Neural network robustness authentication method based on global hash
By adopting the robustness authentication method of neural network based on whole domain hash in malware detection technology, the problem of insufficient robustness in the existing technology is solved, effective detection and defense against samples is achieved, and robustness guarantees are provided with theoretical support.
Patent Information
- Application Number
- CN202510014066.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-01-06
- Publication Date
- 2025-05-02
AI Technical Summary
Existing malware detection technologies are not robust enough when facing adversarial sample attacks, and existing authentication methods have limitations in model independence and discrete data mathematical.
The robustness authentication method of neural network based on whole domain hash is adopted, and the software samples are extracted through feature extraction algorithms, and the whole domain hash function is randomly selected to build an input transformation layer, which is integrated into the neural network model for training and prediction, and the robust boundary of the neural network model is calculated.
It improves the robustness of neural networks in the face of malware against samples and provides theoretical support to ensure that any perturbation within the robust radius cannot successfully attack the neural network model.
Smart Images
Figure CN119918050A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the fields of anti-machine learning and cyberspace security, and in particular to the field of malicious program detection technology. Specifically, it relates to a neural network robustness authentication method based on global hashing. Background Art
[0002] Currently, malware detection applications increasingly rely on machine learning techniques. Although machine learning has made significant progress in security-related tasks, such as malware detection based on deep neural networks. However, machine learning models are very sensitive to small perturbations, making adversarial sample attacks possible. Further research shows that adversarial sample attacks also exist in the field of malware detection. In other words, adversarial sample attacks allow attackers to mislead malware detectors by carefully designing small perturbations, that is, flipping correct predictions.
[0003] In order to cope with this situation, more and more methods for enhancing the robustness of neural networks have been proposed. Relevant researchers have strengthened the model's ability to resist sample attacks by adjusting input, training process, and network architecture. Although the model's robustness has been enhanced empirically, it has always been defeated by stronger attacks in subsequent studies. The reason is that the design of defenses often targets the vulnerabilities of some attacks and it is impossible to search for the optimal adversarial samples for active defense. In other words, although the defense designed empirically can defend against some attacks, it may be defeated by stronger attack methods. Especially in adversarial environments, a dynamic environment is often formed between attack and defense.
[0004] In recent years, provable defense mechanisms have attracted much attention. Under certain threat models, they can theoretically analyze the robustness of the model and defend against any attack under the threat. However, such defense technologies are mainly concentrated in research fields such as image classification and need to be further expanded to malware detection tasks. Existing authentication methods have limitations in terms of model independence and discrete data mathematics. These limitations motivate us to propose a new neural network robustness authentication method, which is applicable to the field of malware detection using discrete data as neural network input. Summary of the invention
[0005] In view of this, the present invention proposes a neural network robustness authentication method based on global hashing to solve the problems existing in the above-mentioned prior art.
[0006] To achieve the above object, the present invention proposes a neural network robustness authentication method based on global hashing, which is characterized by comprising:
[0007] Using a feature extraction algorithm to extract discrete features from software samples, and preprocessing the discrete features;
[0008] Randomly selecting a global hash function to construct an input transformation layer, and integrating the input transformation layer into a neural network model;
[0009] Training the neural network model based on global hash transformation;
[0010] Malware prediction based on the trained neural network model;
[0011] A robust bound for the neural network model is calculated.
[0012] Furthermore, in the process of extracting discrete features from software samples using a feature extraction algorithm, the most important information for the task is identified and selected from the software samples for discrete feature extraction, and the discrete features include categorical features or sequence features.
[0013] Furthermore, in the process of preprocessing the discrete features, the sequence features are segmented using a language segmentation method based on statistics to construct a segmentation set.
[0014] Furthermore, the process of randomly selecting a global hash function to construct an input transformation layer includes:
[0015] Step 1. Design the maximum subscript value of the global hash function and define the function space;
[0016] Step 2. The global hash function selects the corresponding feature in the feature set of a single malware sample as the transformation value according to the subscript; the hash function is uniformly randomly sampled K times using binomial distribution to obtain a transformation value set;
[0017] Step 3. Mapping the transformed values in the transformed value set to the input space X as the input of the neural network;
[0018] Step 4. Repeat steps 2-3 to get the predicted label expectation.
[0019] Furthermore, the predicted label is expected to be as follows:
[0020]
[0021] Where B = Bi (K, p c ) is constructed from the binomial distribution Bi and p c is the Jaccard distance between any two malware samples x,x'∈X.
