1 The following is a flowchart of the file type identification method in the embodiment of the present application. Figure 1 , see Figure 1 As shown, the method may include:

[0047] S11: Obtain the target file to be identified.

[0048] The target file is the file to be identified. The target file may be a file consisting of a number of characters, images, audio, etc. The specific content and form of the target file are not limited here.

[0049] S12: Sampling the target file to obtain a sampling block, where the sampling block contains information characterizing the structure of the target file.

[0050] Since the number of bytes between the files to be recognized is different, in order to align them with the input of the large language model later, the number of bytes of the target file needs to be fixed first, that is, sampling.

[0051] When sampling, in order to preserve the structural information of the target file and achieve accurate identification of the file type, sampling can be performed from different parts of the target file. When selecting the sampling part, it is necessary to select those parts that can characterize the structure of the target file, so as to ensure that the sampled block obtained after sampling contains information that characterizes the structure of the target file. For example: sampling is performed at the first half and the second half of the target file respectively. Another example: sampling is performed at the head, middle and tail of the target file respectively.

[0052] S13: Convert the sample block into a file vector.

[0053] After the target file is sampled and the sampling block is obtained, the sampling block can be further converted into a file vector that conforms to the input dimension of the large language model.

[0054] Generally speaking, the number of bytes sampled is greater than the input dimension of the large language model. For example, the number of bytes of the sampled block is 512×3, while the input dimension of the large language model is 8. In other words, this step is to split the sampled block into multiple vectors that are consistent with the input dimension of the large language model. The multiple vectors split are the file vectors.

[0055] During the specific conversion, a multi-layer perceptron or a conventional vector splitting method can be used.

[0056] The multi-layer perceptron is a pre-trained deep learning model that can convert the input sampling blocks into multiple vectors of preset dimensions that meet the input requirements of the large language model, namely, file vectors.

[0057] In the specific conversion of the multi-layer perceptron, the sampling block can be directly split according to the preset dimension to obtain multiple vectors of preset dimensions. For example: the sampling block includes 1536 bytes, and the preset dimension is 8. After splitting, 192 8-dimensional vectors can be obtained. The sampling block can also be split according to other byte numbers, and then each byte combination after the split is converted into a vector of preset dimension. For example: the sampling block includes 1536 bytes, the preset dimension is 8, and the other byte number is 4. After splitting, 384 4-dimensional vectors can be obtained, and after conversion, 384 8-dimensional vectors can be obtained.

[0058] After obtaining the vectors of multiple preset dimensions, the vectors of multiple preset dimensions are sequentially concatenated to obtain a file vector, which is a vector representation of the target file after being summarized.

[0059] S14: Based on the file vector and the prompt template, input information is obtained. The prompt template is used to stimulate the large language model to output knowledge related to the file structure using a prompt learning method.

[0060] The combination of the file vector and the prompt template can be determined according to the specific content of the prompt template. When the prompt template is a binary vector, the file vector can be directly written into the corresponding position in the prompt template to obtain input information. When the prompt template is a non-binary vector, the prompt template needs to be converted into a binary vector first, and then the file vector is written into the corresponding position of the binary prompt template to obtain input information.

[0061] S15: Input the input information into the large language model to obtain a structural feature representation of the target file.

[0062] The large language model here is a deep learning model with prior knowledge obtained after natural language training. For the large language model, it can generate corresponding output based on the input.

[0063] Since the input information contains a prompt template, and the prompt template uses a prompt learning method to stimulate the relevant knowledge of the file structure output by the large language model, and the file vector in the input information contains the structural representation information of the target file, therefore, when the input information is input into the large language model, the large language model can output the structural feature representation of the target file based on the file vector.

[0064] S16: Input the structural feature representation into a classification network to obtain the type of the target file, wherein the classification network is trained based on an initial classification network using a small sample number of training files.

[0065] The classification network is also a deep learning model that can perform corresponding calculations based on the input content to obtain the probability that the input content belongs to each category it contains, and then select the category with the highest probability as the output.

[0066] Therefore, after obtaining the structural feature representation of the target file, the structural feature representation of the target file is input into the classification network. The classification network outputs the probability of each file type corresponding to the structural feature representation based on multiple pre-trained file types, thereby selecting the file type with the highest probability for output. The file type output by the classification network is the type of the target file.

[0067] In practical applications, the identified file type may refer to the type of file, such as txt, gif, mov, etc., or text files, audio files, video files, image files, program files, compressed files, database files, etc. The specific content of the type is not limited here.

[0068] It can be seen from the process of identifying the type of the target file that before formally identifying the type of the target file, the initial classification network needs to be trained first.

[0069] During specific training, when only a small number of training files can be obtained, for each training file, sampling is performed to obtain a sampling block, and then the sampling block is converted into a file vector, and then the input information is obtained by combining the prompt template, and then the input information is input into the large language model, and then the structural feature representation output by the large language model is input into the initial classification network, and combined with the type of training files, the output classification network is trained to obtain a classification network. Finally, for the target file to be identified, sampling is first performed to obtain a sampling block, and then the sampling block is converted into a file vector, and then the input information is obtained by combining the prompt template, and then the input information is input into the large language model, and then the structural feature representation output by the large language model is input into the classification network. The output of the classification network is the type of the target file. In this way, accurate training of the model is achieved in the case of small sample training files, thereby achieving accurate identification of file types.

