Malicious code classification method based on improved DenseNet
By improving the DenseNet model and cascade classifier, the problem of malicious code texture similarity classification is solved, the accuracy and robustness of malicious code detection are improved, and it can effectively deal with complex malicious code threats.
Patent Information
- Application Number
- CN202510676216.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-24
- Publication Date
- 2025-09-05
AI Technical Summary
Existing deep learning-based malicious code detection models face the problem of difficulty in accurately classifying malicious code with similar textures and poor robustness when faced with the explosive growth of malicious code and its variants. They are particularly vulnerable to attacks from adversarial samples.
An improved DenseNet model is adopted to build a basic model through dense blocks and converter layers, and combined with the fast marching image restoration algorithm for data enhancement. A cascade classifier is designed, including multi-classification and binary classification models, to handle malicious codes with similar textures and different textures respectively.
It improves the ability to identify malicious code with similar textures, enhances the robustness of the model, can effectively defend against adversarial attacks, and improves the accuracy and robustness of malicious code classification.
Smart Images
Figure CN120597271A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of malicious code detection, and in particular relates to a malicious code classification method based on an improved DenseNet. Background Art
[0002] As one of the classic algorithms of deep learning, convolutional neural network (CNN) has strong feature extraction capabilities and has been widely studied and applied in the field of malicious code detection. Some scholars mapped the malicious code into an uncompressed grayscale image and normalized the size. Then, they used the directional gradient histogram to extract the features of the grayscale image and used the deep forest algorithm to classify the malicious code. Some scholars converted the malicious code into an RGB image. The three channels of the RGB image represent the binary file features, assembly instruction features and API call features respectively, achieving better classification results than the grayscale image. Some scholars proposed a malware visualization classification method based on opcode frequency. This method uses the designed chromatogram to classify the malware. The top 15 opcodes with the largest number of occurrences are marked and filled in the order in which the space-filling curve traverses the RGB color space, so that opcodes of the same color are clustered together, resulting in good classification results. Some scholars convert the original malware binary file into an image and then use truncated singular value decomposition (SVD) to transform it to reduce the size of the feature vector, speed up the training process, and reduce model overfitting. Some scholars also use bicubic interpolation, ReduceLROnPlateau learning rate scheduler, and class weight estimation techniques based on the mobile neural network (MobileNet) network structure to establish a MobileNet fine-tuning model to achieve malicious code image classification.
[0003] Although the above CNN-based methods solve the problem of malicious code detection under specific conditions, they still have the following two shortcomings for the explosive growth of malicious code and its variants: First, after visualizing the malicious code as an image, there are also cases where different malicious code families have similar textures, making it difficult for the model to accurately classify them; Second, existing deep learning-based malicious code classification models are not robust and are vulnerable to adversarial examples. Attackers only need to modify a few bytes of the malicious code image to cause the model to misclassify.
[0004] To this end, this application proposes a malicious code classification method based on an improved DenseNet to solve the problems raised by the background technology. Summary of the Invention
[0005] Based on this, it is necessary to address the above technical problems and provide a malicious code classification method based on an improved DenseNet that can accurately classify texture-similar malicious codes and improve the robustness of the malicious code classification model.
[0006] In the first aspect, the present application provides a malicious code classification method based on an improved DenseNet, including:
[0007] Obtaining an initial binary malicious code, and preprocessing the initial binary malicious code to generate an enhanced binary malicious code image;
[0008] Improved densely connected convolutional network base model based on dense blocks and converter layers;
[0009] A first classification model and a second classification model are generated based on training of an improved densely connected convolutional network basic model; wherein the first classification model is used to generate a preliminary classification result based on the enhanced binary malicious code image; and the second classification model is used to generate an image texture subdivision classification result based on the preliminary classification result;
[0010] Based on the enhanced binary malicious code image, the first classification model and the second classification model are combined to generate the final malicious code identification result.
[0011] In one embodiment, obtaining an initial binary malicious code and preprocessing the initial binary malicious code to generate an enhanced binary malicious code image includes:
[0012] Convert the initial binary malicious code into a grayscale image and normalize it to a fixed size to generate a binary malicious code grayscale image;
[0013] The data of binary malicious code grayscale image is enhanced based on the Fast Marching Image Inpainting (FFM) algorithm to generate enhanced binary malicious code image.