[0022] Furthermore, the training process of the neural network model based on the global hash transformation includes:
[0023] After the input of the training samples is transformed based on the global hash function, the transformed results are used as the input of the neural network, and the rest of the training process is consistent with the original neural network training process.
[0024] Furthermore, the process of malware prediction based on the trained neural network model includes:
[0025] Input a test sample, perform input transformation on the test sample based on a global hash function, and use the transformation result as an input of the neural network;
[0026] The sampling and input transformation process of the global hash function is repeated to obtain the predicted label expectation, and the predicted label expectation is used as the final predicted label.
[0027] Furthermore, the process of calculating the robust boundary of the neural network model includes:
[0028] Calculate the region partition of the input space X by the global hash function;
[0029] Calculate the probability value of the transformed value based on the global hash function falling into each area;
[0030] Calculate the empirical expectation of the expected label predicted by the neural network model, and calculate the lower and upper bounds of the predicted label through empirical hypothesis method;
[0031] Calculate the difference in prediction probability between the predicted label and the secondary predicted label; the secondary predicted label refers to the label corresponding to the second highest confidence value output by the neural network during prediction;
[0032] The Jaccard distance between malware samples is set, and a robust radius value is searched by using a binary search method to determine whether the robust radius value satisfies the predicted probability difference value of 0.
[0033] Furthermore, the method for calculating the probability value of the transformation value based on the global hash function falling into each region is as follows:
[0034]
[0035] Among them, σ c (x') represents the transformed value obtained by global hash transformation, k j =i-1 and k j is an integer, pc is the Jaccard distance between malware samples, K represents the number of transformation values, R i (i=1,…,K) represents the i-th partition area.
[0036] Compared with the prior art, the present invention has the following beneficial effects:
[0037] The present invention obtains a neural network model with verifiable robustness for discrete data by constructing an input transformation based on a global hash function. First, input a software sample, extract discrete features of the sample through a feature extraction algorithm, and perform feature preprocessing; based on the features, randomly select a global hash function to construct an input transformation layer, and integrate the transformation layer into the neural network model; the neural network model integrated into the transformation layer requires a slight change in the training process to achieve neural network model training based on global hash transformation; neural network model prediction based on global hash transformation; neural network robust boundary calculation for malware. This method not only improves the robustness of the neural network in the face of malware adversarial samples, but also has theoretical support for this robustness. Within the robust radius, any disturbance cannot successfully attack the neural network model. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the following detailed description of the preferred embodiment.The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting the invention.
[0039] Figure 1 The figure is a schematic diagram of the overall process of the method described in the present invention. DETAILED DESCRIPTION
[0040] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to be able to fully convey the scope of the present disclosure to those skilled in the art. It should be noted that, in the absence of conflict, the embodiments of the present invention and the features described in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.
[0041] This embodiment proposes a neural network robustness authentication method based on global hashing, such as Figure 1 As shown, including:
[0042] Step (S1). Identify and select the most important information for the task from the software sample for discrete feature extraction. This embodiment uses Android software and uses Androguard to unpack Android packages (Android Pakcages, referred to as APK). Unpacking APK by Androguard uses the following types of static APK features:
[0043] (i) The permissions requested by the application (such as android.permission.SEND_SMS).
[0044] (ii) Indicates that the application uses hardware features (such as android.hardware.wifi).
[0045] (iii) The names of application components, including activities, services, broadcast receivers, and providers.
[0046] (iv) Intent filters used to communicate with each other.
[0047] (v) The permissions actually used to call the application programming interface (API). Suppose a total of M classification features are obtained, constituting the feature set x∈X.
[0048] No preprocessing is required for categorical features.
[0049] Step (S2): Input the preprocessed features x∈X of a software sample, randomly select the global hash function, construct the input transformation layer, and fuse the neural network model. The steps are as follows:
[0050] A. Design the maximum subscript value of the global hash function to be 2 31 -1, define the function space as H c ;
[0051] B. Uniformly randomly sample the hash function h according to the binomial distribution Bi(1,K / M) c ∈H c , returns the transformed value h c (x). The global hash function selects the corresponding feature in the feature set of a single malware sample as the transformation value according to the subscript, where K is set according to the next step and M is the number of features in the previous step.