[0070] The small sample mentioned above is a type of sample, which is opposite to the "large sample" and usually refers to a sample size less than or equal to 30. In the embodiment of the present application, it can be understood that the small sample size refers to the sample size of the small sample, which can specifically refer to a number of 5, 10, etc. that is less than 30. In other words, even if there are only 5, 10, etc. training files, model training can still be performed, and accurate identification of file types can be achieved.

[0071] From the above content, it can be seen that the file type identification method provided by the embodiment of the present application can train an accurate classification network even with a small sample number of training files by sampling, vector conversion, adding prompt templates, inputting a large language model, and inputting a classification network. The target file to be identified also follows the processing order of sampling, vector conversion, adding prompt templates, inputting a large language model, and inputting a classification network, so that the file type can be accurately identified. In a small sample scenario, the accuracy of file type identification is improved.

[0072] Furthermore, as a Figure 1 As a refinement and extension of the method shown, an embodiment of the present application also provides a file type identification method.

[0073] Figure 2 The following is a flowchart of the file type identification method in the embodiment of the present application. Figure 2 , see Figure 2 As shown, the method can include two parts, namely: model training and type identification.

[0074] 1. Model training.

[0075] S21: Acquire multiple training files with a small sample size, where the types of the multiple training files are known.

[0076] When there is a need to identify file types, the deep learning model used to identify file types needs to be trained first. To train the model, multiple training files with known file types are required. When file types need to be identified later, multiple training files of the corresponding types are obtained. The specific content of the training files is not limited here.

[0077] The number of training files that can be obtained affects the training method of the model. When a large number of training files can be obtained, the model can be trained using a conventional model training method to achieve efficient model training. When the number of training files that can be obtained is small, it is necessary to use the method involved in the embodiment of the present application to perform model training to ensure the accuracy of file type recognition.

[0078] S22: Sampling multiple training files to obtain a training block corresponding to each training file; the training block contains information characterizing the structure of the corresponding training file.

[0079] S23: Based on the types of each training block, the prompt template and the multiple training files, the initial multi-layer perceptron, the initial large language model and the initial classification network are trained respectively to obtain the multi-layer perceptron, the large language model and the classification network for converting the sampling block into the file vector.

[0080] That is to say, for each training file, sampling is performed to obtain the training block corresponding to each training file. The training block is then input into the initial multi-layer perceptron to obtain the file vector, and then input information is generated based on the file vector and the prompt template, and then the input information is input into the initial large language model, and then the structural feature representation output by the large language model is input into the initial classification network to obtain the type of the training file, and then compared with the known type of the training file, and the parameters in the initial multi-layer perceptron, the initial large language model and the initial classification network are adjusted through the loss function, etc. Through repeated training of multiple training files, a multi-layer perceptron, a large language model and a classification network that can actually be used for file type recognition are obtained.

[0081] In the training of the weights of the multi-layer perceptron, supervised training can be used to improve the accuracy of the trained model, thereby improving the accuracy of file type recognition.

[0082] In some cases, multiple types of identification are sometimes required. That is to say, the training files used for model training are no longer single-type training files, but multiple types of training files. However, for multiple types of training files, it is necessary to ensure that the number of training files of each type is consistent, so as to avoid the number of training files of a certain type being less than the number of training files of other types, so that the features of the training files corresponding to this type cannot be mapped in the model, and ensure that the feature quantities of various types of mappings are consistent, so as to improve the accuracy of file type identification.

[0083] Specifically, before the above step S22, the method may further include:

[0084] Step A1: Group multiple training files according to their types, and the training files in the same group have the same type.

[0085] Since the types of multiple training files are known, the training files of the same type can be directly divided into a group. The types of the training files in each group are the same.

[0086] In practical applications, the number of training files in each group may be one or more. The specific number of training files involved in each group is determined according to the number of training files actually obtained and is not limited here.

[0087] Step A2: Determine whether the number of training files in each group is the same. If yes, execute S22; if no, execute step A3.

[0088] If the number of training files in each group is the same, it means that the types are balanced when performing feature mapping during training, and these training files can continue to be used to perform model training using the method provided in step S22.

[0089] If the number of training files in each group is not exactly the same, for example, the number of training files in one group is less than the number of training files in other groups, or the number of training files in one group is more than the number of training files in other groups, then the number of training files in each group needs to be adjusted to be consistent, and then the adjusted training files are used for model training.

[0090] Step A3: outputting prompt information, where the prompt information is used to prompt adjusting the number of training files in each group to be the same, and sampling the training files after the number adjustment to obtain a training block corresponding to each training file.

[0091] After seeing the output prompt information, the relevant personnel will know that there is a problem with the number of types of training files provided for model training. At this time, the relevant personnel can check the number of training files corresponding to each type, determine the type with the least number of training files, and reduce the number of training files in other types except this type to the number of training files in this type, so that the number of training files corresponding to each type is the same.

[0092] Ensure that the number of training files of each type is consistent. If the total number of training files is small, the model can continue to be trained in the manner of step S22 to ensure the accuracy of the model.

[0093] After completing the training to obtain the multi-layer perceptron, large language model and classification network, the multi-layer perceptron, large language model and classification network can be used to identify the type of the target file.

[0094] 2. Type identification.

[0095] S24: Obtain the target file to be identified.

[0096] The target file here is the file whose file type is to be identified.

