Malicious code identification method based on multi-modal feature extraction and fusion

Abstract

The invention discloses a malicious code identification method based on multi-modal feature extraction and fusion. The method comprises the steps of firstly extracting features of a sample based on text statistics, and capturing shallow semantics of the sample; converting the source code file into a grayscale image, extracting three detail components in the vertical, horizontal and diagonal directions from the grayscale image through wavelet transform, learning the weight of the detail components by using a multi-head attention mechanism, fusing the detail components, extracting fused information through a convolutional neural network, and extracting the fused information through the convolutional neural network; and visual features are obtained. Secondly, generating a control flow graph according to a disassembling result of the source code file, and extracting deep semantic information of a sample from the control flow graph by using a graph convolutional network; and finally, fusing the three extracted features, and inputting the fused features into a classifier to realize malicious code identification. Experimental results show that the method can effectively improve the model classification precision.

Description

Technical Field

[0001] The present invention belongs to the field of software security technology, and relates to code classification based on deep learning, and specifically to a malicious code identification method based on multimodal feature extraction and fusion. Background Art

[0002] Traditional signature-based detection methods require experts to manually review and confirm the malicious code, sign the malicious code, upload the signature to the virus database, and finally download the virus database by the end user to form protection for the specified sample. This method is based on the situation that the malicious code has been discovered, so the protection of malicious code will inevitably have a certain hysteresis.

[0003] Most of the existing new malicious codes are variants of known malicious codes, so there is a certain degree of similarity between malicious code samples from the same family. The malicious code sample classification method based on deep learning can learn the characteristics of known malicious code families, thereby helping users quickly predict whether unknown code targets are malicious files, and isolate new malware in time when it appears to prevent computers from being damaged.

[0004] In current malware classification research, most methods increase the complexity of single-modal features to obtain more information. For example, the visual classification method that converts the hexadecimal file of the sample into image features can improve the classification accuracy to a certain extent by increasing the number of channels of the image, but at the cost of doubling the amount of calculation. Since the visual conversion process is mechanical and formulaic, it does not require any contextual connection or understanding of the execution flow of the code, and it is impossible to capture the semantic information in the code. For single-modal features, stacking the number of feature channels does not enhance its ability to express semantic information, and cannot solve the inherent defects. Therefore, how to comprehensively and multi-angle utilize sample features to improve classification accuracy remains a challenge. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present invention proposes a malicious code recognition method based on multimodal feature extraction and fusion, which characterizes and interprets malicious code from multiple perspectives, integrating text, grayscale images and directed Figure 3 The features of various modalities are fully utilized to overcome the limitations of single modality features. While reducing the high complexity and large amount of calculation of visualization feature solutions, the overall model performance is guaranteed.

[0006] A malicious code identification method based on multimodal feature extraction and fusion, specifically comprising the following steps:

[0007] Step 1: Count the number of occurrences of each operation code in the sample source code as the text statistical feature of the sample.

[0008] Step 2: Convert the sample source code into a grayscale image, and then use the two-dimensional discrete wavelet transform to perform wavelet decomposition to obtain low-frequency main components and high-frequency detail components in the horizontal, vertical and diagonal directions. Use the multi-head attention mechanism to fuse the high-frequency detail components in the three directions and input them into the convolutional neural network to obtain the wavelet visualization features of the sample.

[0009] Step 3: Disassemble the sample source code to obtain an ASM assembly file containing opcodes and addresses, and construct a control flow graph using basic blocks as nodes and jump instructions between basic blocks as edges. Input the control flow graph into the graph convolutional neural network to extract the control flow graph features of the sample.

[0010] Step 4: Fuse the text statistical features, wavelet visualization features, and control flow graph features extracted in steps 1 to 3, and input them into the classifier to identify malicious code.

[0011] Compared with the prior art, the present invention has the following beneficial effects:

[0012] 1. Based on the visualization features of single-level wavelet transform, the edge detail values ​​in the vertical, horizontal and diagonal directions are extracted from the grayscale original image respectively. On this basis, the attention mechanism is used to automatically learn the weights between the detail components to learn different angles and more diverse visualization detail features. The detail information is extracted while considering the performance, which reduces the complex calculation process of the visualization features, further reduces the redundant information, and improves the classification ability of the model.

[0013] 2. Multimodal feature learning combines the traditional feature of treating samples as pure text content with the behavior-based control flow feature. The text statistics-based feature characterizes the shallow semantics of the malicious code. The visualization-based feature better introduces the research results of computer graphics. The control flow-based feature is used to supplement the behavioral semantics of the malicious code. Using only one or more parts of it cannot complete the malicious code classification task well. Multimodality complements each other and further improves the classification accuracy of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 1 is an overall framework diagram of a multimodal malware classification method based on deep learning in an embodiment;

[0015] Figure 2 Schematic diagram of wavelet decomposition;

[0016] Figure 3 Schematic diagram of the convolutional neural network structure used in the embodiment;

[0017] Figure 4 Schematic diagram of the graph convolutional network structure used in the embodiment;

[0018] Figure 5 It is a schematic diagram of feature fusion screening in the embodiment. DETAILED DESCRIPTION

