Malware family classification method

Abstract

The present invention provides a malware family classification method, comprising: obtaining RGB images based on a bytecode file and a configuration file respectively; performing feature extraction on the RGB images based on a designed encoder to obtain discriminative feature vectors; generating sample pairs for each RGB image through data enhancement, optimizing the embedding space using a supervised contrastive learning method so that feature vectors of similar samples are close to each other and feature vectors of heterogeneous samples are far away from each other, thereby training the encoder; using the encoder obtained by the supervised contrastive learning training to extract feature vectors of samples of each category, dividing the similar feature vectors into multiple subclusters based on hierarchical clustering and silhouette coefficient, and performing weighted fusion to generate category prototypes, and completing malware family classification based on the distance between the query sample and each category prototype, thereby significantly improving the generalization and accuracy of malware family classification in small sample scenarios.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a malware family classification method. Background Art

[0002] With the widespread use of smartphones, malware attacks are increasing, posing a significant threat to personal privacy and corporate financial security. Therefore, how to effectively address this growing threat has become a pressing issue in the field of cybersecurity.

[0003] Malware family classification is an efficient analytical tool that groups malware samples with similar characteristics and behavior patterns into the same category, helping security personnel quickly identify new variants, track their propagation paths, and develop targeted defense strategies. Malware family classification is crucial because malware variants often employ various disguises, such as code obfuscation and packing, making traditional detection methods ineffective. Malware family classification not only speeds up the identification of new variants but also helps security personnel predict and analyze malware evolution paths, providing more accurate threat intelligence and enhancing network security protection capabilities.

[0004] Existing malware family classification methods typically rely on large numbers of labeled samples, which presents two significant challenges in practice: First, malware families are frequently updated, making existing models difficult to adapt to new families; second, new family samples are relatively scarce, failing to meet the large data requirements of traditional models. To overcome these challenges, few-shot learning (FSL) has become a research hotspot, aiming to maintain good generalization capabilities using minimal sample data. While few-shot learning has achieved excellent results in tasks such as image classification, traditional few-shot methods often struggle to effectively generate robust family prototypes for malware family classification due to the multimodal nature of malware families and the significant variation among samples within a family, limiting the model's generalization capabilities. Summary of the Invention

[0005] In response to the problems existing in the prior art, the present invention provides a malware family classification method, which at least partially solves the problem of insufficient generalization ability of the model under small sample conditions existing in the prior art.

[0006] The present disclosure provides a malware family classification method, including:

[0007] Obtain the bytecode file and configuration file of the application to be analyzed, and obtain RGB images based on the bytecode file and configuration file respectively;

[0008] Performing feature extraction on the RGB image based on the designed encoder to obtain a discriminative feature vector;

[0009] For each RGB image, sample pairs are generated through data augmentation, and the embedding space is optimized using a supervised contrastive learning method so that feature vectors of similar samples are close to each other and feature vectors of heterogeneous samples are far away from each other, thereby training the encoder;

[0010] The encoder trained by supervised contrastive learning is used to extract feature vectors of samples of each category. Based on hierarchical clustering and silhouette coefficient, similar feature vectors are divided into multiple subclusters and weighted fusion is performed to generate category prototypes. Malware family classification is completed based on the distance between the query sample and each category prototype.

[0011] Optionally, obtaining a bytecode file and a configuration file of the application to be analyzed, and obtaining RGB images based on the bytecode file and the configuration file, respectively, includes:

[0012] Map the bytecode file stream to the R channel of the RGB image;

[0013] Map the profile to the G channel of the RGB image;

[0014] The local entropy features are calculated based on the byte stream of the bytecode file, and the obtained local entropy features are mapped to the B channel of the RGB image.

[0015] Optionally, obtaining a bytecode file and a configuration file of the application to be analyzed, and obtaining RGB images based on the bytecode file and the configuration file, respectively, includes:

[0016] Reconstruct the R channel into a two-dimensional matrix. When reconstructing the R channel into a two-dimensional matrix, the matrix width is dynamically selected according to the byte stream length, and after zero padding, the matrix is ​​scaled to the set pixel through bilinear interpolation, and correction technology is used to enhance the image contrast and brightness;

[0017] Reconstruct the G channel into a two-dimensional matrix. When reconstructing the G channel into a two-dimensional matrix, a fixed width is used, zero-filled, and then scaled to the set pixels through bilinear interpolation. Correction technology is used to enhance the image contrast and brightness.

[0018] The B channel is reconstructed into a two-dimensional matrix. When the B channel is reconstructed into a two-dimensional matrix, local entropy features are calculated and matrix reconstruction is performed based on the byte stream of the bytecode file at a fixed width, and then it is directly scaled to the set pixels through bilinear interpolation.

[0019] Optionally, dynamically selecting the matrix width according to the byte stream length includes: ,

[0020] in, is the image width, The length of the byte stream.

[0021] Optionally, reconstructing the B channel into a two-dimensional matrix includes:

[0022] The sliding window method is used to extract byte-level local entropy features. The byte stream is slidingly calculated and the Shannon entropy of each window is calculated to obtain a one-dimensional entropy sequence.

[0023] The one-dimensional entropy sequence is reconstructed into a two-dimensional matrix with a fixed width after zero padding, and the entropy value is normalized.