[0097] S25: Sampling is performed at the head, middle and tail of the target file according to a fixed number of bytes to obtain a head sampling block, a middle sampling block and a tail sampling block.

[0098] Figure 3 This is an illustration of file sampling in the embodiment of this application. Figure 1 , see Figure 3 As shown, at the head of the target file, a fixed number of bytes are sampled to obtain a head sampling block. At the tail of the target file, a fixed number of bytes are sampled to obtain a tail sampling block. At the middle of the target file, a fixed number of bytes are sampled to obtain a middle sampling block. Among them, Figure 3 In the above diagram, it can be considered that the target file starts with a non-zero value at the head and ends with a non-zero value at the tail. Although the target file has continuous zero values ​​at the head and tail, it is not marked in the figure, but those skilled in the art can refer to it. Figure 4 , Figure 5 And related descriptions, it is easy to infer that Figure 3 After the consecutive zero values ​​at the head and tail are deleted, sampling is performed in the non-zero data area.

[0099] The specific value of the fixed number of bytes can be set according to actual conditions, for example, 512 bytes, etc., and is not specifically limited here.

[0100] Specifically, the above step S25 may include:

[0101] Step B1: Determine whether the number of bytes of the target file is greater than or equal to three times the fixed number of bytes. If yes, execute steps B21-B24; if no, execute steps B31-B34.

[0102] The length of the target file will affect the sampling method. For a longer target file, you can normally sample at the head, middle, and tail of the file to obtain the head sampling block, middle sampling block, and tail sampling block. For a shorter target file, you need to continuously sample from the head to the back, from the middle to the sides, and from the tail to the front to obtain the head sampling block, middle sampling block, and tail sampling block.

[0103] As for the criterion of the number of bytes, three times the fixed number of bytes can be a minimum value. In other words, if the number of bytes of the target file is equal to three times the fixed number of bytes, the sampling method in steps B21-B24 can be adopted. Of course, the sampling method in steps B21-B24 can also be adopted when the number of bytes of the target file is more than three times the fixed number of bytes. In this way, it can be ensured that a longer target file can be fully sampled at the head, middle and tail. For example: assuming that the fixed number of bytes is 512, the number of bytes of the target file is equal to 512×3 bytes, the sampling method in steps B21-B24 can be adopted. Alternatively, the sampling method in steps B21-B24 can be adopted only when the number of bytes of the target file is greater than 4096×2+512 bytes.

[0104] Step B21: respectively obtain a header spare block and a tail spare block greater than a fixed number of bytes from the header and the tail of the target file, and delete continuous zero values ​​at the header and the tail of the target file to obtain a first non-zero data area.

[0105] Step B22: Delete the consecutive zero values ​​at the head of the head spare block; starting from the first non-zero value position after deletion, sequentially obtain a fixed number of bytes of data to obtain a head sampling block; if the number of bytes of the remaining data after deleting the consecutive zero values ​​is less than the fixed number of bytes, fill the tail of the head spare block after deletion with zeros to a fixed number of bytes to obtain a head sampling block.

[0106] Step B23: Delete the continuous zero values ​​at the tail of the tail spare block; starting from the first non-zero value position after deletion, sequentially obtain a fixed number of bytes of data to obtain a tail sampling block; if the number of bytes of the remaining data after deleting the continuous zero values ​​is less than the fixed number of bytes, fill the head of the tail spare block after deletion with zeros to a fixed number of bytes to obtain a tail sampling block.

[0107] Step B24: Starting from the middle position of the first non-zero data area, sequentially acquire half of the fixed number of bytes of data on both sides to obtain a middle sampling block.

[0108] Taking the fixed number of bytes as 512 as an example, when the length of the target file is greater than 4096×2+512 bytes, Figure 4 This is an illustration of file sampling in the embodiment of this application. Figure 2 , see Figure 4 As shown, first, 4096 bytes are taken from the head of the target file as the head spare block. 4096 bytes are taken from the tail of the target file as the tail spare block. And, the continuous zero values ​​at the head and tail of the target file are deleted to obtain the first non-zero data area, where: Figure 4 The left area adjacent to the first non-zero data area is the continuous zero value deleted in the head spare block, and the right area adjacent to the first non-zero data area is the continuous zero value deleted in the tail spare block. For example: the target file is "001100101...01111000", the head spare block is "001100101..." 4096 bytes, the tail spare block is "...01111000" 4096 bytes, and the first non-zero data area is "1100101...01111".

[0109] Then, the continuous zero values ​​at the head of the head spare block are deleted, and 512 bytes are sequentially taken from the first non-zero value position after the deletion to obtain the head sample block. For example: the head spare block is "001100101...", and the head sample block is "1100101...", which are 512 bytes. If the head spare block is less than 512 bytes, then the tail of "1100101..." is padded with zero values ​​to 512 bytes. If 2 bytes are missing, the head sample block is "1100101...00".

[0110] At the same time, the continuous zero values ​​at the end of the tail spare block are deleted, and 512 bytes are sequentially taken from the first non-zero value position after the deletion to obtain the tail sampling block. For example: the tail spare block is "...01111000", and the tail sampling block is "...01111" 512 bytes. If the tail spare block is less than 512 bytes, then the head of "...01111" is padded with zero values ​​to 512 bytes. If 2 bytes are missing, the tail sampling block is "00...01111".

