A malicious code classification method based on machine learning and swarm intelligence algorithm

Abstract

The application belongs to the field of malicious code detection, and provides a malicious code classification method based on machine learning and swarm intelligence algorithm, which comprises the following steps: S1, data preprocessing; S2, feature fusion and selection; S3, model training and classification; the application classifies malicious codes by fusing n-gram features with different n values, compared with a classification method based on a single n value, the four indexes of accuracy, precision, recall and F1-score are all improved, the improved discrete binary particle swarm optimization algorithm is used to further select the fused features, the classification precision is improved, the feature quantity is greatly reduced, and the model running speed is improved.

Description

Technical Field

[0001] This invention belongs to the field of malicious code detection, specifically a malicious code classification method based on machine learning and swarm intelligence algorithms. Background Technology

[0002] In recent years, with the development of artificial intelligence technology, machine learning has become an important method for detecting malicious code. In the selection of malicious code features, opcode n-gram features are among the most frequently used. Some scholars have proposed a malware classification method based on the co-occurrence frequency and correlation of opcode sequences, extracting 2-gram features from malware opcode sequences and using the information gain algorithm to select the top 1000 as the most discriminative features, then using support vector machines for malware classification. Other scholars extract 4-gram opcode features and use various supervised and unsupervised machine learning methods such as artificial neural networks, support vector machines, Bayesian networks, and random forests to distinguish between malware and benign files. Some scholars have proposed a ransomware detection scheme based on PE bytes, using gain ratios to determine thousands of 4-gram combinations that more effectively distinguish ransomware from benign files, treating these 1000+ 4-gram combinations as feature vectors, and using random forests for classification. Some scholars use n-gram algorithms to extract malware opcode features and API call features, with the final label of the malicious sample determined by the highest probability from both API-based and opcode-based detectors. Still others use opcode category sequences and entropy values ​​to create features, evaluating their effectiveness on various machine learning models such as 5-NN, SVM, and random forests.

[0003] The machine learning methods above that use n-gram features for malicious code detection or classification have achieved certain results, but still have the following two shortcomings: First, most methods only use the best-performing 3-gram as features, without studying the effect of fusing n-gram features with different n values; Second, in terms of the number of features extracted, most methods determine the optimal number through manual setting and repeated experimentation, which is inefficient and makes it difficult to achieve the best results.

[0004] To address this issue, those skilled in the art have proposed a malicious code classification method based on machine learning and swarm intelligence algorithms. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a malicious code classification method based on machine learning and swarm intelligence algorithms, thereby resolving the issues in the prior art.

[0006] A method for classifying malicious code based on machine learning and swarm intelligence algorithms includes the following steps:

[0007] S1. Data preprocessing: Disassemble the original malicious code file to obtain the assembly code file, extract the opcode sequence, and generate n-gram features of different lengths through the n-gram algorithm. The n-gram algorithm includes generating 2-gram, 3-gram, 4-gram and 5-gram features in sequence, and normalizing the generated n-gram features.

[0008] S2. Feature Fusion and Selection: A predetermined number of features are extracted from each n-value n-gram feature using document frequency statistics and then fused. An improved discrete binary particle swarm optimization algorithm is used to select key features from the fused features. The document frequency statistics method is used to count the occurrence frequency of each n-value n-gram feature and select the top 500 features for fusion, resulting in a total of 2000 fused features. The improved discrete binary particle swarm optimization algorithm introduces crossover and mutation operations from a genetic algorithm and uses the accuracy of a random forest classifier as the fitness function to select key features from the fused features.

[0009] S3. Model Training and Classification: Based on the selected key features, the random forest algorithm is used to train the model and apply it to the classification of malicious code. The random forest algorithm integrates the prediction results of multiple decision trees and uses the average value to summarize the decision, so as to improve the accuracy and stability of the classification model.

[0010] Preferably, in step S1, the specific steps of the data preprocessing stage are as follows:

[0011] S11. Use the IDEPro tool to disassemble the original malicious code file;

[0012] S12. Read the opcode sequence from the .text field of the disassembled file;

[0013] S13. Obtain the 2-gram data of the opcode sequence;

[0014] S14. Count the number of occurrences for each 2-gram feature;

[0015] S15. Retain 2-gram features that appear more than a set threshold number of times;

[0016] S16. The data is normalized using the Min-Max normalization method, so that the feature values ​​are mapped to the interval [0,1], as shown in equation (1), where X min X is the minimum value of the data. max Maximum value of data

[0017]

[0018] S17. Repeat steps S13 to S16 to extract 3-gram, 4-gram and 5-gram features in sequence.

