Malicious code classification method based on machine learning and swarm intelligence algorithm

Abstract

The invention belongs to the field of malicious code detection, and provides a malicious code classification method based on machine learning and a swarm intelligence algorithm, and the method comprises the following steps: S1, data preprocessing; s2, feature fusion and selection; s3, model training and classification; according to the method, the n-gram features of different n values are fused for malicious code classification, compared with a classification method based on a single n value, the accuracy rate, the precision rate, the recall rate and the F1-score are all improved, the fused features are further selected through the improved discrete binary particle swarm optimization, the classification precision is improved, and meanwhile the classification efficiency is improved. The characteristic quantity is greatly reduced, and the operation speed of the model is improved.

Description

Technical Field

[0001] The invention belongs to the field of malicious code detection, and specifically is a malicious code classification method based on machine learning and swarm intelligence algorithms. Background Art

[0002] In recent years, with the development of artificial intelligence technology, machine learning has become an important method for malicious code detection. In terms of malicious code feature selection, opcode n-gram feature is one of the frequently used features; some scholars proposed a malware classification method based on the co-occurrence frequency and correlation of opcode sequences, extracted 2-gram features from malware opcode sequences, used the information gain algorithm to select the top 1000 as the most discriminative features, and used support vector machines to classify malicious code; some scholars extracted opcode 4-gram features, and used artificial neural networks, support vector machines, Bayesian networks, random forests and other supervised and unsupervised machine learning methods to distinguish malware from benign files; some scholars proposed a ransomware detection scheme based on PE bytes, using the gain ratio to determine the thousands of 4-gram combinations that are more effective in distinguishing ransomware from benign files, and regarded these more than 1000 4-gram combinations as feature vectors, and used random forests for classification; some scholars used the n-gram algorithm to extract malware opcode features and API call features, and the final label of the malicious sample was determined by the highest probability of the API-based and opcode-based detectors; some scholars also used opcode category sequences and entropy values ​​to create features, and evaluated the effects on various machine learning models such as 5-NN, SVM and random forests.

[0003] Although the above machine learning methods using n-gram features for malicious code detection or classification have achieved certain results, they still have the following two shortcomings: First, most methods only use the best performing 3-gram as features, and do not study the effect of fusing n-gram features with different n values; Second, in terms of the number of feature extraction, most methods determine the optimal number through manual settings and repeated experiments, which is inefficient and difficult to achieve the best results.

[0004] To this end, those skilled in the art have proposed a malicious code classification method based on machine learning and swarm intelligence algorithms to solve the problems raised by the background technology. Summary of the invention

[0005] In order to solve the above technical problems, the present invention provides a malicious code classification method based on machine learning and swarm intelligence algorithm to solve the problems in the prior art.

[0006] A malicious code classification method based on machine learning and swarm intelligence algorithm includes the following steps:

[0007] S1. Data preprocessing: disassemble the original malicious code file to obtain the assembly code file, extract the operation code sequence, and generate n-gram features of different lengths through the n-gram algorithm. The n-gram algorithm includes sequentially generating 2-gram, 3-gram, 4-gram and 5-gram features, and normalizing the generated n-gram features;

[0008] S2, feature fusion and selection: using document frequency statistics to extract a predetermined number of features from each n-value n-gram feature and fuse them, and using an improved discrete binary particle swarm algorithm to select key features from the fused features. The document frequency statistics method is used to count the occurrence frequency of each n-value n-gram feature, and the first 500 features are selected for fusion to obtain a total of 2000 fused features. The improved discrete binary particle swarm algorithm introduces crossover and mutation operations of the genetic algorithm and uses the accuracy of the random forest classifier as the fitness function to select key features from the fused features.

[0009] S3. Model training and classification: Based on the selected key features, the random forest algorithm is used for model training and for the classification of malicious code. The random forest algorithm integrates the prediction results of multiple decision trees and uses the average value to summarize the decision to improve the accuracy and stability of the classification model.

[0010] Preferably, in step S1, the data preprocessing step includes the following specific steps:

[0011] S11. Use IDEPro tool to disassemble the original malicious code file;

[0012] S12, read the opcode sequence from the .text field of the disassembled file;

[0013] S13, obtaining 2-gram data of the operation code sequence;

[0014] S14, counting the number of times for each 2-gram feature;

[0015] S15, retaining 2-gram features whose occurrence times are greater than the set threshold;

[0016] S16. Use the Min-Max normalization method to normalize the data so that the feature values ​​are mapped to the interval [0,1], as shown in formula (1), where X min is the minimum value of the data, X max The maximum value of the data

[0017]

[0018] S17. Repeat steps S13 to S16 to extract 3-gram, 4-gram and 5-gram features in sequence.

