Malicious command line detection method based on multi-dimensional feature learning and feature focusing

Abstract

The invention belongs to the technical field of network security and machine learning, and discloses a malicious command line detection method based on multi-dimensional feature learning and feature focusing, and the method comprises the steps: outputting high-dimensional features of parameters of a to-be-detected command line; respectively inputting the basic features into a plurality of expansion convolves with dynamic expansion rates to obtain a plurality of branch features; fusing the branch features with the basic features to obtain preliminary fusion features; a hierarchical progressive fusion feature is obtained by adopting an activation function root; carrying out adaptive average pooling operation on the hierarchical progressive fusion features; a multi-layer perceptron is adopted to extract attention weights, the attention weights and the hierarchical progressive fusion features are fused, and focusing features are obtained; all the focusing features are subjected to weighted fusion, final command line features are obtained, the command line features are learned through a detection model, a detection result is output, and the detection result is a malicious command line or a normal command line. The characteristics of the command line parameters are comprehensively and effectively extracted, and the command line detection precision is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and machine learning, and specifically relates to a malicious command line detection method based on multi-dimensional feature learning and feature focusing. Background Art

[0002] Malicious command lines attack targets including system integrity, user privacy, and the stability of network infrastructure. Traditional detection methods (such as blacklist-based detection, heuristic detection, and custom rule detection) have delays and limitations in identifying new threats. This is because these methods rely on known command line features or manual updates, making it difficult to effectively respond to the ever-changing new malicious command line variants.

[0003] With the advancement of machine learning technology, malicious command line detection methods based on machine learning have gradually gained attention. Machine learning technologies used for malicious command line detection include traditional shallow learning technologies and deep learning technologies. In particular, deep learning has shown high accuracy and generalization ability in automatically learning complex and nonlinear hidden features. Deep learning models currently used for malicious command line detection include CNN (convolutional neural network), RNN (recurrent neural network) and Transformer. However, standard Transformer faces some specific challenges in malicious command line detection: (1) The token-based input mechanism limits its ability to capture character-level information, which is crucial for detecting subtle changes in the command line; (2) Transformer is not as effective as CNN in capturing local patterns, which is critical for identifying malicious substructures in the command line; (3) Transformer lacks the ability to recognize the inherent hierarchical structure in command line instructions. Therefore, existing methods are still unable to fully and effectively extract the features of command line parameters, resulting in limited detection accuracy of classification models. Summary of the invention

[0004] The purpose of the present invention is to provide a malicious command line detection method based on multi-dimensional feature learning and feature focusing, which can comprehensively and effectively extract the features of command line parameters and improve the accuracy of command line detection.

[0005] To achieve the above object, the technical solution adopted by the present invention is:

[0006] A malicious command line detection method based on multi-dimensional feature learning and feature focusing, the malicious command line detection method based on multi-dimensional feature learning and feature focusing comprising:

[0007] The CharBERT model is used to output high-dimensional features of the parameters of the command line to be detected;

[0008] Based on the attention mask mechanism, basic features are obtained according to high-dimensional features, and the basic features are input into multiple dilated convolutions with dynamic dilation rates to obtain multiple branch features;

[0009] For each branch feature, the branch feature is fused with the basic feature to obtain a preliminary fusion feature;

[0010] The activation function is used to output dynamic weight coefficients according to the preliminary fusion features, and all preliminary fusion features are weighted fused based on the dynamic weight coefficients to obtain hierarchical progressive fusion features;

[0011] Perform adaptive average pooling operation on the hierarchical progressive fusion features to generate pooling features of different dimensions;

[0012] For the pooled features of each dimension, a multi-layer perceptron is used to extract the attention weight, and the attention weight is fused with the hierarchical progressive fusion features to obtain the focus features of each dimension;

[0013] The focused features of all dimensions are weighted and fused to obtain the final command line features. The command line features are learned using the detection model, and the detection results are output, which are malicious command lines or normal command lines.

[0014] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution, but are merely further supplements or preferences. Under the premise that there are no technical or logical contradictions, each optional method can be combined with the above-mentioned overall solution separately, and multiple optional methods can also be combined.

[0015] Preferably, the dynamic expansion rate is determined as follows:

[0016] ;

[0017] in, Indicates The dynamic dilation rate of the dilated convolution, To obtain the maximum value, Indicates The learning parameters of the dilated convolution, Represents high-dimensional features, represents the Frobenius norm, Indicates a floor operation.