[0111] At the same time, in the first non-zero data area, starting from the middle position, 256 bytes are sequentially obtained on both sides, totaling 512 bytes, to obtain the middle sampling block. For example: the first non-zero data area is "1100...110011...0011", and the middle sampling block is "...110011...", that is, the first 0 and the 256 consecutive bytes before it and the second 0 and the 256 consecutive bytes after it. If the number of bytes in the first non-zero data area is an even number, then the middle position is the position between the two middle bytes in the first non-zero data area, and from this position, 256 bytes are sequentially obtained on both sides. If the number of bytes in the first non-zero data area is an odd number, then the middle position is the middle byte in the first non-zero data area, including this byte, and from this byte, 255 bytes and 256 bytes, or 256 bytes and 255 bytes are sequentially obtained on both sides.

[0112] In this way, the sampling of the longer target file is completed, and the head sampling block, the middle sampling block and the tail sampling block are obtained, and then the sampling block is obtained. Next, the sampling of the shorter target file is described.

[0113] Step B31: Delete the consecutive zero values ​​at the head and tail of the target file to obtain a second non-zero data area.

[0114] Step B32: Starting from the head of the second non-zero data area, sequentially obtain data of a fixed number of bytes to obtain a head sampling block; if the number of bytes of the data in the second non-zero data area is less than the fixed number of bytes, pad the tail of the second non-zero data area with zeros to the fixed number of bytes to obtain a head sampling block.

[0115] Step B33: Starting from the tail of the second non-zero data area, sequentially obtain data of a fixed number of bytes to obtain a tail sampling block; when the number of bytes of the data in the second non-zero data area is less than the fixed number of bytes, pad the head of the second non-zero data area with zeros to the fixed number of bytes to obtain a tail sampling block.

[0116] Step B34: Starting from the middle position of the second non-zero data area, sequentially obtain half of the fixed number of bytes of data on both sides to obtain an intermediate sampling block; if the number of bytes of the data in the second non-zero data area is less than the fixed number of bytes, symmetrically pad the two sides of the second non-zero data area with zeros to the fixed number of bytes to obtain an intermediate sampling block.

[0117] Taking the fixed number of bytes as 512 as an example, when the length of the target file is less than 4096×2+512 bytes, Figure 5 This is an illustration of file sampling in the embodiment of this application. Figure 3 , see Figure 5 As shown, first, the continuous zero values ​​at the head and tail of the target file are deleted to obtain the second non-zero data area. Figure 5The left area adjacent to the second non-zero data area is the continuous zero value deleted in the target file, and the right area adjacent to the second non-zero data area is the continuous zero value deleted at the end of the target file. For example: the target file is "001100101...01111000", and the second non-zero data area is "1100101...01111".

[0118] Then, starting from the head of the second non-zero data area, 512 bytes are sequentially obtained to obtain the head sample block. For example, the second non-zero data area is "1100101...01111", and the head sample block is "1100101..." 512 bytes. If the second non-zero data area is less than 512 bytes, then the tail of "1100101...01111" is padded with zero values ​​to 512 bytes. If 2 bytes are missing, the head sample block is "1100101...0111100".

[0119] At the same time, starting from the tail of the second non-zero data area, 512 bytes are sequentially obtained to obtain the tail sample block. For example, if the second non-zero data area is "1100101...01111", the tail sample block is the 512 bytes of "...01111". If the second non-zero data area is less than 512 bytes, then the head of "1100101...01111" is padded with zero values ​​to 512 bytes. If 2 bytes are missing, the tail sample block is "001100101...01111".

[0120] At the same time, in the second non-zero data area, starting from the middle position, 256 bytes are sequentially obtained on both sides, totaling 512 bytes, to obtain the middle sampling block. For example: the second non-zero data area is "1100...110011...0011", and the middle sampling block is "...110011...", that is, the first 0 and the 256 consecutive bytes before it and the second 0 and the 256 consecutive bytes after it. If the number of bytes in the second non-zero data area is an even number, then the middle position is the position between the two middle bytes in the second non-zero data area, and from this position, 256 bytes are sequentially obtained on both sides. If the number of bytes in the second non-zero data area is an odd number, then the middle position is the middle byte in the second non-zero data area, including this byte, and from this byte, 255 bytes and 256 bytes, or 256 bytes and 255 bytes are sequentially obtained on both sides. If the "second non-zero data area" is less than 512 bytes, then both sides are symmetrically padded with zeros to 512 bytes. If 2 bytes are missing, the tail sample block is "01100...110011...00110". If an odd number of bytes are missing, one of the two sides can be padded with an extra zero value. There is no restriction on which of the two sides is padded with an extra zero value.

[0121] During the sampling process, if it is found that one byte is missing after sampling, and after confirming that the sampling process is correct, the end of the sampling block can be filled with zeros.

[0122] In this way, the sampling of the shorter target file is completed, and a head sampling block, a middle sampling block and a tail sampling block are obtained, and then a sampling block is obtained.

[0123] The above 4096×2+512 bytes, 512 bytes are all examples. The specific number of bytes for determining the length of the target file can be set according to actual needs and is not limited here.

[0124] Generally speaking, the target file is converted into binary data in a computer, so the sampling block is in binary data mode. At this time, the sampling block in binary data mode needs to be aligned with the input vector of the large language model in terms of dimension.