[0019] The present invention is further explained below with reference to the accompanying drawings:

[0020] A malicious code identification method based on multimodal feature extraction and fusion, such as Figure 1 As shown, firstly, multimodal features are extracted for the sample source code, including features based on text statistics, visualization features based on wavelet decomposition, and graph features based on control flow, then the multimodal features are fused, and malicious code is identified based on the multimodal features. This embodiment uses the data in the public data set BIG2015 as samples, first preprocesses and standardizes the original data set, then divides the data into training set, validation set, and test set in a ratio of 8:1:1, and implements this method in a ten-fold cross-validation environment setting, and the specific steps are as follows:

[0021] Step 1: Select 85 opcodes from the x86 assembly instruction set according to different functions, use XGBoost to perform 10-fold cross validation and select the top 64 instruction opcodes with the highest importance scores as text statistical features F Opcode .

[0022] Step 2: Convert the sample source code into a grayscale image and extract features from the texture of the sample visualization image:

[0023] Step 2.1: Convert the sample PE file content into hexadecimal code byte by byte, corresponding to the grayscale pixel value with a depth of 8 bits, so as to obtain the grayscale image corresponding to the sample source code with a size of 128×128.

[0024] Step 2.2: Use two-dimensional discrete wavelet transform to perform wavelet decomposition on the grayscale image to obtain a low-frequency main component cA and high-frequency detail components cH, cV, cD in the horizontal, vertical and diagonal directions.

[0025] The discrete wavelet discretizes the scale and translation of the basic wavelet. In order to solve the problem of computational complexity, the scaling factor and translation parameters of the discrete wavelet are set to 2 in this embodiment. j , j is a positive integer. YesL 2 (R 2 ) space with is the orthogonal multi-scale analysis of the scale function, where Represented at scale 2j The corresponding basis functions in the multi-scale decomposition, R 2 is a two-dimensional real number space, L 2 (R 2 ) is defined in the two-dimensional real number space R 2 The space of square integrable functions on R. (x, y) is the pixel coordinate, x, y∈R, where is a one-dimensional scaling function.

[0026] One-dimensional scaling function For low pass filter The corresponding one-dimensional wavelet basis ψ(x) is the corresponding high-pass filter Construct a filter bank and perform wavelet decomposition on the grayscale image obtained in step 2.1. First, perform a first-level filtering along the column direction, then perform downsampling, and then filter along the row. Perform downsampling to obtain the main component cA of the low-frequency subband and the high-frequency detail components cH, cV, and cD in the horizontal, vertical, and diagonal directions, which correspond to the edge detail values ​​in the vertical, horizontal, and diagonal directions, respectively. Since each component is obtained by downsampling twice by row or column, the length and width of the four components obtained are 1 / 2 of the original grayscale image, that is, 64×64, as shown in Figure 2 As shown:

[0027]

[0028] where ψ H (x, y), ψ V (x, y), ψ D (x, y) represents two-dimensional wavelet functions that are sensitive to the horizontal, vertical, and diagonal directions, respectively, and represent the grayscale changes along the horizontal direction of the column, the vertical direction of the row, and the diagonal direction of the edge, respectively.

[0029] Each time a wavelet transform is performed on an image, a low-frequency subband and three high-frequency subbands are generated. Each subsequent transform is performed based on the low-frequency subband generated by the previous level of transform. Considering the amount of calculation and high efficiency, only one level of wavelet transform is performed in this embodiment, that is, j=1.

[0030] Step 2.3: In order to reduce information redundancy, the high-frequency detail components cH, cV, and cD obtained in step 2.2 are fused using a multi-head attention mechanism. The importance scores of high-frequency details in different directions are automatically learned as weight values, giving greater weights to important features while reducing the proportion of redundant features.

[0031] The multi-head attention mechanism consists of three linear layers W q , W k 、w vCalculate the attention matrices Q, K, and V. In order to make the components in each direction be treated as a whole and learn weights separately, cH, cV, and cD are input into three heads for self-attention calculation, and finally the output of each head is concatenated and passed through a fully connected layer to obtain the final output D, whose size is 64×64.

[0032] Step 2.4: Use a convolutional neural network consisting of three convolutional layers to learn the features on D as the wavelet visualization feature F Visual , the convolutional neural network structure is as follows Figure 3 shown.

[0033] Step 3: Create a control flow graph for the sample and extract context information from it:

[0034] Step 3.1: Use IDA Pro reverse engineering tool to disassemble the sample PE file and obtain the ASM assembly file containing opcodes and addresses.

[0035] Step 3.2: Read each line of the ASM assembly file, take a code block with only one entry and one exit, namely a basic block, as a node, and take instructions that jump from one basic block to another basic block as directed edges, so as to establish a control flow graph of the sample.

[0036] Step 3.3: Input the control flow graph into Figure 4 In the graph convolutional network shown, the graph feature F of the control flow is learned Graph .

[0037] Step 4: Extract the text statistical features F Opcode , wavelet visualization feature F Visual and control flow graph feature F Graph The data is input into the self-attention mechanism to complete feature fusion, and then XGBoost is used as the classifier to perform ten-fold cross validation.