[0018] Preferably, the method of obtaining basic features based on high-dimensional features based on the attention mask mechanism includes:

[0019] Input high-dimensional features into the depth-separable convolution to obtain deep convolution features;

[0020] Use activation functions to convert high-dimensional features into attention masks;

[0021] The multiplication result of the deep convolution feature and the attention mask is taken as the basic feature.

[0022] Preferably, the fusing the branch feature with the basic feature to obtain the preliminary fused feature comprises: reading the fusion coefficient and applying it to the basic feature, and then adding it to the branch feature as the preliminary fused feature.

[0023] Preferably, the step of using an activation function to output a dynamic weight coefficient according to preliminary fusion features comprises:

[0024] The activation function is a softmax normalization function, and the dynamic weight coefficient is calculated as follows:

[0025] ;

[0026] In the formula, Indicates The dynamic weight coefficient corresponding to the initial fusion feature, represents the number of initial fusion features, Represents a natural constant An exponential function with base ;

[0027] when or hour, represents the learning parameters of the basic features, Indicates the basic feature; otherwise Indicates The learning parameters of the initial fusion features, Indicates Initial fusion features, Indicates The learning parameters of the initial fusion features, Indicates A preliminary fusion feature.

[0028] Preferably, the weighted fusion of all preliminary fusion features based on the dynamic weight coefficient to obtain hierarchical progressive fusion features includes:

[0029] ;

[0030] In the formula, It is a hierarchical progressive fusion feature. represents the number of initial fusion features, Indicates The dynamic weight coefficient corresponding to the initial fusion feature, represents the residual scale parameter, Represents high-dimensional features; when hour, Indicates the basic feature; otherwise Indicates A preliminary fusion feature.

[0031] Preferably, the attention weight is fused with the hierarchical progressive fusion feature to obtain the focus feature of each dimension, including:

[0032] ;

[0033] In the formula, Indicates The focus features of the dimensions, Attention weight fusion ratio, It is a hierarchical progressive fusion feature. Indicates The attention weight of each dimension.

[0034] Preferably, the weighted fusion of the focus features of all dimensions includes:

[0035] Perform upsampling operation on the focused features of each dimension to obtain upsampled features;

[0036] Assign weighted weights to the upsampled features to obtain weighted features;

[0037] Use the sum function to sum the weighted features of all dimensions and output the command line features.

[0038] The present invention provides a malicious command line detection method based on multi-dimensional feature learning and feature focusing. The method detects malicious command lines based on command line parameters. By combining character-level embedding and multi-level feature extraction, the method can more comprehensively capture fine-grained features and contextual semantic relationships in command lines, thereby improving the detection capability of complex malicious command lines. The method adopts multi-dimensional feature learning and regional focus attention mechanism, captures local and global features through multi-dimensional convolution combined with different expansion rates, and dynamically weights important regional features through regional focus attention mechanism, so as to achieve comprehensive and effective extraction of command line parameter features, thereby significantly improving the accuracy and robustness of detection, and achieving excellent detection performance in complex scenarios such as imbalance, multi-classification, cross-dataset testing, and adversarial sample attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 The present invention is a flowchart of a malicious command line detection method based on multi-dimensional feature learning and feature focusing. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0042] like Figure 1 As shown, this embodiment provides a malicious command line detection method based on multi-dimensional feature learning and feature focusing, including the following steps:

[0043] (1) Feature extraction based on command line parameters: The CharBERT model (character-aware pre-trained model) is used to output high-dimensional features of the parameters of the command line to be detected.

[0044] This embodiment uses the pre-trained CharBERT model to encode the command line argument (CLA) sequence to generate high-dimensional features. Specifically, the CharBERT model extends the character-aware embedding based on the BERT model, and can capture important contextual information from the characters and subwords in the command line arguments. Each command line parameter is decomposed into multiple character-level or subword-level tokens, and these tokens are embedded and represented in a dual-channel manner. And the output is extracted from the multi-layer Transformer encoder of the CharBERT model, and the output of each layer represents multi-dimensional information, from low-level character features to high-level contextual semantics. A weighted strategy based on the attention mechanism is used to dynamically weight and fuse the outputs of each layer to generate a multi-layer feature matrix, thereby forming a comprehensive command line parameter representation to capture fine-grained and global malicious patterns in the command line parameters. Finally, the embedded representation and the multi-layer feature matrix are fused to obtain high-dimensional features.