[0125] S26: Divide the sampling block of the binary data mode into multiple byte groups according to the specified number of bytes.

[0126] Although the multilayer perceptron can convert the sampling block into vectors of multiple preset dimensions, so that the sampling module meets the input standard of the large language model, in order to meet different type recognition requirements, the sampling block can be split according to the requirements and then the multilayer perceptron can be used to obtain vectors of multiple preset dimensions.

[0127] During the specific division, the sampling block can be divided into multiple byte groups according to the specified number of bytes. The specified number of bytes here can be configured based on the type recognition requirements. When the requirement for recognition speed in file type recognition is higher than the requirement for recognition accuracy, the specified number of bytes can be set to a value greater than or equal to the preset dimension (i.e., the dimension of the token input to the large language model). When the requirement for recognition accuracy in file type recognition is higher than the requirement for recognition accuracy, the specified number of bytes can be set to a value less than the preset dimension (i.e., the dimension of the token input to the large language model).

[0128] In actual applications, when the number of bytes in a sampling block is 512*3 bytes, the specified number of bytes is 4, that is, the sampling block is divided into 4 bytes and input into the multi-layer perceptron respectively, which can eventually realize accurate and fast identification of file types. If the number of bytes is more than 4, the accuracy of file type identification is not high, and if the number of bytes is less than 4, the speed of file type identification is slow.

[0129] S27: Input multiple byte groups into a multi-layer perceptron to obtain a file vector of a preset dimension corresponding to each byte group, where the preset dimension is the dimension corresponding to the vector input into the large language model. The multi-layer perceptron is used to convert the binary data modality into a natural language modality.

[0130] In other words, when a byte group is input into the multi-layer perceptron, a vector of preset dimensions is obtained. The vector corresponding to multiple byte groups is the file vector.

[0131] Taking the example of grouping a 512×3-byte sampling block by 4 bytes, 384 byte groups can be obtained. Each byte group contains 4 bytes. Assuming that the dimension of the token input to the large language model is 8, a 4-byte byte group is processed by a multi-layer perceptron to obtain an 8-dimensional vector. A total of 384 8-dimensional vectors, namely file vectors, are obtained. In this way, the binary data in the sampling block is aligned with the embedding vector of the large language model, and the binary data modality and the natural language modality are aligned.

[0132] S28: Input the prompt template into the embedding layer of the large language model to obtain an embedding vector. The prompt template is used to represent the output knowledge at the mask position.

[0133] Since the vector of the large language model at the mask (i.e., [MASK]) position carries knowledge related to the file structure, the prompt template can use a prompt learning method to stimulate the large language model to output knowledge related to the file structure at the [MASK] position.

[0134] In actual applications, the prompt template can be “It was [MASK].< <vector>>". Among them, < <vector>> is the file vector after modality alignment.

[0135] Since the prompt template is generally a natural language and the file vector is a binary vector, the prompt module needs to be converted into a binary vector and then used together with the file vector through a large language model to obtain the file structure feature representation.

[0136] On the one hand, the prompt module can be converted into a binary vector in advance, and then the prompt template under the binary vector is concatenated with the file vector and input into the input layer of the large language model.

[0137] On the other hand, in order to improve the efficiency of file type recognition, the prompt template can be first input into the embedding layer of the large language model, and then the prompt template can be converted into a binary vector, i.e., an embedding vector, by using the embedding layer of the large language model. The embedding vector is then concatenated with the file vector and input into the input layer of the large language model.

[0138] S29: Concatenate the embedded vector and the file vector to obtain input information.

[0139] S210: Input the input information into the large language model to obtain the multi-layer latent vector output by the large language model at the [MASK] position.

[0140] After the input information is input into the input layer of the large language model, the large language model begins to analyze the file vector, and then outputs the corresponding multi-layer latent vector at the [MASK] position.

[0141] S211: An attention mechanism is used to select a latent vector of a key layer from multiple layers of latent vectors, and the latent vector of the selected key layer is determined as a structural feature representation of the target file.

[0142] In order to reduce the amount of data represented by the structural features, improve the processing speed of the subsequent classification network, and ensure the accuracy of the structural feature representation, the attention mechanism can be used to select the latent vector of the key layer from the multi-layer latent vector, and determine the selected latent vector as the structural feature representation of the target file. The number of layers selected is determined by the attention mechanism during training and does not need to be manually set.

[0143] In practical applications, the large language model can be a pre-trained language (Bidirectional Encoder Representations from Transformers, BERT) model based on the Transformer architecture. The BERT model can output 12 layers of latent vectors, and other models output more layers of latent vectors. Through the attention mechanism, the key layers can be selected as the final file structure feature representation. The specific type of the large language model is not limited here.

[0144] S212: Input the structural feature representation into the classification network to obtain the type of the target file.

[0145] The structural feature representation output by the large language model is actually a vector, and the type of the target file cannot be directly known through the structural feature representation. Therefore, the structural feature representation of the target file needs to be input into the classification network again, and the output of the classification network is the type of the target file.

[0146] The classification network here can be any known classification network that can represent the output file type based on vectorized file structure features. For example, a classification network based on MLP. The specific type of the classification network is not limited here.

[0147] Finally, a complete example is used to fully illustrate the file type identification method provided in the embodiment of the present application.

[0148] Figure 6 The following is a flowchart of the file type identification method in the embodiment of the present application. Figure 3 , see Figure 6 As shown, the multi-layer perceptron, large language model and classification network are all trained in the above manner.