[0019] Preferably, in step S2, the specific steps of feature fusion are as follows:

[0020] S21 a. For each 2-gram feature, count the document frequency;

[0021] S22a. Sort the 2-gram features in descending order of document frequency.

[0022] S23a. Select the first 500 2-gram features;

[0023] S24a, Repeat steps S21 to S23 to obtain 500 3-gram, 4-gram and 5-gram features in sequence;

[0024] S25a. All features obtained in steps S21 to S24 are fused to obtain 2000 features.

[0025] Preferably, in step S2, the fused features are further filtered using an improved particle swarm optimization algorithm, retaining only the key features. The specific steps of the particle swarm optimization algorithm are as follows:

[0026] S21b, Set the parameters for particle count, iteration count, inertia weight, cognitive weight, and social weight;

[0027] S22b. Randomly initialize the particle position and velocity. The position of each particle is represented by a 2000-dimensional vector. The value of each dimension is 0 or 1. If the value is 1, it means that the feature corresponding to that dimension is selected. Otherwise, it is not selected. The velocity of each particle is also represented by a 2000-dimensional vector. The value of each dimension is a random number in the interval [0,1).

[0028] S23b. Calculate particle fitness. Use the accuracy of the random forest classifier as the fitness function to evaluate each particle and update the particle's own optimal solution and the global optimal solution.

[0029] S24b. Update particle velocity and position. Use equations (2) and (3) to update the velocity and position of each particle. Equation (2) consists of three terms. In the first term, ω is the inertia weight, v id t The first term represents the velocity of the particle in the i-th dimension at time t. This term indicates that the particle has inertia, and the velocity at the next moment is related to the velocity at the previous moment. In the second term, c1 is the cognitive weight, r1 is a random number, and p... id tThe optimal solution found by the particle itself represents the particle's own thinking, that is, making decisions about its next action based on its past experience. In the third term, c2 is the social weight, r2 is the random number, and p... gd t The term "globally optimal solution found in the swarm" indicates that particles can share information, utilizing their own experience while also leveraging the experience of their peers to achieve a unified understanding during the search process.

[0030] v id t+1 =ωv id t +c1r1(p id t -x id t )+c2r2(p gd t -x gd t (2)

[0031] x id t+1 =x id t +v id t (3)

[0032] S25b. Randomly select a particle and perform crossover mutation. In the crossover operation, for the randomly selected individual, two positions are randomly generated to form the fragment to be crossed by the individual. Replace it with the corresponding fragment of the globally optimal individual. In the mutation operation, for the randomly selected individual, a position is randomly generated. If the element of the position is 0, it is replaced with 1. If it is 1, it is replaced with 0.

[0033] S26b, Repeat steps S23b to S25b until the required number of iterations is reached;

[0034] S27b, Output the selected feature subset, with the global optimal solution p gd t Based on this, features with a dimension value of 1 are selected as the optimal feature subset.

[0035] Preferably, in step S3, the malicious code classification is based on the optimal feature subset and uses random forest for classification. The specific steps are as follows:

[0036] S31. Divide the dataset into a training set and a test set in a 7:3 ratio;

[0037] S32. Perform random sampling with replacement on the original training set to generate K training subsets;

[0038] S33. For each training subset, randomly sample M features from the N features output by the particle swarm optimization algorithm to construct the optimal learning model, where M = Sqrt(N).

[0039] S34. K optimal learning models are used to classify the test set data respectively, and the optimal classification result is determined by relative majority voting, as shown in equation (4). Model h i In category c j The output above, where T is the number of categories.

[0040]

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] 1. This invention classifies malicious code by fusing n-gram features with different n values. Compared with classification methods based on a single n value, it improves all four indicators: accuracy, precision, recall, and F1-score.