[0045] (2) Multi-dimensional feature learning: Multi-dimensional local details and structural relationships are captured through multi-dimensional feature learning.

[0046] (2.1) Adaptive multi-dimensional convolution: Based on the attention mask mechanism, basic features are obtained according to high-dimensional features, and the basic features are input into multiple dilated convolutions with dynamic dilation rates to obtain multiple branch features.

[0047] The deep separable convolution (DSConv) and dilated convolution with dynamic dilation rate are used to capture multi-dimensional feature information. It introduces a dynamic dilation rate mechanism to automatically adjust the dilation rate according to the complexity of the input features, effectively capturing multi-scale command line features. The dynamic dilation rate is determined by the following formula:

[0048] ;

[0049] in, Indicates The dynamic dilation rate of the dilated convolution, To obtain the maximum value, Indicates The initial values ​​of the learnable parameters of the dilated convolution are randomly initialized and continuously optimized during the training process. Represents high-dimensional features, Represents the Frobenius norm, which is used to measure the overall strength of the input features. Indicates a round-down operation. , is the number of dilated convolutions. This formula ensures that the dynamic dilation rate is at least 1 and is adaptively adjusted according to the strength of the input features, allowing the model to flexibly focus on command line features of different scales.

[0050] Formally, high-dimensional features are represented as ,in is the number of channels, is the height, The process first applies the DSConv operation to , that is, input the high-dimensional features into the deep separable convolution to obtain the deep convolution features , represents the DSConv operation; then the attention mask mechanism is introduced to enable the model to adaptively focus on the key character features in the command line and improve the sensitivity to malicious features. This embodiment uses an activation function (such as a Sigmoid function) to convert high-dimensional features into attention masks, and finally takes the multiplication result of the deep convolution feature and the attention mask as the basic feature. The formula is as follows:

[0051] ;

[0052] In the formula, Represents the basic features, represents the attention mask, represents the activation function, is the learnable parameter of the activation function.

[0053] Getting basic features Finally, a convolution operation with a dynamic expansion rate is used to process these features. The formula is as follows:

[0054] ;

[0055] In the formula, For the Branch features, , The dilated convolution operation is a special convolution operation that expands the receptive field by inserting "holes" between the convolution kernel elements without increasing the number of parameters. It is a dynamically determined dilation rate that controls the size of the hole. Different from the traditional dilated convolution which uses a fixed dilation rate, the dilation rate in this invention is It is dynamically adjusted according to the complexity of the input features, enabling the model to adaptively focus on command line features of different scales and enhance the ability to capture complex malicious command line patterns.

[0056] (2.2) Hierarchical progressive feature fusion: Multi-dimensional features are hierarchically and progressively fused through 1×1 convolution with dynamic weights to generate feature representations with rich semantic information. Feature fusion uses weighted nonlinear transformation to enhance the model's ability to recognize subtle features of malicious command lines. Contextual information from multiple dimensions is integrated through residual connections with attention mechanisms.

[0057] (2.2.1) For each branch feature, the branch feature is fused with the basic feature to obtain a preliminary fusion feature. In this embodiment, the fusion coefficient is read and applied to the basic feature, and then added to the branch feature as the preliminary fusion feature. The formula is as follows:

[0058] ;

[0059] In the formula, Indicates Initial fusion features, , For the The fusion coefficient corresponding to the initial fusion feature is a learnable parameter. As the fusion coefficient of each branch feature and the basic feature, adaptive feature fusion is achieved to enhance the model's ability to identify different types of malicious command lines.

[0060] (2.2.2) An activation function is used to output dynamic weight coefficients according to the preliminary fusion features, and all preliminary fusion features are weightedly fused based on the dynamic weight coefficients to obtain hierarchical progressive fusion features.

[0061] This embodiment introduces the softmax normalization function as the activation function to achieve adaptive weight allocation of each branch feature, so that the importance of each branch can be dynamically adjusted according to the characteristics of the input command line. The dynamic weight coefficient is calculated as follows:

[0062] ;

[0063] In the formula, Indicates The dynamic weight coefficient corresponding to the initial fusion feature, represents the number of initial fusion features, Represents a natural constant An exponential function with base .

[0064] when or hour, Represents the learnable parameters of the underlying features, Indicates the basic feature; otherwise Indicates The learnable parameters of the initial fusion features, Indicates Initial fusion features, Indicates The learnable parameters of the initial fusion features, Indicates A preliminary fusion feature.