[0038] In one embodiment, firstly, the text statistical features F extracted in the above steps are respectively Opcode ∈R 64 , wavelet visualization feature F Visual ∈R 128 and control flow graph feature F Graph ∈R 512 Train on XGBoost and retain the fields with weight>2 in each feature. Combine the retained features in pairs to generate visualization and control flow graph features F V&L , visualization and text statistical features F V&L And the image and text features F CFG ∈R 490Then use the three combined features to train on XGBoost, and select the fields with weight>2 to form the fusion feature F. V&C&O , complete feature fusion, such as Figure 5 shown.

[0039] In order to prove the effectiveness of this method, a comparative experiment was conducted with the commonly used methods in the prior art. The results are shown in Table 1 and Table 2:

[0040] Table 1

[0041]

[0042] Table 2

[0043]

[0044] Among them, Table 1 is the prediction results of this method on different virus categories. Precision, Recall and F1-Score are selected as evaluation indicators. It can be seen that the F1-Score of this method in all categories has reached at least 97.56%.

[0045] Table 2 shows the comparison results between this method and the commonly used methods in the prior art. The Average Accuracy and Macro F1-Score, which can be calculated from Precision, Recall, and F1-Score, are selected as evaluation indicators to comprehensively reflect the performance of the method. From the data in Table 2, it can be seen that compared with the advanced technologies proposed in recent years, this method has achieved the highest Average Accuracy and Macro F1-Score, indicating that this method has effectively improved the accuracy of the model.

Claims

1. A malicious code identification method based on multimodal feature extraction and fusion, characterized in that: The specific steps include: Step 1: Count the number of occurrences of each opcode in the sample source code as the text statistical feature F of the sample Opcode ; Step 2: Convert the sample source code into a grayscale image, then perform wavelet decomposition on the grayscale image, fuse the high-frequency detail components in the horizontal, vertical and diagonal directions using a multi-head attention mechanism, and then input the convolutional neural network to obtain the wavelet visualization feature F of the sample. Visual ; Step 3: Traverse the ASM assembly file of the sample source code, take all basic blocks as nodes, and take the jump instructions between basic blocks as edges to construct a control flow graph; input the control flow graph into the graph convolutional neural network to extract the control flow graph feature F of the sample Graph ; Step 4: Fuse the text statistical features, wavelet visualization features, and control flow graph features extracted in steps 1 to 3, and input them into the classifier to identify malicious code.

2. The method for identifying malicious code based on multimodal feature extraction and fusion as claimed in claim 1, characterized in that: Calculate the importance scores for the opcodes in the x86 assembly instruction set, select the first 64 opcodes with the highest importance scores, and count the number of times each opcode appears in the sample source code as the text statistical feature F of the sample Opcode .

3. The method for identifying malicious code based on multimodal feature extraction and fusion as claimed in claim 1, characterized in that: Use two-dimensional discrete wavelet transform to perform wavelet decomposition on the grayscale image: Among them, cA is the low-frequency component obtained by decomposition, and cH, cV, and cD are the high-frequency detail components in the horizontal, vertical, and diagonal directions respectively; is a one-dimensional scaling function, ψ(x) and ψ(y) are the one-dimensional wavelet bases corresponding to the scaling function; x, y∈R represent the horizontal and vertical coordinates of the pixel.

4. The method for identifying malicious code based on multimodal feature extraction and fusion as claimed in claim 3, characterized in that: The high-frequency detail components cH, cV, and cD in the three directions are respectively input into the three heads of the multi-head attention mechanism for self-attention calculation. Finally, the output of each head is spliced ​​and then passed through a convolutional neural network including three layers of continuous convolutional layers to obtain the wavelet visualization feature F of the sample. Visual .

5. The method for identifying malicious code based on multimodal feature extraction and fusion as claimed in claim 1, characterized in that: Use IDA Pro reverse engineering tool to disassemble the sample source code and obtain the ASM assembly file containing opcodes and addresses; Read each line of the ASM assembly file, take the basic block with only one entry and one exit as a node, and take the instructions that jump from one basic block to another basic block as directed edges to build the control flow graph of the sample.

6. The method for identifying malicious code based on multimodal feature extraction and fusion as claimed in claim 1, characterized in that: The extracted text statistical features F Opcode , wavelet visualization feature F Visual and control flow graph feature F Graph Input into the self-attention mechanism to complete feature fusion.

7. The method for identifying malicious code based on multimodal feature extraction and fusion as claimed in claim 1, characterized in that: First, the text statistical features F extracted in the above steps are Opcode , wavelet visualization feature F Visual and control flow graph feature F Graph Train on XGBoost, and then retain the fields with weight>2 in each feature; combine the retained features in pairs to generate visualization and control flow graph features F V&O , visualization and text statistical features F V&O And the image and text features F CFG ∈R 490 ; Then use the three features generated by the combination to train on XGBoost, and again select the fields with weight>2 to form the fusion feature F V&C&O , complete feature fusion.

8. The method for identifying malicious code based on multimodal feature extraction and fusion as claimed in claim 1, characterized in that: Select XGBoost as the classifier.

9. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 8.

Images