[0149] Step 1: Get the file to be identified.

[0150] Step 2: Data sampling of the files to be identified is performed, including upper sampling, middle sampling and lower sampling.

[0151] Step 3: Perform binary data lemma (modal alignment) on the sampled data.

[0152] Since the file to be identified is binary data, the sampled data is also binary data. The sampled data is divided into binary data granularity, and then the divided data is mapped between binary semantic space and language semantic space through a multi-layer perceptron to achieve matching with the input of the large language model.

[0153] Step 4: Stimulate the associated knowledge of the modal aligned data.

[0154] After modality alignment, the file feature semantic vector is obtained. The prompt vector is concatenated with the file feature semantic vector to obtain the semantic embedding vector. The semantic embedding vector is input into the BERT model to obtain the file structure feature representation.

[0155] Step 5: Select related knowledge after stimulation.

[0156] For each layer’s [MASK vector], weighted summation is performed based on the weights to obtain the file structure feature representation.

[0157] Step 6: Classify the file structure feature representation.

[0158] The file structure feature representation is input into a multi-layer perceptron, which calculates the probability value of the file structure feature representation under each type, thereby selecting the corresponding type based on the probability value, and outputting the selected type as the type of the file to be identified.

[0159] At this point, the file type identification method provided in the embodiments of the present application has been fully described.

[0160] Based on the same inventive concept, as an implementation of the above method, an embodiment of the present application also provides a file type identification device.

[0161] Figure 7 The structure of the file type identification device in the embodiment of the present application is shown as follows: Figure 1 , see Figure 7 As shown, the device may include: an acquisition module 71, a sampling module 72, an alignment module 73, an excitation module 74, a selection module 75 and an identification module 76.

[0162] The acquisition module 71 is used to acquire the target file to be identified.

[0163] The sampling module 72 is used to sample the target file to obtain a sampling block, wherein the sampling block contains information characterizing the structure of the target file.

[0164] The alignment module 73 is used to convert the sample block into a file vector.

[0165] The stimulation module 74 is used to obtain input information based on the file vector and the prompt template, and the prompt template is used to stimulate the large language model to output knowledge related to the file structure by using a prompt learning method.

[0166] The selection module 75 is used to input the input information into the large language model to obtain the structural feature representation of the target file.

[0167] The identification module 76 is used to input the structural feature representation into the classification network to obtain the type of the target file, wherein the classification network is trained based on the initial classification network using a small sample number of training files.

[0168] Furthermore, as a Figure 7 As a refinement and extension of the device shown, an embodiment of the present application also provides a file type identification device.

[0169] Figure 8 The structure of the file type identification device in the embodiment of the present application is shown as follows: Figure 2 , see Figure 8 As shown, the device may include: a training module 81, an acquisition module 82, a sampling module 83, an alignment module 84, an excitation module 85, a selection module 86 and a recognition module 87.

[0170] The training module 81 is used to obtain a plurality of training files with a small sample size, wherein the types of the plurality of training files are known; the plurality of training files are sampled to obtain a training block corresponding to each training file; the training block contains information characterizing the structure of the corresponding training file; based on each training block, the prompt template and the type of the plurality of training files, the initial multi-layer perceptron, the initial large language model and the initial classification network are trained respectively to obtain a multi-layer perceptron, the large language model and the classification network for converting the sampled block into a file vector.

[0171] The training module 81 is also used to group the multiple training files according to their types after obtaining multiple training files with a small sample size, so that the types of the training files in the same group are the same; determine whether the number of training files in each group is the same; if so, execute the step of sampling the multiple training files to obtain the training blocks corresponding to each training file; if not, output a prompt message, which is used to prompt to adjust the number of training files in each group to be the same, and sample the training files after the adjusted number to obtain the training blocks corresponding to each training file.

[0172] The acquisition module 82 is used to acquire the target file to be identified.

[0173] The sampling module 83 is used to sample the head, middle and tail of the target file according to a fixed number of bytes to obtain a head sampling block, a middle sampling block and a tail sampling block.

[0174] The sampling module 83 includes: a pre-sampling unit 831 , a head sampling unit 832 , a middle sampling unit 833 and a tail sampling unit 834 .

[0175] The pre-sampling unit 831 is used to obtain a header spare block and a tail spare block greater than the fixed number of bytes from the header and the tail of the target file respectively if the number of bytes of the target file is greater than or equal to three times the fixed number of bytes, and to delete continuous zero values ​​at the header and the tail of the target file to obtain a first non-zero data area.

[0176] The head sampling unit 832 is used to delete the continuous zero values ​​at the head of the head spare block; starting from the first non-zero value position after the deletion, sequentially obtain a fixed number of bytes of data to obtain a head sampling block; if the number of bytes of the remaining data after deleting the continuous zero values ​​is less than the fixed number of bytes, the tail of the head spare block after the deletion is padded with zeros to a fixed number of bytes to obtain a head sampling block.

[0177] The middle sampling unit 833 is used to sequentially acquire half of the fixed number of bytes of data from the middle position of the first non-zero data area to both sides to obtain a middle sampling block.