[0052] C. Repeat step 2.B for K=3 times to get Where || is the concatenation code, and K = 3 hash codes are used to maintain malware detection accuracy;
[0053] D. For categorical features, h c (x) is in space X, no such operation is required;
[0054] E. The processed K transformed values can be mapped to space X as a neural network Input from X→Y, where Y is the output label space {0,1};
[0055] F. Repeat steps 2.B-2.E to construct the expectation of the predicted labels:
[0056]
[0057] Where B = Bi (3,3 / M) is constructed from the binomial distribution Bi and pc is the Jaccard distance between any two malware samples x,x'∈X:
[0058]
[0059] Step (S3). The neural network model training based on global hash transformation is as follows:
[0060] A. Input training sample set This embodiment uses two data sets: the Drebin data set and the Androzoo data set. The Drebin data set contains 5479 malicious APKs and 57136 benign APKs. The Androzoo data set contains a total of 21249 malicious APKs and 21008 benign APKs. Furthermore, 60% of the data in the two data sets are used as training sets, 20% of the data are used as validation sets, and the remaining 20% are used as test sets. Through steps 2.A to 2.E, the input x is hashed based on the global hash function. i (i=1,…,N) performs input transformation and uses the transformed result as the neural network input.
[0061] B. The rest of the training process is the same as the original neural network The X→Y training process remains consistent and does not need to be changed. This embodiment uses the Adam optimization method to train the neural network model based on hash transformation, where the batch size is 128, the number of iterations is 300, and the learning rate is 0.001.
[0062] Step (S4). Prediction of the neural network model based on global hash transformation, the steps are as follows:
[0063] A. Input test sample x∈X, and perform steps 2.A to 2.E on the input x based on the global hash function. i (i=1,…,N) performs input transformation and uses the transformed result as the neural network input.
[0064] B. Repeat step 2.F L = 1000 times to sample the global hash function and perform input transformation to obtain the expected predicted label of the neural network, which is the final predicted label.
[0065] Step (S5). Neural network robust boundary calculation for malware, the process is as follows:
[0066] A. Calculate the region partition of the input space X by the global hash function. The projection region composed of K = 3 transformation values is: For i = 1, ..., K, where ||·|| 0 Yes 0 norm and γ is the maximum distance between any two samples;
[0067] B. Calculate the transformation σ based on the global hash function c (x) falls into each region R i (i=1,…,K). When i=1, Pr(σ c (x)∈R i )=1; when i=2,...,K, Pr(σ c (x)∈R i )=0;
[0068] C. Calculation of σ c The corresponding probability of (x') is: where k is a positive integer j =i-1, p c Set it in step G below;
[0069] D. Calculate the empirical expectation of equation (1), sample L = 10000 K transformations, and calculate the predicted label based on the empirical assumptions The lower bound (Abbreviated as ) and upper bound (Abbreviated as ),in is the predicted label;
[0070] F. Calculate the predicted label and the sub-predicted label The difference in predicted probability is:
[0071]
[0072] The secondary prediction label refers to the label corresponding to the second highest confidence value output by the neural network during prediction.
[0073] G. Calculate the robust radius and set p c =1.0-C Jaccard (x, x'), search for the robust radius value γ by binary search * , which just satisfies
[0074] This embodiment reports the effectiveness on the test set through the standard indicators false positive rate (FNR), false positive rate (FPR), F1 score, accuracy (Acc for short, i.e. the proportion of correctly predicted examples in the test data set) and balanced accuracy (bAcc). Table 1 includes the detection effect (in %) of the detector of this method on the Drebin and Androzoo data sets. On the Drebin data set, this method achieves an F1 score of 89.15% when K=3, while an F1 score of 85.09% is achieved based on the traditional random method. This shows that this method is significantly better than the traditional random method. On the Androzoo data set, this method achieves an F1 score of 91.42% when K=3, but an F1 score of 92.39% is achieved based on the traditional random method. This shows that this method can achieve the corresponding detection effect. It is worth noting that the Drebin data set is more challenging due to the serious imbalance problem of malicious and benign data. Therefore, this embodiment shows that this method has better robustness in the face of data balance problems.