[0014] In one embodiment, the fast marching image inpainting algorithm is expressed as:
[0015]
[0016] w(p,q)=dir(p,q)·dst(p,q)·lev(p,q)
[0017] Where p is any point on the boundary of the area to be repaired in the image to be repaired, I(p) is the pixel estimate of point p, and B ε (p) is a neighborhood in the known image with point p as the center and ε as the radius, q is any point in the neighborhood, is the gradient of point q, w(p,q) is the influence weight function of the known pixel point q on the area to be filled, dir(p,q) is the direction factor, dst(p,q) is the geometric distance factor, and lev(p,q) is the level set distance factor.
[0018] In one embodiment, data enhancement is performed on a binary malicious code grayscale image based on a fast marching image restoration algorithm (FFM) to generate an enhanced binary malicious code image, including:
[0019] Initialize the image to be repaired based on the binary malicious code grayscale image, and obtain the width data and height data of the image to be repaired;
[0020] Initialize the mask matrix based on the width data and height data;
[0021] Divide the image to be repaired into multiple rectangular image blocks of the same size;
[0022] Traverse the rectangular image blocks and generate a mask area at a random position in each rectangular image block;
[0023] Traverse each mask area, use the fast marching image restoration algorithm to perform data enhancement, and update the image to be restored and the mask matrix.
[0024] In one embodiment, an improved densely connected convolutional network basic model includes, in order of data flow, an input layer, a convolutional layer, a maximum pooling layer, a first dense block, a first converter layer, a second dense block, a second converter layer, a third dense block, a global average pooling layer, and a Kono network module. The improved densely connected convolutional network basic model is constructed based on the dense block and the converter layer, including:
[0025] constructing a first dense block, a second dense block, and a third dense block based on the dense block;
[0026] A first converter layer and a second converter layer are constructed based on the converter layer.
[0027] In one embodiment, the expression of the Kono network module is:
[0028]
[0029] φ l,j,i (·)=w b ·b(·)+w s Spline(·)
[0030] Where KAN(x) is the Kono network module, is the lth activation function matrix, φ l,j,i (·) is the activation function connecting the i-th neuron in layer l and the j-th neuron in layer l+1, b(·) and Spline(·) are the basis function and spline function respectively, w b and w s are basis function weights and spline function weights respectively.
[0031] In one embodiment, the first classification model is a multi-classification model, and the second classification model is a binary classification model. Based on the enhanced binary malicious code image, the first classification model and the second classification model are combined to generate a final malicious code identification result, including:
[0032] Inputting the enhanced binary malicious code image into the first classification model, performing preliminary multi-classification, and generating preliminary classification results;
[0033] Performing texture similarity judgment on the preliminary classification results to generate texture similarity judgment results;
[0034] If the texture similarity determination result is a texture difference, a final malicious code identification result is generated based on the preliminary classification result;
[0035] If the texture similarity determination result is texture similarity, the preliminary classification result is input into the second classification model for texture binary classification to obtain the image texture subdivision classification result, and the final malicious code identification result is generated based on the image texture subdivision classification result.
[0036] In a second aspect, the present application also provides a malicious code classification device based on an improved DenseNet, comprising:
[0037] A malicious code acquisition module is used to acquire the initial binary malicious code and pre-process the initial binary malicious code to generate an enhanced binary malicious code image;
[0038] Basic model building module, used to build an improved densely connected convolutional network basic model based on dense blocks and converter layers;
[0039] A classification model training module is used to generate a first classification model and a second classification model based on the training of an improved densely connected convolutional network basic model;
[0040] The classification result generation module is used to generate a final result of malicious code identification based on the enhanced binary malicious code image and in combination with the first classification model and the second classification model.
[0041] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any method of the first aspect of the present application are implemented.
[0042] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any method of the first aspect of the present application.
[0043] The above-mentioned malicious code classification method based on the improved DenseNet solves the classification problem caused by the similarity of image textures between individual malicious code families by designing a cascade classifier, significantly improving the recognition ability of families with similar textures; by optimizing the DenseNet network structure, the overall accuracy of the model can be improved; by preprocessing the initial binary malicious code and generating a data enhancement strategy for enhancing the binary malicious code image, the robustness of malicious code recognition can be improved. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0045] Figure 1 A flowchart of a malicious code classification method based on an improved DenseNet provided in one embodiment of the present application;
[0046] Figure 2 A schematic diagram of a process for preprocessing initial binary malicious code provided by one embodiment of the present application;
[0047] Figure 3 A schematic diagram of a flow chart of an FFM image enhancement method provided in one embodiment of the present application;
[0048] Figure 4 A flowchart of a method for generating a final result of malicious code identification provided by one embodiment of the present application;
[0049] Figure 5 An overall framework diagram of another malicious code classification method based on improved DenseNet provided in one embodiment of the present application;
[0050] Figure 6 A graph showing the training accuracy of an improved DenseNet model provided in one embodiment of the present application;
[0051] Figure 7 A graph showing the training loss value of an improved DenseNet model provided in one embodiment of the present application;
[0052] Figure 8 A schematic diagram of the robustness of a model after data enhancement provided in one embodiment of the present application;
[0053] Figure 9 A schematic diagram of model robustness before data enhancement provided in one embodiment of the present application;
[0054] Figure 10 A schematic diagram of the structure of a malicious code classification device based on an improved DenseNet provided in one embodiment of the present application. DETAILED DESCRIPTION
[0055] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.