[0024] Optionally, the encoder includes:

[0025] DenseNet-121 backbone network, CBAM attention mechanism module and feature compression projection layer;

[0026] The DenseNet-121 backbone network extracts multi-layer features through four dense blocks;

[0027] The CBAM attention mechanism module generates attention maps from the channel and spatial dimensions through the channel attention module and the spatial attention module respectively;

[0028] The feature maps extracted by the DenseNet-121 backbone network and the CBAM attention mechanism module are combined and mapped to a low-dimensional embedding space through a feature compression projection layer and L2 normalized.

[0029] Optionally, generating sample pairs for each RGB image through data augmentation and optimizing the embedding space using a supervised contrastive learning method so that feature vectors of similar samples are close to each other and feature vectors of heterogeneous samples are far away from each other may include:

[0030] After inputting the sample pair into the encoder, the embedded representation is obtained;

[0031] Each embedded feature in the embedded representation is regarded as an anchor point, and the samples with the same label as the anchor point are found as the positive sample set through the supervised contrast loss function, and the samples of different categories are regarded as the negative sample set.

[0032] Optionally, the encoder trained by supervised contrastive learning is used to extract feature vectors of samples of each category, and similar feature vectors are divided into multiple subclusters based on hierarchical clustering and silhouette coefficient, and weighted fusion is performed to generate category prototypes. Malware family classification is completed based on the distance between the query sample and each category prototype, including:

[0033] The feature vectors of samples of each category extracted by the encoder obtained through supervised contrastive learning training are directly clustered using the hierarchical clustering method; during the clustering process, the results of different clustering levels are quantitatively evaluated using the silhouette coefficient to measure the intra-class tightness and inter-class separation of the clustering results; based on the evaluation results, the scheme with the best clustering effect is selected from multiple candidate clustering schemes, and the selected clustering results are used for subsequent prototype generation and malware family classification.

[0034] Optionally, the quantitative evaluation of the results of different clustering levels using the silhouette coefficient during the clustering process includes:

[0035] Starting with each sample as an independent cluster, calculate the distance between clusters, gradually merge the cluster pairs with the smallest distance, and build a complete cluster tree;

[0036] The tree structure is cut at different pruning levels to obtain different numbers of cluster division results, and the silhouette coefficient is used to evaluate the clustering quality of each division scheme;

[0037] The silhouette coefficient is based on the average distance between the jth sample and other samples in its cluster. , the average distance between the jth sample and all samples in the nearest other clusters And the total number of supporting samples in the current category is calculated;

[0038] According to the clustering quality evaluation results, the best clustering scheme is selected from multiple candidate clustering schemes. The clustering result with the highest silhouette coefficient is used as the final clustering result, and all cluster centers obtained by the clustering are expressed as: ,

[0039] in, represents the center vector of the jth subcluster in family i, is the final number of clusters of this class, the set Characterizes the potential substructure distribution presented by family i in the support set.

[0040] Optionally, after obtaining all cluster center representations, the following is also included:

[0041] In the inference phase, for any query sample , first calculate the query sample The distance between each subcluster center , and then use the softmax function to calculate the query sample of each cluster center The response weight , and use the weighted fusion dynamic prototype as the query sample The representation under the i-th category will eventually convert the query sample Assigned to the category with the smallest distance to its dynamic prototype.

[0042] The malware family classification method provided by the present invention constructs RGB image input and combines the supervised contrastive learning (SupCon) strategy to optimize the feature embedding space, explicitly enhances intra-class consistency and inter-class discrimination, and improves the generalization ability and classification accuracy in small-sample malware family classification tasks, thereby achieving the purpose of improving stability and accuracy.

[0043] The dynamic prototype generation mechanism based on hierarchical clustering and silhouette coefficient can effectively cope with the multimodal characteristics of malware families, further enhancing the classifier's adaptability when dealing with malware family mutations, and further improving the generalization ability in small-sample malware family classification tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The above and other objects, features and advantages of the present disclosure will become more apparent through a more detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings, wherein like reference numerals generally represent like components throughout the exemplary embodiments of the present disclosure.

[0045] Figure 1 A flowchart of the framework of the malware family classification method provided in the embodiment of the present disclosure;

[0046] Figure 2a This is an RGB image sample of the Plankton family of malware.

[0047] Figure 2b This is an RGB image sample of the mobiletx family among malware families;

[0048] Figure 2c This is an RGB image sample of the accutrack family among the malware families;

[0049] Figure 3 The encoder structure frame provided by the embodiment of the present disclosure;

[0050] Figure 4 A flowchart of supervised contrastive learning provided by an embodiment of the present disclosure;

[0051] Figure 5 A hierarchical clustering flow chart provided for an embodiment of the present disclosure;

[0052] Figure 6 A comparison chart of dynamic clustering and k-clustering at different levels provided in the embodiment of the present disclosure;

[0053] Figure 7a A SimCLR feature distribution diagram provided by an embodiment of the present disclosure;

[0054] Figure 7bEpisodic Training feature distribution diagram provided by the embodiment of the present disclosure;

[0055] Figure 7c SoftMax feature distribution diagram provided by the embodiment of the present disclosure;

[0056] Figure 7d This is a SupCon feature distribution diagram provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0057] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0058] It should be clear that the following embodiments of the present disclosure are described through specific concrete examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other in the absence of conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0059] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement an apparatus and / or practice a method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this apparatus and / or practice this method.