[0075] Table 1
[0076]
[0077] Table 2
[0078]
[0079] Table 2 (unit: Jaccard distance) reports the neural network robustness radius obtained by this method and the traditional random method. Based on the mean and median of the radius, it is observed that when K = 3, this method achieves a higher average (≥ 0.004) and median (≥ 0.008) of the certified radius than the traditional method in terms of Jaccard distance (Equation (2)) on the Drebin dataset. On the one hand, the global hash function acts directly on discrete features and is not affected by data sparsity, but the traditional random method selects features from a 10,000-dimensional feature representation and is susceptible to sparsity. On the Androzoo dataset, the method of the present invention also achieves a better average and maximum certified radius than the traditional random method when K = 3.
[0080] Unless otherwise specified, all technical and scientific terms used herein have the same meanings as commonly understood by those skilled in the art to which the invention pertains. Although only preferred methods and materials are described herein, any methods and materials similar or equivalent to those described herein may also be used in the practice or testing of the invention. All documents mentioned in this specification are incorporated by reference to disclose and describe the methods and / or materials associated with the documents. In the event of a conflict with any incorporated document, the contents of this specification shall prevail.
[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.
Claims
1. A neural network robustness authentication method based on global hashing, characterized in that: include: Using a feature extraction algorithm to extract discrete features from software samples, and preprocessing the discrete features; Randomly selecting a global hash function to construct an input transformation layer, and integrating the input transformation layer into a neural network model; Training the neural network model based on global hash transformation; Malware prediction based on the trained neural network model; A robust bound for the neural network model is calculated.
2. According to claim 1, the neural network robustness authentication method based on global hashing is characterized in that: In the process of extracting discrete features from software samples using feature extraction algorithms, the most important information for the task is identified and selected from the software samples for discrete feature extraction, and the discrete features include categorical features or sequence features.
3. The neural network robustness authentication method based on global hashing according to claim 2 is characterized in that: In the process of preprocessing the discrete features, the sequence features are segmented using a statistically based language segmentation method to construct a segmentation set.
4. The neural network robustness authentication method based on global hashing according to claim 1 is characterized in that: The process of randomly selecting a global hash function to construct the input transformation layer includes: Step 1. Design the maximum subscript value of the global hash function and define the function space; Step 2. The global hash function selects the corresponding feature in the feature set of a single malware sample as the transformation value according to the subscript; the hash function is uniformly randomly sampled K times using binomial distribution to obtain a transformation value set; Step 3. Mapping the transformed values in the transformed value set to the input space X as the input of the neural network; Step 4. Repeat steps 2-3 to get the predicted label expectation.
5. The neural network robustness authentication method based on global hashing according to claim 4 is characterized in that: The predicted labels are expected to be as follows: Where B = Bi (K, p c ) is constructed from the binomial distribution Bi and p c is the Jaccard distance between any two malware samples x,x'∈X.
6. The neural network robustness authentication method based on global hashing according to claim 1 is characterized in that: The training process of the neural network model based on global hash transformation includes: After the input of the training samples is transformed based on the global hash function, the transformed results are used as the input of the neural network, and the rest of the training process is consistent with the original neural network training process.
7. The neural network robustness authentication method based on global hashing according to claim 1 is characterized in that: The process of malware prediction based on the trained neural network model includes: Input a test sample, perform input transformation on the test sample based on a global hash function, and use the transformation result as an input of the neural network; The sampling and input transformation process of the global hash function is repeated to obtain the predicted label expectation, and the predicted label expectation is used as the final predicted label.
8. The neural network robustness authentication method based on global hashing according to claim 1 is characterized in that: The process of calculating the robust margin of the neural network model includes: Calculate the region partition of the input space X by the global hash function; Calculate the probability value of the transformed value based on the global hash function falling into each area; Calculate the empirical expectation of the expected label predicted by the neural network model, and calculate the lower and upper bounds of the predicted label through empirical hypothesis method; Calculate the difference in prediction probability between the predicted label and the secondary predicted label; the secondary predicted label refers to the label corresponding to the second highest confidence value output by the neural network during prediction; The Jaccard distance between malware samples is set, and a robust radius value is searched by using a binary search method to determine whether the robust radius value satisfies the predicted probability difference value of 0.
9. The neural network robustness authentication method based on global hashing according to claim 8 is characterized in that: The method for calculating the probability value of the transformed value based on the global hash function falling into each area is as follows: Among them, σ c (x') represents the transformed value obtained by global hash transformation, k j =i-1 and k j is an integer, pc is the Jaccard distance between malware samples, K represents the number of transformation values, R i (i=1,…,K) represents the i-th partition area.