[0056] In one embodiment, Figure 1 As shown, a malicious code classification method based on an improved DenseNet is provided. This embodiment uses the method applied to a server as an example. It is understandable that the method can also be applied to a terminal, or to a system including a terminal and a server, and implemented through the interaction between the terminal and the server. In this embodiment, the method may include the following steps:
[0057] Step S101: obtaining an initial binary malicious code, and preprocessing the initial binary malicious code to generate an enhanced binary malicious code image.
[0058] Illustratively, the server may perform, but is not limited to, size alignment, filtering and noise reduction, and data enhancement on the initial binary malicious code to achieve pre-processing of the initial binary malicious code.
[0059] Optionally, the server may convert the binary malicious code into a grayscale image, normalize it to a fixed size, and use a Fast Marching Method (FFM) algorithm to perform data augmentation on the training set.
[0060] Step S102: construct an improved densely connected convolutional network basic model based on dense blocks and converter layers.
[0061] Specifically, the server can construct an improved densely connected convolutional network basic model (improved DenseNet basic model) based on the densely connected convolutional network (DenseNet121) model and combine at least one dense block (DenseBlock) and at least one converter (Transition) layer.
[0062] Optionally, the number of DenseBlocks in the improved DenseNet base model can be set to three, and the number of Transition layers in the improved DenseNet base model can be set to two. This setting can reduce the number of parameters of the improved DenseNet base model and prevent overfitting of the improved DenseNet base model.
[0063] Optionally, a Kolmogorov-Arnold Network (KAN) structure can be used in the fully connected layer instead of the multi-layer perceptron (MLP) structure to improve the fitting ability of the improved DenseNet basic model.
[0064] Step S103: Generate a first classification model and a second classification model based on the training of the improved densely connected convolutional network basic model.
[0065] Specifically, the server can communicate with the storage system to obtain a preset first model training data set and a second model training data set, and train the constructed improved densely connected convolutional network basic model based on the preset first model training data set and the second model training data, respectively, to obtain a first classification model and a second classification model. The first classification model is used to generate a preliminary classification result based on the enhanced binary malicious code image. The second classification model is used to generate an image texture subdivision classification result based on the preliminary classification result.
[0066] Optionally, the server may build a cascade classifier based on the first classification model and the second classification model. The first classification model may be the first stage of the cascade classifier, outputting preliminary classification results; the second classification model may be the second stage of the cascade classifier, further segmenting images with similar textures.
[0067] Furthermore, the first classification model may be a multi-classification DenseNet model; and the second classification model may be a binary classification DenseNet model.
[0068] Step S104: Based on the enhanced binary malicious code image, the first classification model and the second classification model are combined to generate a final malicious code recognition result.
[0069] Optionally, the server can input the enhanced binary malicious code image into the first classification model for preliminary classification, generate a preliminary classification result, and judge the preliminary classification result according to the preset classification end rule. If the preliminary classification result meets the preset classification end rule, the server can generate a final result of malicious code identification based on the preliminary classification result.
[0070] Furthermore, if the server determines that the preliminary classification result does not meet the preset classification termination rules, the server can input the preliminary classification result into the second classification model to perform texture subdivision classification and generate an image texture subdivision classification result. At this time, the server can generate a final malicious code identification result based on the image texture subdivision classification result.
[0071] In the above-mentioned malicious code classification method based on the improved DenseNet, by preprocessing the initial binary malicious code to generate an enhanced binary malicious code image, the feature information of the malicious code can be more effectively extracted, thereby providing richer feature input for the subsequent classification model; by constructing an improved DenseNet basic model based on dense blocks and converter layers, the dense connection and reuse of malicious code image features can be achieved, and the feature information in the malicious code image can be fully utilized, thereby improving the accuracy, robustness and generalization ability of malicious code recognition; by constructing a mechanism for the two classification models to work together, the accuracy of malicious code classification can be effectively improved and the robustness of malicious code classification can be enhanced.