[0060] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The illustrations only show components related to the present disclosure and are not drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component can be changed at will, and the component layout may also be more complicated.

[0061] Additionally, in the following description, specific details are provided to provide a thorough understanding of the examples. However, one skilled in the art will appreciate that the aspects described can be practiced without these specific details.

[0062] This embodiment discloses a malware family classification method, including:

[0063] Obtain the bytecode file and configuration file of the application to be analyzed, and obtain RGB images based on the bytecode file and configuration file respectively;

[0064] Performing feature extraction on the RGB image based on the designed encoder to obtain a discriminative feature vector;

[0065] For each RGB image, sample pairs are generated through data augmentation, and the embedding space is optimized using a supervised contrastive learning method so that feature vectors of similar samples are close to each other and feature vectors of heterogeneous samples are far away from each other, thereby training the encoder;

[0066] The encoder trained by supervised contrastive learning is used to extract feature vectors of samples of each category. Based on hierarchical clustering and silhouette coefficient, similar feature vectors are divided into multiple subclusters and weighted fusion is performed to generate category prototypes. Malware family classification is completed based on the distance between the query sample and each category prototype.

[0067] The following text takes the Android system as an example, but is not limited to the Android system. Other systems can also be applied to the technical solutions disclosed in this embodiment.

[0068] In a specific application scenario, the small sample Android malware family classification method based on contrastive learning and dynamic prototyping includes:

[0069] Extract static features of Android malware by generating an RGB image input, mapping the classes.dex bytecode file, AndroidManifest.xml configuration file, and local entropy features to the red, green, and blue channels of the image, respectively, to generate a three-channel color image for classification tasks;

[0070] The DenseNet-121 network and the CBAM attention mechanism feature extractor are used to enhance the model's ability to perceive key area features in malware images, thereby improving the discriminability of feature expression.

[0071] Using supervised contrastive learning (SupCon) methods, we optimize the feature embedding space to ensure significant separation between different malware families while enhancing the consistency of samples within the same family, improving classification accuracy.

[0072] Design a dynamic prototype generation mechanism that combines hierarchical clustering and the silhouette coefficient method to adaptively adjust the prototype of each malware family, avoiding excessive structural differences within the family and enhancing the robustness of the classification model.

[0073] The generated dynamic prototypes are combined with the optimized feature embedding space to achieve efficient classification of malware families.

[0074] The details are as follows:

[0075] Step 1: Get the dataset:

[0076] This example constructed the experimental dataset using two representative datasets in the field of Android malware detection: the Drebin dataset and the CIC-InvesAndMal2019 dataset. The Drebin dataset contains 5,560 malicious applications across 179 families, exhibiting a typical long-tail distribution. The CIC-InvesAndMal2019 dataset contains 426 malicious samples and 5,065 benign samples across 42 families, with a relatively balanced distribution across categories, making it suitable for modeling and analyzing small samples and new malware.

[0077] In the experimental setting, a base / novel partitioning strategy commonly used in small-sample learning is adopted, where the base subset is used to build representation capabilities, and the novel subset is used to evaluate the generalization performance of the model on unseen classes. It is required that the category spaces of the two do not overlap but have consistent distribution characteristics.

[0078] Specifically, for the Drebin dataset, families with at least 20 samples were selected to form the base subset, while the remaining families with between 10 and 20 samples formed the novel subset. The novel subset was further split into validation and test sets at a 1:1 ratio to avoid data overlap. For the CIC-InvesAndMal2019 dataset, all 42 malicious families were split into base and novel sets at a 6:4 ratio, with validation and test sets also split within the novel sets. This also ensures that the model only encounters new classes during the testing phase.

[0079] Step 2: Local experimental environment deployment:

[0080] All experiments in this embodiment were completed in a local working environment. The operating platform was Windows 11 operating system, equipped with an Intel Core i7-14700HX processor and an NVIDIA GeForce RTX 4070 Laptop GPU with a memory capacity of 16 GB. Model development was based on the Python 3.8 programming language, using the PyTorch 2.4.1 deep learning framework, and using PyCharm 2024.1.1 as the main development tool. The above-mentioned hardware and software environment can fully meet the computational requirements of the proposed method in the training and reasoning stages, ensuring the stability of the experimental process and the repeatability of the results.

[0081] During the training phase, the model was optimized using a supervised contrastive learning strategy, with an initial learning rate of 0.001, SGD as the optimizer, and SupConLoss as the loss function. The total number of training epochs was 200, with a batch size of 32. During the testing phase, an N-way K-shot episodic few-shot setting was used to evaluate the model's recognition capabilities in scenarios with few samples and unseen classes. Specifically, the task was a 5-way classification task, with either 5-shot or 1-shot support samples provided for each class, along with 5 additional query samples. To ensure the statistical stability of the evaluation results, a total of 1000 episodes were constructed for testing. Furthermore, to accommodate the clustering requirements of the task, the maximum number of classes in the clustering module was set to 4.

[0082] Step 3: Data Visualization:

[0083] Extract the classes.dex bytecode file and AndroidManifest.xml configuration file from the APK file to be analyzed, map the classes.dex byte stream to the red channel of the image, and map the AndroidManifest.xml configuration file to the green channel of the image. Calculate the local entropy features based on the classes.dex byte stream, and map the resulting entropy matrix to the blue channel of the image. During the image generation process:

[0084] When reconstructing the red channel into a two-dimensional matrix, the matrix width is dynamically selected based on the byte stream length. After zero padding, the matrix is ​​scaled to 128×128 pixels using bilinear interpolation. CLAHE and gamma correction techniques are used to enhance image contrast and brightness.