[0019] Preferably, in step S2, the specific steps of feature fusion are as follows:

[0020] S21 a. For each 2-gram feature, count the document frequency;

[0021] S22a, sort the 2-gram features from large to small according to the document frequency value;

[0022] S23a, select the first 500 2-gram features;

[0023] S24a, repeat the method of steps S21 to S23, and obtain 500 3-gram, 4-gram and 5-gram features respectively;

[0024] S25a. All the features obtained in steps S21 to S24 are merged to obtain 2000 features.

[0025] Preferably, in step S2, the fused features are further screened using an improved particle swarm algorithm to retain only key features. The specific steps of the particle swarm algorithm are as follows:

[0026] S21b, set the number of particles, number of iterations, inertia weight, cognitive weight and social weight parameters;

[0027] S22b, randomly initialize the particle position and speed. The position of each particle is represented by a 2000-dimensional vector, and the value of each dimension is 0 or 1. If the value is 1, it means that the feature corresponding to the dimension is selected, otherwise it is not selected. The speed of each particle is also represented by a 2000-dimensional vector, and the value of each dimension is a random number in the interval [0,1);

[0028] S23b, calculate the fitness of the particle, use the accuracy of the random forest classifier as the fitness function, evaluate each particle, and update the particle's own optimal solution and the global optimal solution;

[0029] S24b, update the particle speed and position, use formula (2) and formula (3) to update the speed and position of each particle. Formula (2) consists of three terms. In the first term, ω is the inertia weight, v id t is the velocity of the particle in the i-th dimension at time t. This term indicates that the particle has inertia, and the velocity at the next moment is related to the velocity at the previous moment. In the second term, c1 is the cognitive weight, r1 is a random number, and p id tis the optimal solution found by the particle itself. This item represents the particle's own thinking, that is, making the next behavioral decision based on its own past experience. In the third item, c2 is the social weight, r2 is the random number, and p gd t is the global optimal solution found in the group. This item indicates that particles can share information and make full use of their own experience while searching for a consistent cognitive process.

[0030] v id t+1 =ωv id t +c1r1(p id t -x id t )+c2r2(p gd t -x gd t ) (2)

[0031] x id t+1 =x id t +v id t (3)

[0032] S25b, randomly select a particle and perform crossover mutation. In the crossover operation, two positions are randomly generated for the randomly selected individual, which constitute the fragment to be crossed by the individual, and the fragment is replaced with the corresponding fragment of the global optimal individual. In the mutation operation, a position is randomly generated for the randomly selected individual. If the element of the position is 0, it is replaced with 1, and if it is 1, it is replaced with 0;

[0033] S26b, repeat steps S23b to S25b until the number of iterations is reached;

[0034] S27b, output the selected feature subset to obtain the global optimal solution p gd t Based on this, the features with dimension value 1 are selected as the optimal feature subset.

[0035] Preferably, in step S3, the malicious code classification is based on the optimal feature subset and is classified using random forest, and the specific steps are as follows:

[0036] S31, divide the data set into a training set and a test set in a ratio of 7:3;

[0037] S32, performing random sampling with replacement on the original training set to generate K groups of training subsets;

[0038] S33, for each training subset, randomly sample M features from the N features output by the particle swarm algorithm to construct an optimal learning model, where M = Sqrt(N);

[0039] S34, use K optimal learning models to classify the test set data respectively, and use the relative majority voting method to determine the optimal classification result, as shown in formula (4), where Represents model h i In category c j The output on, T is the number of categories

[0040]

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] 1. The present invention classifies malicious code by fusing n-gram features with different n values. Compared with the classification method based on a single n value, the accuracy, precision, recall and F1-score are all improved.

