A lightweight malware classification method based on multi-feature fusion

Abstract

The present invention discloses a lightweight malware classification method based on multi-feature fusion, comprising the following steps: extracting an opcode sequence and a static API call sequence from the malware's ASM file as original input, and performing deduplication and length truncation preprocessing on the sequence; extracting multi-scale behavioral features from the opcode sequence using an improved Res2Net module, and parsing the static API call sequence into a triple semantic chain of action-object-category, and mapping it into an embedding vector; concatenating the obtained opcode feature vector and the API semantic feature vector into a fused feature; adding position encoding to the fused feature and then inputting it into a multi-head self-attention mechanism, and enhancing the representation of key behavioral features through attention weighting; and inputting the attention output into a fully connected layer after dimensionality reduction by pooling to complete malware family classification. The present invention effectively improves classification accuracy and generalization ability.

Description

Technical Field

[0001] The present invention relates to the technical field of malware, and in particular to a lightweight malware classification method based on multi-feature fusion. Background Art

[0002] Malware classification methods based on deep learning are gaining popularity. Deep learning methods based on static analysis, in particular, have garnered widespread attention due to their ability to rapidly process large amounts of data without requiring sample execution. The core of static analysis involves extracting static features from executable files, such as binary structure, opcode sequences, static API call sequences, and string information, modeling them, and then utilizing deep neural networks for classification. Unlike dynamic analysis, static analysis methods are less dependent on the external environment and have the advantage of extracting features without requiring sample execution. They are less susceptible to circumvention by anti-sandbox mechanisms (such as virtual machine detection and behavioral delay triggering), and offer greater stability and repeatability. Furthermore, static analysis traverses all code paths in a program, enabling the discovery of potentially malicious logic that is difficult to access during dynamic execution, thereby improving the coverage of malicious features. However, while static analysis-based malware classification methods have achieved promising results in practice, they still have certain limitations.

[0003] First, static analysis has difficulty reproducing the actual behavior of malware at runtime and cannot capture hidden attack paths such as environmental perception, dynamic downloading, and conditional triggering, thus limiting its feature expression capabilities. Second, static features are usually presented as structured and high-dimensional data, and different features often have heterogeneity and redundancy. Especially when relying solely on a single static feature (such as an opcode sequence or a static API call sequence), it is easy to ignore key behavioral information due to insufficient feature coverage, thereby affecting the accuracy and generalization of classification. In addition, when static analysis schemes integrate multiple features, the parameter scale and computational complexity of the model increase significantly, making it difficult to achieve efficient operation in resource-constrained environments (such as real-time detection in the cloud or embedded devices), thereby limiting the real-time nature and application feasibility of malware classification. Summary of the Invention

[0004] Purpose of the invention: The purpose of the present invention is to provide a lightweight malware classification method based on multi-feature fusion to solve the problems of insufficient information coverage and high computing resource consumption in the existing technology in static malware classification.

[0005] Technical solution: The lightweight malware classification method based on multi-feature fusion described in the present invention includes the following steps:

[0006] (1) Extract the opcode sequence and static API call sequence from the malware’s ASM file as the original input, and perform preprocessing on the sequence by deduplication and length truncation;

[0007] (2) The improved Res2Net module is used to extract multi-scale behavioral features from the opcode sequence, and the static API call sequence is parsed into a semantic chain of action-object-category triples and mapped into an embedding vector;

[0008] (3) Concatenate the obtained opcode feature vector and API semantic feature vector into fusion features;

[0009] (4) After adding position encoding to the fused features, the fused features are fed into a multi-head self-attention mechanism to enhance the representation of key behavioral features through attention weighting;

[0010] (5) The attention output is input into the fully connected layer after pooling and dimensionality reduction to complete the malware family classification.

[0011] Furthermore, the preprocessing in step (1) includes: truncating the length of the opcode sequence to 150, truncating the length of the static API call sequence to 75; and removing consecutively repeated opcodes and API calls.

[0012] Furthermore, in step (2), the improved Res2Net module is as follows: embed the opcode into the vector Decomposed into s grouping features , ,…, , ; Except Each group outside Perform a one-dimensional convolution operation and combine it with the previous scale output Perform residual fusion, the formula is as follows:

[0013] ;

[0014] in, is the output feature of the previous scale; ;

[0015] Output multi-scale , ,…, Concatenate in channel dimension, and combine with original input after 1*1 convolution and batch normalization. Perform residual connection, the formula is as follows:

[0016] ;

[0017] in represents batch normalization, is a linear activation function.