[0178] The tail sampling unit 834 is used to delete the continuous zero values ​​at the tail of the tail spare block; starting from the first non-zero value position after the deletion, sequentially obtain a fixed number of bytes of data to obtain a tail sampling block; if the number of bytes of the remaining data after deleting the continuous zero values ​​is less than the fixed number of bytes, the head of the tail spare block after the deletion is padded with zeros to a fixed number of bytes to obtain a tail sampling block.

[0179] The pre-sampling unit 831 is further configured to delete the continuous zero values ​​at the head and tail of the target file to obtain a second non-zero data area if the number of bytes of the target file is less than three times the fixed number of bytes.

[0180] The head sampling unit 832 is also used to sequentially obtain a fixed number of bytes of data starting from the head of the second non-zero data area to obtain a head sampling block; if the number of bytes of the data in the second non-zero data area is less than the fixed number of bytes, the tail of the second non-zero data area is padded with zeros to a fixed number of bytes to obtain a head sampling block.

[0181] The intermediate sampling unit 833 is also used to start from the middle position of the second non-zero data area, and sequentially obtain half of the fixed number of bytes of data on both sides to obtain an intermediate sampling block; if the number of bytes of the data in the second non-zero data area is less than the fixed number of bytes, the two sides of the second non-zero data area are symmetrically padded with zeros to the fixed number of bytes to obtain an intermediate sampling block.

[0182] The tail sampling unit 834 is also used to sequentially acquire a fixed number of bytes of data starting from the tail of the second non-zero data area to obtain a tail sampling block; when the number of bytes of the data in the second non-zero data area is less than the fixed number of bytes, the head of the second non-zero data area is padded with zeros to the fixed number of bytes to obtain a tail sampling block.

[0183] When the sampling block is in binary data mode, the alignment module 84 includes: a division unit 841 and an alignment unit 842 .

[0184] The division unit 841 is used to divide the sampling block of the binary data mode into multiple byte groups according to the specified number of bytes.

[0185] In actual applications, the value corresponding to the specified number of bytes is smaller than the value corresponding to the preset dimension.

[0186] The alignment unit 842 is used to input multiple byte groups into a multi-layer perceptron to obtain a file vector of a preset dimension corresponding to each byte group, where the preset dimension is the dimension corresponding to the vector input into the large language model. The multi-layer perceptron is used to convert the binary data modality into a natural language modality.

[0187] The excitation module 85 is used to input the prompt template into the embedding layer of the large language model to obtain an embedding vector. The prompt template is used to stimulate the large language model to output knowledge related to the file structure at the mask position using a prompt learning method; the embedding vector is spliced ​​with the file vector to obtain input information.

[0188] The selection module 86 is used to input the input information into the large language model to obtain the multi-layer latent vector output by the large language model at the mask position; the attention mechanism is used to select the latent vector of the key layer from the multi-layer latent vector, and the latent vector of the selected key layer is determined as the structural feature representation of the target file.

[0189] The identification module 87 is used to input the structural feature representation into the classification network to obtain the type of the target file.

[0190] It should be noted here that the description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0191] Based on the same inventive concept, an embodiment of the present application also provides an electronic device.

[0192] Fig. 9 This is a schematic diagram of the structure of the electronic device in the embodiment of the present application, see Fig. 9 As shown, the electronic device may include: a processor 91, a memory 92, and a bus 93; wherein the processor 91 and the memory 92 communicate with each other via the bus 93; the processor 91 is used to call program instructions in the memory 92 to execute the methods in one or more of the above embodiments.

[0193] It should be noted that the description of the above electronic device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the electronic device embodiment of this application, please refer to the description of the method embodiment of this application for understanding.

[0194] Based on the same inventive concept, an embodiment of the present application further provides a computer-readable storage medium, which may include: a stored program; wherein, when the program is running, the device where the storage medium is located is controlled to execute the method in one or more of the above embodiments.

[0195] It should be noted here that the description of the above storage medium embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the storage medium embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0196] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.< / vector> < / vector>

Claims

1. A method for identifying a file type, characterized in that: The method comprises: Get the target file to be identified; Sampling the target file to obtain a sampling block, wherein the sampling block contains information characterizing the structure of the target file; Converting the sample block into a file vector; Based on the file vector and the prompt template, input information is obtained, wherein the prompt template is used to stimulate knowledge related to the output file structure of the large language model by using a prompt learning method; Inputting the input information into a large language model to obtain a structural feature representation of the target file; The structural feature representation is input into a classification network to obtain the type of the target file, wherein the classification network is trained based on an initial classification network using training files with a small sample size.

2. The method according to claim 1, characterized in that The step of sampling the target file to obtain a sampling block includes: Sampling is performed at the head, middle and tail of the target file according to a fixed number of bytes to obtain a head sampling block, a middle sampling block and a tail sampling block.