[0043] 2. The present invention further selects the fused features by adopting discrete binary particle swarm algorithm, which greatly reduces the feature quantity and improves the model running speed while improving the classification accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is the overall framework diagram of the method of the present invention;

[0045] Figure 2 A diagram of the crossover operation introduced by the discrete binary particle swarm algorithm of the present invention;

[0046] Figure 3 A diagram of the crossover operation introduced by the discrete binary particle swarm algorithm of the present invention;

[0047] Figure 4 It is a fitness curve diagram of the discrete binary particle swarm algorithm of the present invention;

[0048] Figure 5 It is a schematic diagram for comparing the performance evaluation of the present invention. DETAILED DESCRIPTION

[0049] The following embodiments of the present invention are described in further detail in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0050] like Figures 1 to 5 As shown:

[0051] Embodiment 1: Taking the public data set provided by Kaggle for the Microsoft malware classification challenge as an example, the present invention provides a malicious code classification method based on machine learning and swarm intelligence algorithm, including the following steps:

[0052] S1. Data preprocessing: The Kaggle dataset comes with a disassembly file, which can be used directly. The opcode sequence is extracted from the disassembly file, and the n-gram algorithm is used to generate 2-gram, 3-gram, 4-gram and 5-gram features in turn, and then normalized.

[0053] S2. Feature fusion and selection: The document frequency statistics method is used to extract the pre-determined number of features from each n-value n-gram feature and fuse them. The improved discrete binary particle swarm algorithm is used to select key features from the fused features. The document frequency statistics method is used to count the occurrence frequency of each n-value n-gram feature, and the first 500 features are selected for fusion to obtain a total of 2000 fused features. The improved discrete binary particle swarm algorithm introduces the crossover and mutation operations of the genetic algorithm and uses the accuracy of the random forest classifier as the fitness function to select key features from the fused features.

[0054] S3. Model training and classification: Based on the selected key features, the random forest algorithm is used for model training and for the classification of malicious code. The random forest algorithm integrates the prediction results of multiple decision trees and uses the average value to summarize the decision to improve the accuracy and stability of the classification model.

[0055] Furthermore, in step S1, the specific steps of data preprocessing are as follows:

[0056] S11. Disassemble the file using the Kaggle dataset.

[0057] S12, read the opcode sequence from the .text field of the disassembled file;

[0058] S13, obtaining 2-gram data of the operation code sequence;

[0059] S14, counting the number of times for each 2-gram feature;

[0060] S15, retain 2-gram features with a frequency greater than 700;

[0061] S16. Use the Min-Max normalization method to normalize the data so that the feature values ​​are mapped to the interval [0,1], as shown in formula (1), where X min is the minimum value of the data, X max The maximum value of the data

[0062]

[0063] S17. Repeat steps S13 to S16 to extract 3-gram, 4-gram and 5-gram features in sequence.

[0064] Furthermore, in step S2, the specific steps of feature fusion are as follows:

[0065] S21 a. For each 2-gram feature, count the document frequency;

[0066] S22a, sort the 2-gram features from large to small according to the document frequency value;

[0067] S23a, select the first 500 2-gram features;

[0068] S24a, repeat the method of steps S21 to S23, and obtain 500 3-gram, 4-gram and 5-gram features respectively;

[0069] S25a. All the features obtained in steps S21 to S24 are merged to obtain 2000 features.

[0070] Furthermore, the fused features are further screened using an improved particle swarm algorithm to retain only the key features. The specific steps of the particle swarm algorithm are as follows:

[0071] S21 b, set the number of particles to 50, the number of iterations to 100, the inertia weight to 0.5, and the cognitive weight and social weight to 1.5;

[0072] S22b, randomly initialize the particle position and speed. The position of each particle is represented by a 2000-dimensional vector, and the value of each dimension is 0 or 1. If the value is 1, it means that the feature corresponding to the dimension is selected, otherwise it is not selected. The speed of each particle is also represented by a 2000-dimensional vector, and the value of each dimension is a random number in the interval [0,1);

[0073] S23b, calculate the fitness of the particle, use the accuracy of the random forest classifier as the fitness function, evaluate each particle, and update the particle's own optimal solution and the global optimal solution;

[0074] S24b, update particle speed and position;

[0075] S25b, randomly select a particle and perform crossover mutation;

[0076] S26b, repeat steps S23b to S25b until the number of iterations is reached;

[0077] S27b, output the selected feature subset.