[0018] Furthermore, in step (2), building the API semantic chain includes: parsing a single API call into a triple, representing the action, object, and category; building a unified dictionary containing all triples of words, assigning an index to each word and mapping it to a k-dimensional embedding vector; performing a one-dimensional convolution with a stride of 3 on the triple embedding vector of each API call to fuse the action, object, and category semantics. The formula is as follows:

[0019] ;

[0020] in, for sigmoid activation function, It is the final API semantic feature representation.

[0021] Furthermore, in step (4), the calculation formula of the position code is:

[0022] ;

[0023] in, Indicates the position of the token in the sequence, represents the dimension of the position encoding, is the dimension of the embedding vector.

[0024] Furthermore, the calculation of the multi-head self-attention mechanism in step (4) includes: generating a query matrix, a key matrix, and a value matrix through linear transformation of the fused features; after linear transformation, inputting the query matrix, the key matrix, and the value matrix into the corresponding feature heads to calculate the attention output in the subspace; and linearly mapping the multi-head outputs to the final features after splicing.

[0025] The present invention provides a lightweight malware classification method system based on multi-feature fusion, comprising:

[0026] Preprocessing module: used to extract opcode sequences and static API call sequences from the malware's ASM files as raw input, and perform preprocessing on the sequences by removing duplicates and cutting down their length;

[0027] Feature extraction module: This module extracts multi-scale behavioral features from opcode sequences using an improved Res2Net module. It also parses static API call sequences into semantic chains of action-object-category triples and maps them into embedding vectors.

[0028] Splicing module: used to splice the obtained opcode feature vector and API semantic feature vector into fusion features;

[0029] Weighted feature module: used to add position encoding to the fused features and then input them into the multi-head self-attention mechanism, thereby enhancing the representation of key behavioral features through attention weighting;

[0030] Classification module: This module is used to input the attention output into the fully connected layer after pooling and dimensionality reduction to complete malware family classification.

[0031] An electronic device according to the present invention includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods when executing the program.

[0032] The computer-readable storage medium of the present invention stores a computer program, which implements the steps of any one of the methods when executed by a processor.

[0033] Beneficial effects: Compared with the existing technology, the present invention has the following significant advantages: The present invention selects opcode sequences and static API call sequences as core features, and proposes a lightweight malware classification method that integrates underlying behaviors and functional semantics. This method realizes multi-scale behavioral feature extraction of opcode sequences through an improved Res2Net module, and at the same time constructs an API semantic chain module to model the semantic relationship of static API calls in a structured manner. The two types of features are combined to integrate the underlying operational behavior and high-level semantic information, thereby enhancing the model's ability to characterize the multi-dimensional behavioral patterns of malware. In order to further reduce the computational overhead of the model, the present invention designs a lightweight classifier architecture that combines position encoding and multi-head self-attention mechanisms to achieve dynamic correlation modeling between multi-source features while retaining the temporal information of the behavioral sequence; in conjunction with the subsequent fully connected layer, efficient malware classification is effectively completed. This architecture significantly reduces the parameter scale and computational cost while suppressing redundant information and highlighting key behavioral features, making it suitable for rapid deployment and real-time detection in resource-constrained scenarios. Experimental results show that this method is significantly superior to traditional single-feature methods on multiple malware datasets. While ensuring the lightweight of the model, it effectively improves the classification accuracy and generalization ability, verifying its feasibility and efficiency in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is the overall architecture diagram of the present invention;

[0035] Figure 2 This is a diagram of the improved Res2net processing process of the present invention;

[0036] Figure 3 It is a diagram of the construction process of the classifier module of the present invention. DETAILED DESCRIPTION

[0037] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0038] like Figure 1As shown, the embodiment of the present invention provides a lightweight malware classification method based on multi-feature fusion, which is divided into three parts: original information collection, operation code and API feature processing, and classifier module; and includes the following steps:

[0039] (1) Raw information collection: The main task of this part is to extract key feature data from the malware’s ASM file, including opcode sequences and static API call sequences, as raw sequence data.

[0040] (2) Operation code and API feature processing: First, we construct an API semantic chain through the extracted static API call sequence to capture the contextual information of the malware behavior. Then, we use the improved Res2Net module to perform multi-scale feature extraction on the operation code sequence to extract more discernible local and global behavior features. Finally, we concatenate the two types of feature vectors into a fused feature representation for subsequent classifier processing.