[0085] The green channel uses a fixed width of 256 when reconstructing into a two-dimensional matrix. It is also zero-padded and scaled to 128×128 pixels through bilinear interpolation. CLAHE and gamma correction techniques are used to enhance image contrast and brightness.

[0086] The blue channel is directly scaled to 128×128 through bilinear interpolation after local entropy feature calculation and matrix reconstruction based on the classes.dex byte stream with a fixed width of 256.

[0087] Finally, the red, green, and blue channels are combined to obtain an RGB image that represents the static structural information and potential malicious features of the APK.

[0088] Specific as Figure 1 As shown in the figure, the original APK file does not need to be decompiled. Instead, the classes.dex bytecode and AndroidManifest.xml configuration file are directly extracted. The local entropy information based on the classes.dex file is then mapped to the red, green, and blue channels, generating a discriminative RGB color image as input for subsequent model training.

[0089] For the R and G channels, we extract the classes.dex bytecode file and the AndroidManifest.xml configuration file from the APK file, respectively. First, we determine the image width w based on the byte stream length. The length of the classes.dex bytecode file varies widely (from a few KB to approximately 4MB), so we use a dynamic adaptive strategy to estimate the most appropriate matrix width based on the byte count: ,

[0090] This strategy isn't intended to restore the original file size; rather, it aims to maintain structural and morphological balance during the image construction phase, avoiding semantic disturbances caused by disproportionate proportions. This improves image quality and model perception during subsequent interpolation and scaling. The width is chosen based on commonly used standard resolutions in image processing and is divided into intervals based on the size distribution of the classes.dex bytecode file, ensuring both structural integrity and processing consistency.

[0091] Then, the byte data is padded into a two-dimensional matrix according to the selected width, and the insufficient part is filled with zeros to ensure the alignment of the matrix.

[0092] For the green channel (G), since the size of the AndroidManifest.xml configuration file is usually between 1–32KB and varies little, a fixed width w = 256 is used to construct the matrix. Subsequently, the byte stream is padded to the selected width and reconstructed into a two-dimensional matrix, and the missing parts are zero-filled:

[0093] ,

[0094] The resulting matrix is ​​scaled to 128×128 pixels using bilinear interpolation. The interpolation formula is as follows:

[0095] ,

[0096] in, , is the relative offset of the target pixel (x, y) relative to its four neighboring pixels. Finally, CLAHE and Gamma correction (clahe_gamma) are applied to the generated image to improve the contrast and brightness of the image, and the final red and green channel images are obtained.

[0097] The B channel is used to characterize the complexity of the spatial structure of the classes.dex file to enhance the model's robustness against code perturbations (such as obfuscation and packing). This example uses a sliding window method to extract local entropy features, setting the window size to 256 bytes and the step size to 128 bytes. The Shannon entropy is calculated in each sliding window:

[0098] ,

[0099] in, Indicates the number of bytes with byte value i in the sliding window, The resulting entropy sequence is reconstructed into a two-dimensional matrix with a fixed width of w = 256 after zero padding, normalized to the interval [0, 255], and the same scaling and alignment strategy as the R and G channels is used to generate a spatially consistent blue channel image.

[0100] The formula for normalization to the interval [0,255] is: ,

[0101] Finally, the bilinear interpolation method is used to scale the images to a uniform size of 128×128 to ensure the consistency of spatial alignment of the three-channel images.

[0102] Figures 2a to 2c Image samples of different malware families are shown. Figure 2a For the Plankton family, Figure 2b For the MobileTX family, Figure 2c It is the accutrack family. It can be seen that the images within the same family have consistent texture and structural features, while there are significant differences between different families, which verifies the effectiveness of the visualization method of this embodiment.

[0103] Step 4: Build the Encoder:

[0104] In order to effectively extract the discriminative features in malware visualization images, enhance the model's ability to focus on key areas, and give full play to the advantages of DenseNet and CBAM attention mechanisms, this embodiment designs an encoder module that integrates dense connection structure and attention mechanism. Its overall structure is as follows: Figure 3This module mainly consists of three parts: the DenseNet-121 backbone network, the CBAM attention mechanism module, and the embedding feature projection layer (Projection Head), aiming to achieve the organic integration of multi-scale feature reuse, key area enhancement, and low-dimensional embedding expression.

[0105] First, the backbone adopts the DenseNet-121 network structure, which includes four Dense Blocks, consisting of 6, 12, 24, and 16 Dense Layers, respectively. Each Dense Layer includes batch normalization (BN), ReLU activation, 1×1 Bottleneck convolution, and 3×3 convolution. This dense connection mechanism enables efficient feature reuse across layers, effectively alleviating the vanishing gradient problem and making it particularly suitable for deep modeling with small sample sizes. A Transition module is inserted between every two Dense Blocks to compress the channel dimension and control the feature map size, avoiding information overload caused by channel redundancy.