[0078] Furthermore, in step S3, the malicious code classification is based on the optimal feature subset and is classified using random forest. The specific steps are as follows:

[0079] S31, divide the data set into a training set and a test set in a ratio of 7:3;

[0080] S32, performing random sampling with replacement on the original training set to generate 100 training subsets;

[0081] S33, for each training subset, randomly sample M features from the N features output by the particle swarm algorithm to construct an optimal learning model, where M = Sqrt(N);

[0082] S34. Use 100 optimal learning models to classify the test set data respectively, and use the relative majority voting method to determine the optimal classification result.

[0083] Experimental example: In order to fully verify the performance of the present invention, the following three experiments are designed, and the present invention adopts the following parameter configuration: the number of particles in the particle swarm algorithm is set to 50, the number of iterations is set to 100, the inertia weight is set to 0.5, the cognitive weight and the social weight are both set to 1.5, and the fitness evaluation function is the random forest classification accuracy; the number of trees in the random forest algorithm is set to 100, and the value of the random state is set to 42.

[0084] Experiment 1: Comparison experiment before and after n-gram feature fusion

[0085] To verify the effect of fusion of n-gram features with different n values, we first used 2-gram, 3-gram, 4-gram and 5-gram features to conduct experiments separately, recorded the values ​​of various evaluation indicators, and then fused all the features without using the IBPSO algorithm for feature selection. The performance data is shown in the following table:

[0086]

[0087] By comparing the performance data before and after the fusion of n-gram features in detail, it is found that the accuracy of classification using the fused features is 99.13%, which is 0.15%, 0.25%, 0.5% and 0.4% higher than that of using 2-gram, 3-gram, 4-gram or 5-gram features separately, respectively. The precision rate is also the best. Although the recall rate and F1 value are not the highest, they are higher than the average level. Therefore, the classification effect of using the fused n-gram features is better than that of using the n-gram features with a single n value.

[0088] Experiment 2: Particle Swarm Algorithm Evaluation Experiment

[0089] In order to verify the effectiveness of the proposed IBPSO algorithm, the effects of no feature selection, feature selection using the BPSO algorithm, and feature selection using the IBPSO algorithm are compared, as shown in the following table:

[0090]

[0091]

[0092] It can be seen that after using the BPSO algorithm to select features, all indicators have been improved and the number of features has been greatly reduced. After using the IBPSO algorithm to select features, although the accuracy is slightly poor, the other indicators are higher than the BPSO algorithm. The number of features is further reduced to 320, which is conducive to improving the running speed of the random forest classifier.

[0093] Experiment 3: Comparison with other malicious code classification methods

[0094] The present invention is compared with the existing malicious code classification technology, as shown in the following table:

[0095]

[0096] The classification method of the present invention has an accuracy rate lower than 99%, while the other indicators are higher than 99%. Compared with the advanced deep learning method, although there are still gaps in some indicators, this method is easy to implement, has a small number of parameters, and a short model training time, and has certain advantages in malicious code classification.

[0097] From the above, it can be seen that the present invention classifies malicious code by fusing n-gram features of different n values. Compared with the classification method based on a single n value, the accuracy, precision, recall rate and F1-score are all improved. At the same time, by adopting the IBPSO algorithm to further select the fused features, the classification accuracy is improved while the feature quantity is greatly reduced, thereby improving the model running speed.

[0098] The embodiments of the present invention are provided for the purpose of illustration and description. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations of the present invention. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A malicious code classification method based on machine learning and swarm intelligence algorithm, characterized by: The following steps are involved: S1. Data preprocessing: disassemble the original malicious code file to obtain the assembly code file, extract the operation code sequence, and generate n-gram features of different lengths through the n-gram algorithm. The n-gram algorithm includes sequentially generating 2-gram, 3-gram, 4-gram and 5-gram features, and normalizing the generated n-gram features; S2, feature fusion and selection: using document frequency statistics to extract a predetermined number of features from each n-value n-gram feature and fuse them, and using an improved discrete binary particle swarm algorithm to select key features from the fused features. The document frequency statistics method is used to count the occurrence frequency of each n-value n-gram feature, and the first 500 features are selected for fusion to obtain a total of 2000 fused features. The improved discrete binary particle swarm algorithm introduces crossover and mutation operations of the genetic algorithm and uses the accuracy of the random forest classifier as the fitness function to select key features from the fused features. S3. Model training and classification: Based on the selected key features, the random forest algorithm is used for model training and for the classification of malicious code. The random forest algorithm integrates the prediction results of multiple decision trees and uses the average value to summarize the decision to improve the accuracy and stability of the classification model.