[0043] 2. This invention employs a discrete binary particle swarm optimization algorithm to further select from the fused features, thereby improving classification accuracy while significantly reducing the number of features and increasing model running speed. Attached Figure Description

[0044] Figure 1 This is a diagram illustrating the overall framework of the method of the present invention;

[0045] Figure 2 A diagram illustrating the crossover operation introduced in the discrete binary particle swarm algorithm of this invention;

[0046] Figure 3 A diagram illustrating the crossover operation introduced in the discrete binary particle swarm algorithm of this invention;

[0047] Figure 4 This is a fitness curve diagram of the discrete binary particle swarm optimization algorithm of the present invention;

[0048] Figure 5 This is a comparative diagram illustrating the performance evaluation of the present invention. Detailed Implementation

[0049] The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and should not be construed as limiting the scope of the invention.

[0050] like Figures 1 to 5 As shown:

[0051] Example 1: Taking the public dataset provided in Kaggle for the Microsoft Malware Classification Challenge as an example, this invention provides a malware classification method based on machine learning and swarm intelligence algorithms, including the following steps;

[0052] S1. Data Preprocessing: The Kaggle dataset comes with a disassembly file, which can be used directly. Extract the opcode sequence from the disassembly file, and use the n-gram algorithm to generate 2-gram, 3-gram, 4-gram and 5-gram features in sequence, and then perform normalization processing.

[0053] S2. Feature Fusion and Selection: The document frequency statistics method is used to extract a predetermined number of features from each n-value n-gram feature and fuse them. An improved discrete binary particle swarm optimization algorithm is used to select key features from the fused features. The document frequency statistics method is used to count the occurrence frequency of each n-value n-gram feature and select the top 500 features for fusion, resulting in a total of 2000 fused features. The improved discrete binary particle swarm optimization algorithm introduces crossover and mutation operations from the genetic algorithm and uses the accuracy of the random forest classifier as the fitness function to select key features from the fused features.

[0054] S3. Model Training and Classification: Based on the selected key features, the random forest algorithm is used to train the model and apply it to the classification of malicious code. The random forest algorithm integrates the prediction results of multiple decision trees and uses the average value to summarize the decision, thereby improving the accuracy and stability of the classification model.

[0055] Furthermore, in step S1, the specific steps of the data preprocessing stage are as follows:

[0056] S11. Disassemble the Kaggle dataset file;

[0057] S12. Read the opcode sequence from the .text field of the disassembled file;

[0058] S13. Obtain the 2-gram data of the opcode sequence;

[0059] S14. Count the number of occurrences for each 2-gram feature;

[0060] S15. Retain 2-gram features that appear more than 700 times;

[0061] S16. The data is normalized using the Min-Max normalization method, so that the feature values ​​are mapped to the interval [0,1], as shown in equation (1), where X min X is the minimum value of the data. max Maximum value of data

[0062]

[0063] S17. Repeat steps S13 to S16 to extract 3-gram, 4-gram and 5-gram features in sequence.

[0064] Furthermore, in step S2, the specific steps of feature fusion are as follows:

[0065] S21 a. For each 2-gram feature, count the document frequency;

[0066] S22a. Sort the 2-gram features in descending order of document frequency.

[0067] S23a. Select the first 500 2-gram features;

[0068] S24a, Repeat steps S21 to S23 to obtain 500 3-gram, 4-gram and 5-gram features in sequence;

[0069] S25a. All features obtained in steps S21 to S24 are fused to obtain 2000 features.

[0070] Furthermore, the fused features are further filtered using an improved particle swarm optimization algorithm, retaining only the key features. The specific steps of the particle swarm optimization algorithm are as follows:

[0071] S21 b, Set the number of particles to 50, the number of iterations to 100, the inertia weight to 0.5, and the cognitive weight and social weight to 1.5;

[0072] S22b. Randomly initialize the particle position and velocity. The position of each particle is represented by a 2000-dimensional vector. The value of each dimension is 0 or 1. If the value is 1, it means that the feature corresponding to that dimension is selected. Otherwise, it is not selected. The velocity of each particle is also represented by a 2000-dimensional vector. The value of each dimension is a random number in the interval [0,1).

[0073] S23b. Calculate particle fitness by using the accuracy of the random forest classifier as the fitness function to evaluate each particle and update the particle's own optimal solution and the global optimal solution.

[0074] S24b, update particle velocity and position;

[0075] S25b: Randomly select a particle and perform crossover mutation;

[0076] S26b, Repeat steps S23b to S25b until the required number of iterations is reached;

[0077] S27b, Output the selected feature subset.