[0041] (3) Classifier module: This module is based on the strategy of multi-feature fusion. By introducing the multi-head self-attention mechanism and position encoding, it combines the fully connected layer to build a lightweight malware classification model.

[0042] Among them, Figure 2 As shown in Figure 1, the opcode multi-scale feature extraction process: In order to convert the opcode sequence into a vector representation that can be processed by the neural network, the length of the extracted opcode sequence is first normalized to 150, and 324 different opcodes are extracted from the normalized sequence to build an embedding vocabulary for them. Each opcode is mapped to -dimensional dense vector representation, let Indicates the opcodes dimensional embedding, the opcode sequence can be expressed as:

[0043] ;

[0044] in, is the length of the opcode sequence, is the dimension of the embedding vector. is a The sequence matrix of represents the dense feature representation of the opcode sequence.

[0045] Traditional CNNs often use fixed-size convolution kernels when processing sequence data. While this design is effective in extracting local features, it struggles to simultaneously capture both local details and global structural information. In malware opcode sequences, local fragments may reveal specific malicious behaviors, while longer call chains reflect overall behavioral patterns. Therefore, after obtaining the opcode embedding representation, a custom Res2Net module is used to capture multi-level features in the opcode sequence. Specifically, the two-dimensional convolution of Res2Net is changed to a one-dimensional convolution to accommodate the convolution operation on the sequence. For malware opcode sequences, this multi-scale fusion strategy can simultaneously capture fine-grained local behavioral patterns (such as specific opcode fragments) and more global structural patterns (such as complex call chains and execution flows).

[0046] like Figure 2 As shown, the opcode characteristics After preliminary channel decomposition, 4 grouping features are obtained , ,…, , Indicates the The characteristics of the scale, is the feature dimension corresponding to the scale. For each grouping feature , using one-dimensional convolution To extract local features, and accumulate and fuse them with the features of the previous scale, thus fusing the local behavior information of the opcode sequence. In addition, Res2Net expands the receptive field by stacking multiple layers of convolution, which can gradually capture global feature information. The formula is as follows:

[0047] ;

[0048] in, is the output feature of the previous scale. The first scale No convolution operation is required, i.e. , its main function is to retain the original feature information and avoid losing key information prematurely.

[0049] like Figure 2 As shown, the opcode features after convolution and residual fusion , ,…, The information of different scales is accumulated, concatenated in the channel dimension and mapped to the initial input dimension through 1×1 convolution to obtain the output features. In order to ensure efficient transmission of information flow, the fused features and input features Perform residual connections between them to obtain the final output features ,in represents batch normalization, is a linear activation function.

[0050] Compared to other multi-scale extraction methods (such as the Inception module, MobileNetV2, and dilated convolution), Res2Net's advantage lies in its partitioning of the input feature map into multiple subsets and independent convolution operations on each subset. This allows Res2Net to capture richer, more fine-grained multi-scale information without significantly increasing the number of parameters or computational complexity. Furthermore, the introduction of an additional residual connection mechanism allows for the gradual fusion of features at different scales, enhancing global information interaction within opcode sequences and effectively capturing the diverse behavioral patterns of malware.

[0051] Table 1 shows the processing method for static API call sequences. To more fully mine the semantic information in static API call sequences, this method expands a single API into an API triple, thereby constructing the static API call sequence into an API semantic chain. Unlike methods that only input API calls as single tokens into the model, this method decomposes and semantically expands the API name, converting it into an action-object-class triple. This captures the underlying behavioral logic behind the API call at the semantic level.

[0052] Table 1 Triplet construction examples

[0053] ;

[0054] After completing the construction of the semantic chain, the above triples are mapped into vector representations that can be processed by the model. The three types of semantic units, action, object, and category, are unified and integrated into the same dictionary. A total of 2,499 unique word units are extracted (covering actions, objects, and three types of category labels), and each word unit is assigned a unique index value, providing a common encoding basis for subsequent feature representation and learning.