[0106] Secondly, in order to improve the model's ability to focus on key areas, a CBAM (Convolutional Block Attention Module) attention mechanism module is introduced after the backbone network. Figure 3 As shown in Figure 1, it consists of two submodules connected in series: the Channel Attention Module (CAM) and the Spatial Attention Module (SAM). The CAM module extracts global contextual information at the channel level through global average pooling and max pooling, and combines this with a shared feedforward neural network for weighted fusion to generate a channel attention map, thereby highlighting discriminative feature channels. The SAM module then further extracts information from the spatial dimension, integrating local responses through pooling and convolution to generate a spatial attention map, which is used to enhance the representation of key areas in the image.

[0107] Finally, the embedding feature compression layer compresses the enhanced feature map into a feature vector of size [B, 1024, 1, 1] through global average pooling. It is then mapped to a low-dimensional embedding space (e.g., 512 dimensions) through a fully connected layer and L2 normalized to obtain a standardized embedding vector. This vector serves as the feature representation in the contrastive learning phase, optimizing intra-class compactness and inter-class separation, as well as inter-class discrimination and intra-class aggregation.

[0108] Step 5: Introduction of training method:

[0109] Malware image classification tasks, when performed with small sample sizes, are often limited by the generalization capabilities of feature extractors. This is particularly challenging when modeling the internal consistency of similar samples. To address this issue, this example employs supervised contrastive learning (SupCon) as the core strategy for encoder training, aiming to construct an embedding space representation with stronger intra-class cohesion and inter-class discrimination.

[0110] Supervised Contrastive Learning (SupCon) is used as a training strategy to optimize the feature embedding space and enhance the generalization ability of the model:

[0111] Malware image classification in small sample sizes often faces the problem of insufficient generalization of feature extractors. To enhance the model's ability to consistently model similar samples, this paper introduces a supervised contrastive learning (SupCon) approach. This approach explicitly reduces the distance between similar samples in the embedding space while effectively distinguishing heterogeneous samples, thereby constructing a more discriminative and well-structured feature representation space.

[0112] Specifically, if Figure 4 As shown in the figure, during training, each original image sample undergoes two different data augmentation methods (such as random cropping, color perturbation, and grayscaling) to generate two views, forming a positive sample pair. After augmentation, a batch contains N original samples, expanded to 2N augmented image instances. These images are fed into the encoder, where feature vectors are extracted, resulting in a set of embedded representations {z1, z2, ..., z2N}, where samples of the same category maintain consistency in color and structure.

[0113] In the contrastive learning process, each embedding vector zi is used as an anchor to construct its positive sample set. (similar samples), the rest are considered negative samples The goal of training is to keep the distance between the anchor and the positive sample as close as possible, while maximizing the distance between the anchor and the negative sample, thereby improving the inter-class discrimination. The supervised contrast loss function is defined as follows:

[0114] ,

[0115] in, It is the index set of all anchors in the batch. is a temperature parameter used to adjust the sensitivity to similarity.

[0116] Step 6: Construction of hierarchical clustering and silhouette coefficient:

[0117] In the task of classifying small-sample malware families, since the same family may contain multiple variants or multiple iterative versions, its internal samples often have significant differences in structural features and representation space. If all supporting samples are simply averaged to construct a class prototype, it is easy to cause feature distortion due to excessive intra-class differences, thereby affecting the classification accuracy and discrimination ability of the model. To solve this problem, this embodiment, based on the encoder trained by the supervised contrastive learning strategy, first inputs the visual image into the encoder to extract a standardized embedding vector, and maps it to a unified low-dimensional feature space. This embedding space has strong inter-class discrimination and intra-class structure preservation capabilities, and can be effectively used for subsequent clustering analysis and structural modeling.

[0118] On this basis, this embodiment designs a solution based on hierarchical clustering and silhouette coefficient. Figure 5 As shown in the figure, specifically, a bottom-up hierarchical clustering method is used to initialize each support sample as an independent cluster, and the inter-cluster distance is calculated based on the Ward connection criterion. The most similar cluster pairs are iteratively merged, and the inter-cluster distance is calculated by the Ward connection criterion. The cluster pairs with the smallest distance are gradually merged, and finally a complete clustering tree (dendrogram) is constructed.

[0119] To explore the internal structural distribution of malware families in the embedding space, this example prunes the cluster tree at multiple levels (e.g., k = 2, 3, 4) to obtain sub-cluster divisions at different granularities. For each cluster division, the silhouette score is used to evaluate the clustering quality. The silhouette score comprehensively considers both intra-cluster compactness and inter-cluster separation and is defined as follows:

[0120] ,

[0121] in, represents the average distance between the jth sample and other samples in its cluster (i.e., intra-class compactness), represents the average distance between the sample and all samples in the nearest cluster (i.e., inter-class separation), and T is the total number of supporting samples in the current class. This indicator ranges from [−1, 1]. A larger value indicates a more reasonable cluster structure, with both good intra-class compactness and sufficient inter-class separability. After obtaining the optimal clustering partitioning scheme through silhouette coefficient evaluation, this embodiment uses the clustering result with the highest silhouette coefficient as the final partitioning scheme, and represents all cluster centers obtained from this clustering as:

[0122] ,

[0123] in represents the center vector of the jth subcluster in family i, is the final number of clusters of this class. Characterizes the potential substructure distribution presented by family i in the support set.

[0124] Step 7: Dynamic prototype generation and classification decision construction:

[0125] After completing hierarchical clustering of samples from each family in the support set, we obtain several subcluster center vectors for each category, which describe the diversity structure within the category. To fully utilize this subcluster information and improve the model's adaptability to intra-category variation, this example proposes a dynamic prototype generation strategy based on softmax weighted fusion.