2. A method for classifying malicious code based on machine learning and swarm intelligence algorithm as claimed in claim 1, characterized in that: In step S1, the data preprocessing step includes the following specific steps: S11. Use IDEPro tool to disassemble the original malicious code file; S12, read the opcode sequence from the .text field of the disassembled file; S13, obtaining 2-gram data of the operation code sequence; S14, counting the number of times for each 2-gram feature; S15, retaining 2-gram features whose occurrence times are greater than the set threshold; S16. Use the Min-Max normalization method to normalize the data so that the feature values ​​are mapped to the interval [0,1], as shown in formula (1), where X min is the minimum value of the data, X max The maximum value of the data S17. Repeat steps S13 to S16 to extract 3-gram, 4-gram and 5-gram features in sequence.

3. The method for classifying malicious code based on machine learning and swarm intelligence algorithm as claimed in claim 1, characterized in that: In step S2, the specific steps of feature fusion are as follows: S21 a. For each 2-gram feature, count the document frequency; S22a, sort the 2-gram features from large to small according to the document frequency value; S23a, select the first 500 2-gram features; S24a, repeat the method of steps S21 to S23, and obtain 500 3-gram, 4-gram and 5-gram features respectively; S25a. All the features obtained in steps S21 to S24 are merged to obtain 2000 features.

4. The method for classifying malicious code based on machine learning and swarm intelligence algorithm as claimed in claim 1, characterized in that: In step S2, the fused features are further screened using an improved particle swarm algorithm to retain only the key features. The specific steps of the particle swarm algorithm are as follows: S21b, set the number of particles, number of iterations, inertia weight, cognitive weight and social weight parameters; S22b, randomly initialize the particle position and speed. The position of each particle is represented by a 2000-dimensional vector, and the value of each dimension is 0 or 1. If the value is 1, it means that the feature corresponding to the dimension is selected, otherwise it is not selected. The speed of each particle is also represented by a 2000-dimensional vector, and the value of each dimension is a random number in the interval [0,1); S23b, calculate the fitness of the particle, use the accuracy of the random forest classifier as the fitness function, evaluate each particle, and update the particle's own optimal solution and the global optimal solution; S24b, update the particle speed and position, use formula (2) and formula (3) to update the speed and position of each particle. Formula (2) consists of three terms. In the first term, ω is the inertia weight, v id t is the velocity of the particle in the i-th dimension at time t. This term indicates that the particle has inertia, and the velocity at the next moment is related to the velocity at the previous moment. In the second term, c1 is the cognitive weight, r1 is a random number, and p id t is the optimal solution found by the particle itself. This item represents the particle's own thinking, that is, making the next behavioral decision based on its own past experience. In the third item, c2 is the social weight, r2 is the random number, and p gd t is the global optimal solution found in the group. This item indicates that particles can share information and make full use of their own experience while searching for a consistent cognitive process. v id t+1 =ωv id t +c1r1(p id t -x id t )+c2r2(p gd t -x gd t ) (2) x id t+1 =x id t +v id t (3) S25b, randomly select a particle and perform crossover mutation. In the crossover operation, two positions are randomly generated for the randomly selected individual, which constitute the fragment to be crossed by the individual, and the fragment is replaced with the corresponding fragment of the global optimal individual. In the mutation operation, a position is randomly generated for the randomly selected individual. If the element of the position is 0, it is replaced with 1, and if it is 1, it is replaced with 0; S26b, repeat steps S23b to S25b until the number of iterations is reached; S27b, output the selected feature subset to obtain the global optimal solution p gd t Based on this, the features with dimension value 1 are selected as the optimal feature subset.

5. The method for classifying malicious code based on machine learning and swarm intelligence algorithm as claimed in claim 1, characterized in that: In step S3, the malicious code classification is based on the optimal feature subset and is classified using random forest. The specific steps are as follows: S31, divide the data set into a training set and a test set in a ratio of 7:3; S32, performing random sampling with replacement on the original training set to generate K groups of training subsets; S33, for each training subset, randomly sample M features from the N features output by the particle swarm algorithm to construct an optimal learning model, where M = Sqrt(N); S34, use K optimal learning models to classify the test set data respectively, and use the relative majority voting method to determine the optimal classification result, as shown in formula (4), where Represents model h i In category c j The output on, T is the number of categories

Images