[0055] Embedding Mapping: Let the size of the dictionary be , each word is mapped to -dimensional embedding vector space, constructing the embedding matrix ,in Indicates the first The embedding vector of the word. API call triples ,in , , are the indices of the API call in the action, object, and class dictionaries, respectively, and their vector representations are:

[0056] ;

[0057] The three vectors are concatenated to obtain the final embedding representation of the API call, i.e., the k-dimensional vector :

[0058] ;

[0059] By calling a sequence of APIs of length m The above mapping can be converted into a set of triple embedding vector sequences, as follows:

[0060] ;

[0061] Local semantic feature extraction: To further extract the triple vector sequence In order to further explore local semantic associations and potential sequence patterns, the present invention uses one-dimensional convolution (Conv1D) to extract local features of the sequence and sets the step size to 3, that is, each convolution operation covers a complete triple embedding, that is, feature aggregation is performed on the three semantic units (Action, Object, Class) that constitute the triple, and semantic information is extracted in a fine-grained manner.

[0062] Specifically, for a single API call the corresponding triple vector , let the convolution kernel parameters be and bias terms By setting the receptive field of the convolution kernel to cover the entire triple (i.e., a semantic unit dimension of size 3), the action, object, and class embeddings of a single API call can be fused. The convolution operation formula is as follows:

[0063] ;

[0064] in, for sigmoid activation function, is the final API semantic feature representation. Through the above steps, the original triple embedding is compressed into a high-level feature representation describing a single API call, thereby converting the lengthy and structured API call sequence into a low-dimensional feature vector containing rich semantic information.

[0065] On this basis, combined with the multi-scale behavioral information and global structural characteristics of the opcode sequence, the model can achieve efficient identification and classification of malware samples under a lightweight structure.

[0066] like Figure 3This paper demonstrates the construction process of a lightweight classifier. In the previous experimental steps, the present invention extracts the malware's underlying behavioral features and functional semantics. Opcode sequence features capture local instruction patterns and global execution flows, while API call sequences provide semantic information and contextual dependencies at the function call level. These two types of features are concatenated to create a fused feature vector, which preserves the underlying behavioral details while enhancing the overall semantic representation.

[0067] Because both the opcode sequence and the triple semantic chain sequence maintain their original order, the sequence vectors after this feature processing can fully reflect the high-level characteristics of the malware's behavior. Therefore, these fused feature vectors can represent high-level features of certain malware behaviors, with each token corresponding to a key behavior. While different types of malware may perform similar underlying operations during execution, the differences in their static API call sequences can help the model identify their unique attack patterns and targets.

[0068] On this basis, to highlight key features and suppress irrelevant or redundant features, this paper introduces a multi-head self-attention mechanism (MHSA) to further enhance the expressive power of fused features. MHSA independently calculates attention weights across multiple attention heads, enabling the model to concurrently learn association patterns between various features in different subspaces. This means the model can simultaneously focus on different behavioral features (such as opcodes and API calls) and effectively model the relationships between them, thereby improving classification and recognition performance.

[0069] However, the self-attention mechanism itself lacks the ability to perceive the order of the input sequence. Its output weights rely solely on the similarity between query keys, ignoring the specific position of elements in the sequence. However, malware behavior is often highly temporal. For example, performing an operation followed by an API call often represents a specific attack behavior. Relying solely on similarity to calculate weights may cause the model to ignore the temporal information in the sequence, thereby affecting the capture of malicious behavior patterns. To this end, positional encoding is introduced before the fused features are input into the multi-head self-attention (MHSA) to preserve the temporal information and contextual dependencies of the sequence. Experimental results show that inputting the position-encoded fusion vector into the MHSA can slightly improve the classification accuracy and robustness of the model without any additional computational burden, demonstrating the effectiveness of positional encoding.

[0070] Specifically, in order to effectively capture the timing information in opcode sequences and static API call sequences and improve the model's ability to understand the association between different features, this paper uses position encoding to generate fixed position information and embeds it into the fusion vector representation of each token, thereby preserving the position information of each key token in the sequence and ensuring that the timing relationship and behavior pattern in the sequence are effectively modeled. The position encoding formula is as follows:

[0071] ;

[0072] in, Indicates the position of the token in the sequence, represents the dimension of the position encoding, is the dimension of the embedding vector.