[0126] In the inference phase, for any query sample to be classified, it is first input into the encoder and mapped into the embedding space to obtain its embedding vector representation. Then, the Euclidean distance between the query sample and all sub-cluster centers of each candidate category i is calculated :

[0127] ,

[0128] Then use the softmax function to get each center The response weight for this query sample :

[0129] ,

[0130] in, is the temperature parameter, which is used to adjust the sensitivity of the distance. Finally, the query sample Dynamic prototype under category i Expressed as:

[0131] ,

[0132] The model assigns the sample to the category with the smallest distance to its dynamic prototype:

[0133] ;

[0134] Step 8: Encoder training:

[0135] Based on the data partitioning scheme constructed in step 1 and the RGB visualization image generated in step 3, this example uses the base subset as training data to optimize the encoder designed in step 4. The training strategy uses supervised contrastive learning (SupCon) to improve the model's inter-class separability and intra-class cohesion in the embedding space.

[0136] During training, samples are first generated into two views using an augmentation strategy. These are then fed into an encoder to extract embedded features and construct positive and negative sample pairs based on supervised labels. By minimizing the supervised contrastive loss function, the model gradually learns to bring similar samples closer together and dissimilar samples further apart in the structural space, establishing a more clearly distinguishable feature distribution.

[0137] To ensure the trained model's generalization performance on unseen categories, the validation set generated in step 1 is periodically evaluated during training. The evaluation process remains consistent with formal reasoning. First, hierarchical clustering is performed on each class of support examples in the validation set, as in step 6. The silhouette coefficient is used to select the optimal pruning structure, resulting in multiple subcluster centers for that class. Subsequently, dynamic prototypes are generated using the softmax weighting mechanism in step 7, and the model's classification accuracy on query examples is evaluated using an episodic few-shot testing framework.

[0138] The consistency assessment process described above truly reflects the model's structural modeling and discriminative capabilities under unseen conditions, avoiding bias caused by inconsistencies between the assessment method and the inference process. Ultimately, the model parameters that perform best on the validation set are selected as the final encoder version for subsequent small-sample inference tasks.

[0139] Step 9: Test the Encoder:

[0140] After completing the encoder training and verification in step eight, this embodiment uses the novel test set divided in step one to comprehensively evaluate the finally trained encoder model to verify its generalization ability and actual classification effect on unseen categories.

[0141] During the testing phase, the evaluation process is strictly aligned with the real-world application scenarios of the inference phase. Specifically, for each test episode, several classes are randomly selected (e.g., 5-way), and a small number of support samples (e.g., 1-shot or 5-shot) are sampled from each class. Multiple query samples from the same class are then collected to construct the test task. All support samples are first embedded using the encoder and then hierarchically clustered according to the process described in step 6. The silhouette coefficient is used to evaluate the optimal pruning scheme, resulting in multiple subcluster centers for each class.

[0142] Then, for each query sample, the distance between it and the centers of all subclusters in each candidate category is calculated, and the softmax weighting mechanism proposed in step 7 is used to fuse and generate a dynamic prototype. Finally, the model determines the category to which the query sample belongs based on the distance between the query sample and the dynamic prototype of each category.

[0143] This process constructed 1,000 episodic few-shot test tasks on the novel test set and systematically evaluated the model's performance under both 5-way 5-shot and 5-way 1-shot settings. Experimental results show that on the Drebin dataset, SupProto achieves an average accuracy of 90.59% in the 5-shot setting and 75.56% in the 1-shot setting. On the CIC-InvesAndMal2019 dataset, the 5-shot and 1-shot accuracies are 85.64% and 67.96%, respectively. These results demonstrate that the proposed method maintains good generalization and discriminative performance under complex conditions such as low sample size, high inter-class similarity, and intra-class heterogeneity.

[0144] Step 10: Ablation experiment design and effect verification:

[0145] To fully verify the effectiveness of each key module in this embodiment and further analyze the contribution of each sub-module to the model performance, this embodiment designed and conducted three ablation experiments, which were carried out from three perspectives: embedded network structure, dynamic clustering mechanism, and training paradigm selection. The goal is to evaluate the specific role and performance impact of each component of SupProto in the small sample malware classification task.

[0146] (1) To verify the superiority of the embedding network used by SupProto, this example selects ResNet18, MobileNetV3, EfficientNetB0, and the basic version of DenseNet121 for comparison with SupProto. These networks cover different types from lightweight models to mainstream high-performance architectures, which can reflect the impact of structural complexity on the quality of embedded features. All models are tested 1000 times in a 5-way manner on the Drebin dataset under the same training strategy and inference process.

[0147] Table 1. 5-way 1-shot accuracy

[0148]

[0149] Table 2. 5-way 5-shot accuracy

[0150] .

[0151] The results, shown in Tables 1 and 2, show that in the 1-shot setting, SupProto, leveraging the DenseNet121 architecture with the CBAM attention module, achieved an accuracy of 75.56%, a 2.5% improvement over the traditional ResNet18 and a 2.41% improvement over the original DenseNet. In the 5-shot setting, SupProto's accuracy further improved to 90.59%, achieving the highest performance among all models, validating its advantages in feature extraction and discriminative modeling.