3. The method according to claim 2, characterized in that The sampling is performed at the head, middle and tail of the target file according to a fixed number of bytes to obtain a head sampling block, a middle sampling block and a tail sampling block, including: If the number of bytes of the target file is greater than or equal to three times the fixed number of bytes, a head spare block and a tail spare block greater than the fixed number of bytes are obtained from the head and the tail of the target file respectively, and continuous zero values ​​located at the head and the tail of the target file are deleted to obtain a first non-zero data area; Deleting the continuous zero values ​​at the head of the head spare block; starting from the first non-zero value position after the deletion, sequentially acquiring the fixed number of bytes of data to obtain the head sampling block; if the number of bytes of the remaining data after deleting the continuous zero values ​​is less than the fixed number of bytes, padding the tail of the head spare block after the deletion with zeros to the fixed number of bytes to obtain the head sampling block; Deleting the continuous zero values ​​at the tail of the tail spare block; starting from the first non-zero value position after the deletion, sequentially acquiring the fixed number of bytes of data to obtain the tail sampling block; if the number of bytes of the remaining data after deleting the continuous zero values ​​is less than the fixed number of bytes, padding the head of the tail spare block after the deletion with zeros to the fixed number of bytes to obtain the tail sampling block; Starting from the middle position of the first non-zero data area, data of half the fixed number of bytes are sequentially acquired on both sides to obtain the middle sampling block.

4. The method according to claim 2, characterized in that: The sampling is performed at the head, middle and tail of the target file according to a fixed number of bytes to obtain a head sampling block, a middle sampling block and a tail sampling block, including: If the number of bytes of the target file is less than three times the fixed number of bytes, the continuous zero values ​​at the head and the tail of the target file are deleted to obtain a second non-zero data area; Starting from the head of the second non-zero data area, sequentially acquiring the fixed number of bytes of data to obtain the head sample block; if the number of bytes of the data in the second non-zero data area is less than the fixed number of bytes, padding the tail of the second non-zero data area with zeros to the fixed number of bytes to obtain the head sample block; Starting from the tail of the second non-zero data area, sequentially acquiring the fixed number of bytes of data to obtain the tail sampling block; when the number of bytes of the data in the second non-zero data area is less than the fixed number of bytes, padding the head of the second non-zero data area with zeros to the fixed number of bytes to obtain the tail sampling block; Starting from the middle position of the second non-zero data area, data of half the fixed number of bytes are sequentially obtained on both sides to obtain the middle sampling block; if the number of bytes of the data in the second non-zero data area is less than the fixed number of bytes, zeros are symmetrically padded on both sides of the second non-zero data area to the fixed number of bytes to obtain the middle sampling block.

5. The method according to claim 1, characterized in that The sampling block is in binary data mode, and converting the sampling block into a file vector includes: Dividing the sampling block of the binary data mode into a plurality of byte groups according to a specified number of bytes; The multiple byte groups are input into a multi-layer perceptron to obtain a file vector of a preset dimension corresponding to each byte group, wherein the preset dimension is the dimension corresponding to the vector input into the large language model, and the multi-layer perceptron is used to convert the binary data modality into a natural language modality.

6. The method according to claim 5, characterized in that The numerical value corresponding to the specified number of bytes is smaller than the numerical value corresponding to the preset dimension.

7. The method according to claim 1, characterized in that The step of obtaining input information based on the file vector and the prompt template includes: Inputting the prompt template into the embedding layer of the large language model to obtain an embedding vector, wherein the prompt template is used to stimulate the large language model to output knowledge related to the file structure at the mask position by using a prompt learning method; The embedding vector is concatenated with the file vector to obtain the input information.

8. The method according to claim 1, characterized in that The step of inputting the input information into a large language model to obtain a structural feature representation of the target file includes: Inputting the input information into a large language model to obtain a multi-layer latent vector output by the large language model at a mask position; An attention mechanism is used to select a latent vector of a key layer from the multiple layers of latent vectors, and the latent vector of the selected key layer is determined as the structural feature representation of the target file.

9. The method according to any one of claims 1 to 8, characterized in that Before obtaining the target file to be identified, the method further includes: Acquire a plurality of training files with a small sample size, wherein the types of the plurality of training files are known; Sampling the multiple training files to obtain a training block corresponding to each training file; the training block contains information characterizing the structure of the corresponding training file; Based on each training block, the prompt template and the type of the multiple training files, an initial multilayer perceptron, an initial large language model and an initial classification network are trained respectively to obtain a multilayer perceptron, the large language model and the classification network for converting the sampling block into a file vector.

10. The method according to claim 9, characterized in that After obtaining a plurality of training files with a small sample size, the method further includes: The plurality of training files are grouped according to type, wherein the training files in the same group are of the same type; Determine whether the number of training files in each group is the same; If yes, then perform the step of sampling the multiple training files to obtain a training block corresponding to each training file; If not, a prompt message is output, where the prompt message is used to prompt that the number of training files in each group be adjusted to be the same, and the training files after the number adjustment are sampled to obtain a training block corresponding to each training file.

11. A file type identification device, characterized in that: The device comprises: An acquisition module, used for acquiring a target file to be identified; A sampling module, used for sampling the target file to obtain a sampling block, wherein the sampling block contains information characterizing the structure of the target file; An alignment module, used for converting the sampling block into a file vector; An excitation module, used to obtain input information based on the file vector and a prompt template, wherein the prompt template is used to excite the knowledge related to the output file structure of the large language model by using a prompt learning method; A selection module, used for inputting the input information into a large language model to obtain a structural feature representation of the target file; The identification module is used to input the structural feature representation into a classification network to obtain the type of the target file, wherein the classification network is trained based on an initial classification network using a small sample number of training files.

12. An electronic device, characterized in that: The electronic device comprises: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other via the bus; and the processor is used to call program instructions in the memory to execute the method as claimed in any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The storage medium comprises: a stored program; wherein, when the program is running, the device where the storage medium is located is controlled to execute the method as claimed in any one of claims 1 to 10.

Images