[0073] Furthermore, the fused feature vector after position encoding is introduced into the multi-head self-attention mechanism to achieve dynamic modeling and weighted enhancement of features between different positions in the sequence. MHSA calculates attention weights through multiple parallel self-attention heads and simultaneously learns multiple feature association patterns in different subspaces, enabling the model to simultaneously focus on local behavior patterns in opcode sequences and semantic dependencies across functions in static API call sequences, thereby capturing more complex malicious behavior features. Figure 3 As shown, using fusion features Generate query (Q), key (K) and value (V), and project them into different attention subspaces through multiple linear mapping matrices. The formula is as follows: ;

[0074] in, is the fused feature vector, , , is the corresponding learnable weight matrix. After linear transformation, the matrices Q, K, and V are input into the corresponding feature head to calculate the attention output in the subspace. The formula is as follows:

[0075] ;

[0076] Then the outputs of multiple attention heads are concatenated by dimension and then processed through a linear mapping The mapping converges into the final enhanced fusion feature:

[0077] ;

[0078] Finally, the enhanced fused features output by multi-head self-attention are reduced in dimension through a pooling layer and fed into a fully connected neural network to construct a malware classification model. Combining positional encoding with multi-head self-attention improves the model's ability to model multi-dimensional features such as temporal relationships, behavioral patterns, and dependencies in opcode sequences and static API call sequences, thereby enhancing the model's classification accuracy, robustness, and generalization capabilities for complex malware samples.

Claims

1. A lightweight malware classification method based on multi-feature fusion, characterized by: The following steps are involved: (1) Extract the opcode sequence and static API call sequence from the malware’s ASM file as the original input, and perform preprocessing on the sequence by deduplication and length truncation; (2) The improved Res2Net module is used to extract multi-scale behavioral features of the opcode sequence, and the static API call sequence is parsed into a semantic chain of action-object-category triples and mapped into an embedding vector; The improved Res2Net module is as follows: The opcode is embedded in the vector Decomposed into s grouping features , ,…, , ; Except Each group outside Perform a one-dimensional convolution operation and combine it with the previous scale output Perform residual fusion, the formula is as follows: ; in, is the output feature of the previous scale; ; Output multi-scale , ,…, Concatenate in channel dimension, and combine with original input after 1*1 convolution and batch normalization. Perform residual connection, the formula is as follows: ； in represents batch normalization, is a linear activation function; Building an API semantic chain includes: parsing a single API call into a triple vector , representing actions, objects and categories; let the convolution kernel parameters be and bias terms , build a unified dictionary containing all triplet tokens, assign an index to each token and map it to a k-dimensional embedding vector; perform a one-dimensional convolution with a stride of 3 on the triplet embedding vector of each API call to fuse action, object, and category semantics. The formula is as follows: ； in, for sigmoid activation function, It is the final API semantic feature representation; (3) Concatenate the obtained opcode feature vector and API semantic feature vector into fusion features; (4) After adding position encoding to the fused features, the fused features are fed into a multi-head self-attention mechanism to enhance the representation of key behavioral features through attention weighting; (5) The attention output is input into the fully connected layer after pooling and dimensionality reduction to complete the malware family classification.

2. A lightweight malware classification method based on multi-feature fusion according to claim 1, characterized in that: The preprocessing in step (1) includes: truncating the opcode sequence length to 150 and the static API call sequence length to 75; and removing consecutive repeated opcodes and API calls.

3. The lightweight malware classification method based on multi-feature fusion according to claim 1 is characterized in that: In step (4), the calculation formula of the position code is: ； in, Indicates the position of the token in the sequence, represents the dimension of the position encoding, is the dimension of the embedding vector.

4. The lightweight malware classification method based on multi-feature fusion according to claim 1 is characterized in that: The calculation of the multi-head self-attention mechanism in step (4) includes: generating a query matrix, a key matrix, and a value matrix through linear transformation of the fused features; after linear transformation, inputting the query matrix, the key matrix, and the value matrix into the corresponding feature head to calculate the attention output in the subspace; and linearly mapping the multi-head outputs to the final features after splicing.

5. A classification system for the lightweight malware classification method based on multi-feature fusion according to claim 1, characterized in that: include: Preprocessing module: used to extract opcode sequences and static API call sequences from the malware's ASM files as raw input, and perform preprocessing on the sequences by removing duplicates and cutting down their length; Feature extraction module: This module extracts multi-scale behavioral features from opcode sequences using an improved Res2Net module. It also parses static API call sequences into semantic chains of action-object-category triples and maps them into embedding vectors. Splicing module: used to splice the obtained opcode feature vector and API semantic feature vector into fusion features; Weighted feature module: used to add position encoding to the fused features and then input them into the multi-head self-attention mechanism, thereby enhancing the representation of key behavioral features through attention weighting; Classification module: This module is used to input the attention output into the fully connected layer after pooling and dimensionality reduction to complete malware family classification.

6. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the program, the steps of the method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium, characterized in that A computer program is stored, and when the program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images