[0152] (2) Comparative experiment of dynamic clustering mechanism:

[0153] To evaluate the effectiveness of the "hierarchical clustering + silhouette coefficient" dynamic prototype generation mechanism proposed in step 6, this example further compares it with a hierarchical clustering scheme with a fixed number of clusters (e.g., fixed pruning levels k = 2, 3, or 4) and a traditional prototype network. The changes in classification accuracy are compared under different shot settings.

[0154] The experimental results are as follows Figure 6 As shown, the dynamic clustering mechanism used by SupProto achieves optimal performance in all settings, with an average improvement of approximately 1.1% over fixed clustering and a 1.86% improvement over the optimal fixed solution (k=3) in the 7-shot setting. Furthermore, compared to traditional prototypical networks, the average improvement is approximately 3%, demonstrating that the dynamic clustering mechanism not only improves robustness but also better adapts to complex family structure differences.

[0155] (3) Comparative analysis of different training strategies:

[0156] To explore the impact of the learning method of the embedding space on the final model performance, this example compares the SupContrast method used by SupProto with three mainstream training strategies: traditional Softmax classification training, unsupervised contrastive learning method SimCLR, and Episodic Training method.

[0157] In the experiment, ResNet18 is uniformly used as the embedding network to eliminate the interference caused by differences in network structure. Samples from five families in the Drebin dataset are used for feature learning, and the spatial distribution of the embedded vectors is compared through t-SNE dimensionality reduction visualization.

[0158] like Figures 7a to 7d As shown, Figure 7a is the SimCLR feature distribution map, Figure 7b is the Episodic Training feature distribution map, Figure 7c is the SoftMax feature distribution map, Figure 7dThis is the SupCon feature distribution diagram. The SupCon method shows the best clustering structure in the embedding space: Figures 7a to 7d middle Indicates fakelogo, Indicates nandrobox, means fatakr, Represents mobilespy Indicates steek.

[0159] The distance between similar samples of the SupCon method is significantly smaller than that between heterogeneous samples, and the cluster structures of various types are compact and the boundaries are clear. SimCLR can also achieve good intra-class aggregation under unlabeled supervision, but due to the lack of label semantic constraints, the inter-class separation of some categories is poor. Episodic Training constructs tasks by supporting sets and query sets, indirectly optimizing the feature structure, but because the contrast loss is not explicitly optimized, its clustering effect of some categories is weak. In contrast, although the Softmax classifier can construct basic category discrimination boundaries, it does not optimize the embedding space, resulting in blurred boundaries between classes. Overall, SupCon, as a training paradigm for embedding networks, meets the task requirements and has significant advantages.

[0160] This example, based on the malware family classification task, conducts in-depth analysis of the static features of Android malware and combines image recognition technology to generate discriminative RGB images. This significantly improves the accuracy and robustness of the classification model when dealing with small-sample, high-variability malware families. By mapping the bytecode of the classes.dex file, the AndroidManifest.xml configuration file, and the local entropy features of the classes.dex file to different channels of the image, it comprehensively expresses the static structural information and potential malicious characteristics of the malware, providing high-quality input data for subsequent classification models.

[0161] To further enhance feature extraction, this example introduces an encoder design that combines DenseNet-121 with CBAM (Channel and Spatial Attention Mechanism). By leveraging DenseNet's feature reuse and CBAM's attention mechanism, the encoder can extract more fine-grained and discriminative features from complex malware family variants, effectively improving classification performance. By optimizing the image feature extraction process, the encoder enhances model robustness and its ability to focus on key areas when learning with a small sample size.

[0162] This implementation also introduces a dynamic prototype network (SupProto) based on contrastive learning. By optimizing the feature embedding space, it enhances the ability to model the consistency of similar samples, effectively improving the performance of malware family classification. In the feature space, SupProto can significantly reduce the distance between similar malware samples while increasing the distance between different malware families, thereby improving the model's discriminative ability.

[0163] A dynamic prototype generation mechanism combining hierarchical clustering and silhouette coefficients makes malware family prototypes more representative. By optimizing intra-class clustering and silhouette coefficients, the proposed dynamic prototype fusion mechanism effectively avoids prototype distortion caused by excessive intra-family differences, enhancing the model's adaptability and robustness to malware family variants.

[0164] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0165] Various changes, substitutions, and modifications may be made to the technology described herein without departing from the teachings defined by the appended claims. Moreover, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of things, means, methods, and actions described above. Currently existing or later developed processes, machines, manufactures, compositions of things, means, methods, or actions that perform substantially the same function or achieve substantially the same results as the corresponding aspects described herein may be utilized. Accordingly, the appended claims include within their scope such processes, machines, manufactures, compositions of things, means, methods, or actions.

[0166] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0167] The above description has been provided for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A malware family classification method, characterized in that: include: Obtain the bytecode file and configuration file of the application to be analyzed, and obtain RGB images based on the bytecode file and configuration file respectively; Performing feature extraction on the RGB image based on the designed encoder to obtain a discriminative feature vector; For each RGB image, sample pairs are generated through data augmentation, and the embedding space is optimized using a supervised contrastive learning method so that feature vectors of similar samples are close to each other and feature vectors of heterogeneous samples are far away from each other, thereby training the encoder; The encoder trained by supervised contrastive learning is used to extract feature vectors of samples of each category. Based on hierarchical clustering and silhouette coefficient, similar feature vectors are divided into multiple subclusters and weighted fusion is performed to generate category prototypes. Malware family classification is completed based on the distance between the query sample and each category prototype.