[0065] In the hierarchical progressive fusion, this embodiment adopts a weighted coefficient The weighted summation replaces the traditional simple summation and adds parameters Controlling Primitive Features The residual contribution of further enhances the model's ability to learn complex command line features. The formula is as follows:

[0066] ;

[0067] In the formula, It is a hierarchical progressive fusion feature. represents the number of initial fusion features, Indicates The dynamic weight coefficient corresponding to the initial fusion feature, Represents the residual ratio parameter, which is set based on experience or experiment. It should be noted that Indicates that there is branches, each branch has an expansion convolution, and obtains the corresponding branch features and preliminary fusion features, and has corresponding learning parameters, dynamic weight coefficients, etc. It can be understood as A dilated convolution, which can also be understood as Branch features.

[0068] In the multi-dimensional feature learning of this embodiment, by introducing adaptive weight allocation, dynamic expansion rate and attention mask mechanism, the model's detection ability for complex malicious command lines is significantly improved, especially when dealing with highly obfuscated and deformed command lines, showing stronger robustness and accuracy. Compared with traditional methods, our hierarchical progressive fusion strategy can more effectively retain and integrate feature information at different levels, reduce information loss, and enhance the generalization ability of the model.

[0069] (3) Regional Focus Attention Mechanism: A spatial regional focus attention mechanism is used to weight different regions of features differently, highlighting information-rich fragments.

[0070] (3.1) Adaptive average pooling: Perform an adaptive average pooling operation on the hierarchical progressive fusion features to generate pooling features of different dimensions. For example, pooling features of sizes 1×1, 2×2, and 4×4 can be generated. These pooling features are used in subsequent attention calculations to help the model assign weights to different regions of the feature.

[0071] (3.2) Attention mechanism: For the pooled features of each dimension, a multi-layer perceptron (MLP) is used to extract the attention weight, and the attention weight is fused with the hierarchical progressive fusion features to obtain the focus features of each dimension. The formula is as follows:

[0072] ;

[0073] In the formula, Indicates The attention weight of each dimension, Indicates The pooling features of dimensions, , is the weight parameter of the multilayer perceptron, is the learnable parameter, , is the bias term of the multilayer perceptron, is a learnable parameter, is an activation function, such as the ReLU activation function, It is a Sigmoid function that maps the output to between 0 and 1.

[0074] ;

[0075] In the formula, Indicates The focus features of the dimensions, Attention weight fusion ratio controls the fusion ratio of original features and attention weighted features, which is set based on experience or experiments.

[0076] (3.3) Also in fusion and weighting: weighted fusion of the focused features of all dimensions is performed to obtain the final command line features, the command line features are learned using the detection model, and the detection results are output, which are malicious command lines or normal command lines.

[0077] When weighted fusion is performed on the focused features of all dimensions, the focused features of each dimension are first upsampled to obtain the upsampled features; then weighted weights are assigned to the upsampled features to obtain weighted features; finally, the weighted features of all dimensions are summed using the summation function to output the command line features. The specific formula is as follows:

[0078] ;

[0079] In the formula, For command line features, is the number of pooling scales, that is, the number of generated pooling features, For the The weighted weight coefficient of the pooled features satisfies the weight sum to 1. This is an upsampling operation that upsamples the features to their original size.

[0080] In the regional focus attention mechanism, attention weights are used to extract key information from the pooled features through a multi-layer perceptron. The attention weights are applied to the original features through the parameters Control the feature fusion ratio. Integrate pooled features of different scales, provide multi-scale perspectives, enhance the model's comprehensive understanding of command lines, improve the accuracy of malicious command line recognition, and achieve efficient and accurate malicious command line detection.

[0081] Since the attention weights generated by pooled feature maps of different sizes may have multiple weights covering the same element when they correspond to the original feature map, a two-step strategy is adopted for fusion: (1) interpolation upsampling: the attention weights generated by all pooled feature maps are upsampled back to the size of the original feature map to ensure that each element has a corresponding weight value; (2) weighted summation fusion: for multiple attention weights at each position, weighted summation is used to fuse them so that the final feature map can integrate information expressions at different scales. The weight coefficients of each scale are learnable parameters, and the weight sum is 1.

[0082] This operation ensures that the most important parts of the feature graph are enhanced while weakening irrelevant or noise information, thereby providing a more accurate feature representation for the final detection model. The detection model refers to a classifier model used for malicious command line detection, such as a random forest classifier (Random Forest), a support vector machine (SVM), etc. After obtaining the final feature representation, it is input into the detection model to complete the malicious command line detection, and the output result is "malicious" (malicious command line) or "normal" (normal command line).