[0078] Furthermore, in step S3, the malicious code classification is based on the optimal feature subset and uses a random forest for classification. The specific steps are as follows:

[0079] S31. Divide the dataset into a training set and a test set in a 7:3 ratio;

[0080] S32. Perform random sampling with replacement on the original training set to generate 100 training subsets.

[0081] S33. For each training subset, randomly sample M features from the N features output by the particle swarm optimization algorithm to construct the optimal learning model, where M = Sqrt(N).

[0082] S34. Use 100 optimal learning models to classify the test set data respectively, and use the relative majority voting method to determine the optimal classification result.

[0083] Experimental Example: To fully verify the performance of the present invention, the following three experiments were designed, and the present invention was configured with the following parameters: the number of particles in the particle swarm optimization algorithm was set to 50, the number of iterations was set to 100, the inertia weight was set to 0.5, the cognitive weight and the social weight were both set to 1.5, and the fitness evaluation function was the random forest classification accuracy; the number of trees in the random forest algorithm was set to 100, and the value of the random state was set to 42.

[0084] Experiment 1: Comparison of n-gram feature fusion before and after.

[0085] To verify the effect of fusing n-gram features with different n values, experiments were first conducted separately using 2-gram, 3-gram, 4-gram, and 5-gram features, and the values ​​of each evaluation index were recorded. Then, all features were fused without using the IBPSO algorithm for feature selection, and experiments were conducted again. The performance data is shown in the table below:

[0086]

[0087] By comparing the performance data before and after n-gram feature fusion in detail, it was found that the accuracy of classification using the fused features was 99.13%, which was improved by 0.15%, 0.25%, 0.5%, and 0.4% respectively compared with the individual use of 2-gram, 3-gram, 4-gram, and 5-gram features. The precision also showed the best performance. Although the recall and F1 score were not the highest, they were above average. Therefore, the classification effect of using the fused n-gram features is better than that of using n-gram features with a single n value.

[0088] Experiment 2: Particle Swarm Optimization Algorithm Evaluation Experiment

[0089] To verify the effectiveness of the proposed IBPSO algorithm, the performance of feature selection without feature selection, feature selection using the BPSO algorithm, and feature selection using the IBPSO algorithm were compared, as shown in the table below:

[0090]

[0091]

[0092] It can be seen that after using the BPSO algorithm to select features, all indicators are improved and the number of features is greatly reduced. After using the IBPSO algorithm to select features, although the accuracy is slightly worse, all other indicators are higher than the BPSO algorithm, and the number of features is further reduced to 320, which is conducive to improving the running speed of the random forest classifier.

[0093] Experiment 3: Comparison with other malware classification methods

[0094] The present invention is compared with existing malware classification techniques, as shown in the table below:

[0095]

[0096] The classification method of this invention has an accuracy rate of less than 99%, but all other indicators are higher than 99%. Compared with advanced deep learning methods, although there are still gaps in some indicators, this method is easy to implement, has a small number of parameters, and a short model training time, which gives it certain advantages in malicious code classification.

[0097] As can be seen from the above, this invention classifies malicious code by fusing n-gram features with different n values. Compared with classification methods based on a single n value, it improves all four indicators: accuracy, precision, recall, and F1-score. At the same time, by using the IBPSO algorithm to further select the fused features, it significantly reduces the number of features and improves the model's running speed while improving classification accuracy.

[0098] The embodiments of the present invention are given for the purposes of illustration and description. Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for classifying malicious code based on machine learning and swarm intelligence algorithms, characterized in that: Includes the following steps: S1. Data preprocessing: Disassemble the original malicious code file to obtain the assembly code file, extract the opcode sequence, and generate n-gram features of different lengths through the n-gram algorithm. The n-gram algorithm includes generating 2-gram, 3-gram, 4-gram and 5-gram features in sequence, and normalizing the generated n-gram features. S2. Feature Fusion and Selection: A predetermined number of features are extracted from each n-value n-gram feature using document frequency statistics and then fused. An improved discrete binary particle swarm optimization algorithm is used to select key features from the fused features. The document frequency statistics method is used to count the occurrence frequency of each n-value n-gram feature and select the top 500 features for fusion, resulting in a total of 2000 fused features. The improved discrete binary particle swarm optimization algorithm introduces crossover and mutation operations from a genetic algorithm and uses the accuracy of a random forest classifier as the fitness function to select key features from the fused features. S3. Model Training and Classification: Based on the selected key features, the random forest algorithm is used to train the model and apply it to the classification of malicious code. The random forest algorithm integrates the prediction results of multiple decision trees and uses the average value to summarize the decision, so as to improve the accuracy and stability of the classification model.