2. The malware family classification method according to claim 1, characterized in that: The step of obtaining a bytecode file and a configuration file of the application to be analyzed and obtaining RGB images based on the bytecode file and the configuration file respectively includes: Map the bytecode file stream to the R channel of the RGB image; Map the profile to the G channel of the RGB image; The local entropy features are calculated based on the byte stream of the bytecode file, and the obtained local entropy features are mapped to the B channel of the RGB image.

3. The malware family classification method according to claim 2, characterized in that: The step of obtaining a bytecode file and a configuration file of the application to be analyzed and obtaining RGB images based on the bytecode file and the configuration file respectively includes: Reconstruct the R channel into a two-dimensional matrix. When reconstructing the R channel into a two-dimensional matrix, the matrix width is dynamically selected according to the byte stream length, and after zero padding, the matrix is ​​scaled to the set pixel through bilinear interpolation, and correction technology is used to enhance the image contrast and brightness; Reconstruct the G channel into a two-dimensional matrix. When reconstructing the G channel into a two-dimensional matrix, a fixed width is used, zero-filled, and then scaled to the set pixels through bilinear interpolation. Correction technology is used to enhance the image contrast and brightness. The B channel is reconstructed into a two-dimensional matrix. When the B channel is reconstructed into a two-dimensional matrix, local entropy features are calculated and matrix reconstruction is performed based on the byte stream of the bytecode file at a fixed width, and then it is directly scaled to the set pixels through bilinear interpolation.

4. The malware family classification method according to claim 3, characterized in that: The dynamically selecting the matrix width according to the byte stream length includes: , in, is the image width, The length of the byte stream.

5. The malware family classification method according to claim 3, characterized in that: The step of reconstructing the B channel into a two-dimensional matrix includes: The sliding window method is used to extract byte-level local entropy features. The byte stream is slidingly calculated and the Shannon entropy of each window is calculated to obtain a one-dimensional entropy sequence. The one-dimensional entropy sequence is reconstructed into a two-dimensional matrix with a fixed width after zero padding, and the entropy value is normalized.

6. The malware family classification method according to claim 1, characterized in that: The encoder comprises: DenseNet-121 backbone network, CBAM attention mechanism module and feature compression projection layer; The DenseNet-121 backbone network extracts multi-layer features through four dense blocks; The CBAM attention mechanism module generates attention maps from the channel and spatial dimensions through the channel attention module and the spatial attention module respectively; The feature maps extracted by the DenseNet-121 backbone network and the CBAM attention mechanism module are combined and mapped to a low-dimensional embedding space through a feature compression projection layer and L2 normalized.

7. The malware family classification method according to claim 1, characterized in that: The method generates sample pairs for each RGB image through data augmentation and optimizes the embedding space using a supervised contrastive learning method so that the feature vectors of similar samples are close to each other and the feature vectors of heterogeneous samples are far away from each other, including: After inputting the sample pair into the encoder, the embedded representation is obtained; Each embedded feature in the embedded representation is regarded as an anchor point, and the samples with the same label as the anchor point are found as the positive sample set through the supervised contrast loss function, and the samples of different categories are regarded as the negative sample set.

8. The malware family classification method according to claim 1, characterized in that: The encoder trained by supervised contrastive learning is used to extract feature vectors of samples from each category. Based on hierarchical clustering and silhouette coefficient, similar feature vectors are divided into multiple subclusters and weighted fusion is performed to generate category prototypes. Malware family classification is completed based on the distance between the query sample and each category prototype, including: The feature vectors of samples of each category extracted by the encoder obtained through supervised contrastive learning training are directly clustered using the hierarchical clustering method; during the clustering process, the results of different clustering levels are quantitatively evaluated using the silhouette coefficient to measure the intra-class tightness and inter-class separation of the clustering results; based on the evaluation results, the scheme with the best clustering effect is selected from multiple candidate clustering schemes, and the selected clustering results are used for subsequent prototype generation and malware family classification.

9. The malware family classification method according to claim 8, characterized in that: The results of different clustering levels in the clustering process are quantitatively evaluated using the silhouette coefficient, including: Starting with each sample as an independent cluster, calculate the distance between clusters, gradually merge the cluster pairs with the smallest distance, and build a complete cluster tree; The tree structure is cut at different pruning levels to obtain different numbers of cluster division results, and the silhouette coefficient is used to evaluate the clustering quality of each division scheme; The silhouette coefficient is based on the average distance between the jth sample and other samples in its cluster. , the average distance between the jth sample and all samples in the nearest other clusters And the total number of supporting samples in the current category is calculated; According to the clustering quality evaluation results, the best clustering scheme is selected from multiple candidate clustering schemes. The clustering result with the highest silhouette coefficient is used as the final clustering result, and all cluster centers obtained by the clustering are expressed as: , in represents the center vector of the jth subcluster in family i, is the final number of clusters of this class, the set Characterizes the potential substructure distribution presented by family i in the support set.

10. The malware family classification method according to claim 9, characterized in that: After obtaining all cluster center representations, it also includes: In the inference phase, for any query sample , first calculate the query sample The distance between each subcluster center , and then use the softmax function to calculate the query sample of each cluster center The response weight , and use the weighted fusion dynamic prototype as the query sample The representation under the i-th category will eventually convert the query sample Assigned to the category with the smallest distance to its dynamic prototype.

Images