[0083] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0084] The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A malicious command line detection method based on multi-dimensional feature learning and feature focusing, characterized in that: The malicious command line detection method based on multi-dimensional feature learning and feature focusing includes: The CharBERT model is used to output high-dimensional features of the parameters of the command line to be detected; Based on the attention mask mechanism, basic features are obtained according to high-dimensional features, and the basic features are input into multiple dilated convolutions with dynamic dilation rates to obtain multiple branch features; For each branch feature, the branch feature is fused with the basic feature to obtain a preliminary fusion feature; The activation function is used to output dynamic weight coefficients according to the preliminary fusion features, and all preliminary fusion features are weighted fused based on the dynamic weight coefficients to obtain hierarchical progressive fusion features; Perform adaptive average pooling operation on the hierarchical progressive fusion features to generate pooling features of different dimensions; For the pooled features of each dimension, a multi-layer perceptron is used to extract the attention weight, and the attention weight is fused with the hierarchical progressive fusion features to obtain the focus features of each dimension; The focused features of all dimensions are weighted and fused to obtain the final command line features. The command line features are learned using the detection model, and the detection results are output, which are malicious command lines or normal command lines.

2. The malicious command line detection method based on multi-dimensional feature learning and feature focusing according to claim 1 is characterized in that: The dynamic expansion rate is determined as follows: ； in, Indicates The dynamic dilation rate of the dilated convolution, To obtain the maximum value, Indicates The learning parameters of the dilated convolution, Represents high-dimensional features, represents the Frobenius norm, Indicates a floor operation.

3. The malicious command line detection method based on multi-dimensional feature learning and feature focusing according to claim 1 is characterized in that: The attention mask mechanism is based on obtaining basic features according to high-dimensional features, including: Input high-dimensional features into the depth-separable convolution to obtain deep convolution features; Use activation functions to convert high-dimensional features into attention masks; The multiplication result of the deep convolution feature and the attention mask is taken as the basic feature.

4. The malicious command line detection method based on multi-dimensional feature learning and feature focusing according to claim 1 is characterized in that: The step of fusing the branch feature with the basic feature to obtain the preliminary fused feature includes: reading the fusion coefficient and applying it to the basic feature, and then adding the fusion coefficient to the branch feature as the preliminary fused feature.

5. The malicious command line detection method based on multi-dimensional feature learning and feature focusing according to claim 1 is characterized in that: The activation function is used to output a dynamic weight coefficient according to the preliminary fusion feature, including: The activation function is a softmax normalization function, and the dynamic weight coefficient is calculated as follows: ； In the formula, Indicates The dynamic weight coefficient corresponding to the initial fusion feature, represents the number of initial fusion features, Represents a natural constant An exponential function with base ; when or hour, represents the learning parameters of the basic features, Indicates the basic feature; otherwise Indicates The learning parameters of the initial fusion features, Indicates Initial fusion features, Indicates The learning parameters of the initial fusion features, Indicates A preliminary fusion feature.

6. The malicious command line detection method based on multi-dimensional feature learning and feature focusing according to claim 1 is characterized in that: The step of weighted fusion of all preliminary fusion features based on dynamic weight coefficients to obtain hierarchical progressive fusion features includes: ； In the formula, It is a hierarchical progressive fusion feature. represents the number of initial fusion features, Indicates The dynamic weight coefficient corresponding to the initial fusion feature, represents the residual scale parameter, Represents high-dimensional features; when hour, Indicates the basic feature; otherwise Indicates A preliminary fusion feature.

7. The malicious command line detection method based on multi-dimensional feature learning and feature focusing according to claim 1 is characterized in that: The attention weights are fused with the hierarchical progressive fusion features to obtain the focus features of each dimension, including: ； In the formula, Indicates The focus features of the dimensions, Attention weight fusion ratio, It is a hierarchical progressive fusion feature. Indicates The attention weights of the dimensions.

8. The malicious command line detection method based on multi-dimensional feature learning and feature focusing according to claim 1 is characterized in that: The weighted fusion of the focus features of all dimensions includes: Perform upsampling operation on the focused features of each dimension to obtain upsampled features; Assign weighted weights to the upsampled features to obtain weighted features; Use the sum function to sum the weighted features of all dimensions and output the command line features.

Images