2. The malicious code classification method based on machine learning and swarm intelligence algorithms as described in claim 1, characterized in that: In step S1, the specific steps of the data preprocessing stage are as follows: S11. Use the IDEPro tool to disassemble the original malicious code file; S12. Read the opcode sequence from the .text field of the disassembled file; S13. Obtain the 2-gram data of the opcode sequence; S14. Count the number of occurrences for each 2-gram feature; S15. Retain 2-gram features that appear more than a set threshold number of times; S16. The data is normalized using the Min-Max normalization method, so that the feature values ​​are mapped to the interval [0,1], as shown in equation (1), where, The minimum value of the data. Maximum value of data (1) S17. Repeat steps S13 to S16 to extract 3-gram, 4-gram and 5-gram features in sequence.

3. The malicious code classification method based on machine learning and swarm intelligence algorithms as described in claim 1, characterized in that: In step S2, the specific steps of feature fusion are as follows: S21a. For each 2-gram feature, count the document frequency; S22a. Sort the 2-gram features in descending order of document frequency. S23a. Select the first 500 2-gram features; S24a, Repeat steps S21 to S23 to obtain 500 3-gram, 4-gram and 5-gram features in sequence; S25a. All features obtained in steps S21 to S24 are fused to obtain 2000 features.

4. The malicious code classification method based on machine learning and swarm intelligence algorithms as described in claim 1, characterized in that: In step S2, the fused features are further filtered using an improved particle swarm optimization algorithm, retaining only the key features. The specific steps of the particle swarm optimization algorithm are as follows: S21b, Set the parameters for particle count, iteration count, inertia weight, cognitive weight, and social weight; S22b. Randomly initialize the particle position and velocity. The position of each particle is represented by a 2000-dimensional vector. The value of each dimension is 0 or 1. If the value is 1, it means that the feature corresponding to that dimension is selected. Otherwise, it is not selected. The velocity of each particle is also represented by a 2000-dimensional vector. The value of each dimension is a random number in the interval [0,1). S23b. Calculate particle fitness by using the accuracy of the random forest classifier as the fitness function to evaluate each particle and update the particle's own optimal solution and the global optimal solution. S24b. Update particle velocity and position. Use equations (2) and (3) to update the velocity and position of each particle. Equation (2) consists of three terms. In the first term... For inertial weights, Let be the velocity of the particle in the i-th dimension at time t. This term indicates that the particle has inertia, and the velocity at the next moment is related to the velocity at the previous moment. In the second term... For cognitive weight, It is a random number. The optimal solution found by the particle itself represents the particle's own thinking, that is, making decisions about its next action based on its past experience. In the third term... As a social weight, It is a random number. The term "globally optimal solution found in the swarm" indicates that particles can share information, utilizing their own experience while also leveraging the experience of their peers to achieve a unified understanding during the search process. （2） （3） S25b. Randomly select a particle and perform crossover mutation. In the crossover operation, for the randomly selected individual, two positions are randomly generated to form the fragment to be crossed by the individual. Replace it with the corresponding fragment of the globally optimal individual. In the mutation operation, for the randomly selected individual, a position is randomly generated. If the value of the position is 0, it is replaced with 1. If it is 1, it is replaced with 0. S26b, Repeat steps S23b to S25b until the required number of iterations is reached; S27b, Output the selected feature subset, which is the globally optimal solution. Based on this, features with a dimension value of 1 are selected as the optimal feature subset.

5. The malicious code classification method based on machine learning and swarm intelligence algorithms as described in claim 1, characterized in that: In step S3, the malicious code classification is based on the optimal feature subset and uses random forest for classification. The specific steps are as follows: S31. Divide the dataset into a training set and a test set in a 7:3 ratio; S32. Perform random sampling with replacement on the original training set to generate K training subsets; S33. For each training subset, randomly sample M features from the N features output by the particle swarm optimization algorithm to construct the optimal learning model, where M = Sqrt(N). S34. K optimal learning models are used to classify the test set data respectively, and the optimal classification result is determined by relative majority voting, as shown in equation (4). Representation Model In category The output on Number of categories （4）。

Images