[0072] In one of the optional embodiments, please refer to Figure 2 , obtain the initial binary malicious code, and pre-process the initial binary malicious code to generate an enhanced binary malicious code image, including:
[0073] Step S210 , converting the initial binary malicious code into a grayscale image, and normalizing it to a fixed size to generate a binary malicious code grayscale image.
[0074] Step S220 , performing data enhancement on the binary malicious code grayscale image based on a fast marching image restoration algorithm to generate an enhanced binary malicious code image.
[0075] Schematically, the FFM algorithm is an efficient image restoration technology based on partial differential equations, which is mainly used to fill the missing areas in the image so that it can blend naturally with the surrounding background.
[0076] In the above-mentioned malicious code classification method based on the improved DenseNet, by converting the initial binary malicious code into a grayscale image, the data can be simplified from a complex binary sequence to a two-dimensional grayscale image, which can reduce the dimension of the data and make the subsequent feature extraction and classification process more efficient; by using a fixed-size input image, the operation of the improved DenseNet model can be made more efficient, thereby improving the operating efficiency of the improved DenseNet model; the FFM image restoration algorithm can repair and enhance the image while retaining the original features of the image. The enhanced image can better resist noise and interference, thereby improving the robustness of the improved DenseNet model to malicious code variants and noise.
[0077] In one optional embodiment, the fast marching image inpainting algorithm is expressed as:
[0078]
[0079] w(p,q)=dir(p,q)·dst(p,q)·lev(p,q)
[0080] Where p is any point on the boundary of the area to be repaired Ω in the image to be repaired I, I(p) is the pixel estimate of point p, and B ε (p) is a neighborhood in the known image with point p as the center and ε as the radius, q is any point in the neighborhood, is the gradient of point q, w(p,q) is the influence weight function of the known pixel point q on the area to be filled, dir(p,q) is the direction factor, dst(p,q) is the geometric distance factor, and lev(p,q) is the level set distance factor.
[0081] Schematically, the direction factor, geometric distance factor, and level set distance factor together determine the influence of the known pixel q on the pixel to be repaired p. After filling the boundary, it is necessary to iterate the above steps, gradually shrinking the boundary until the hole area is completely repaired.
[0082] In the above-mentioned malware classification method based on the improved DenseNet, the FFM algorithm can accurately and efficiently repair and enhance the missing or blurred parts in the malicious code image, thereby providing clearer and richer feature information for the subsequent improved DenseNet model.
[0083] In one of the optional embodiments, please refer to Figure 2 ,Based on the fast marching image repair algorithm, the binary malicious code grayscale image is enhanced to generate an enhanced binary malicious code image, including:
[0084] Step S221 : Initialize the image to be repaired based on the binary malicious code grayscale image, and obtain width data and height data of the image to be repaired.
[0085] Specifically, the server may initialize the image to be repaired I based on the binary malicious code grayscale image, and obtain width data w and height data h of the image to be repaired I.
[0086] Step S222 : Initialize the mask matrix based on the width data and the height data.
[0087] Specifically, the server may initialize a mask matrix mask of a size of [w, h] based on the width data w and the height data h, with all elements initialized to 0, indicating that no area of the image to be repaired I is masked.
[0088] Step S223: Divide the image to be repaired into a plurality of rectangular image blocks of the same size.
[0089] Specifically, the server can divide the image to be repaired I into n×n rectangular image blocks of the same size
[0090] Step S224 , traverse the rectangular image blocks and generate a mask area at a random position in each rectangular image block.
[0091] Specifically, the server may traverse the rectangular image blocks and generate a mask region of size k×k at a random position in each rectangular image block, indicating that the region of the image to be repaired I is masked, thereby obtaining a masked marked image.
[0092] Step S225 , traverse each mask area, use the fast marching image restoration algorithm to perform data enhancement, and update the image to be restored and the mask matrix.
[0093] Optional, such as Figure 3 As shown, the server can obtain the original malicious code image and initialize the image to be repaired based on the original malicious code image. The server can divide the image to be repaired into multiple rectangular blocks of equal size and generate a mask region of size k×k at a random position within each block, randomly inserting the mask. The server can perform image repair using the FFM algorithm based on the masked block image to be repaired, obtaining the repaired image.
[0094] In the above-mentioned malware classification method based on the improved DenseNet, by dividing the image into multiple rectangular image blocks, randomly generating a mask area within each image block, and then using the FFM algorithm for local repair and enhancement, it is possible to generate high-quality enhanced binary malware code images. This not only improves the feature diversity and robustness of the image, but also optimizes and improves the training effect and real-time performance of the DenseNet model.
[0095] In one optional embodiment, the improved densely connected convolutional network basic model includes, in order of data flow, an input layer, a convolutional layer, a maximum pooling layer, a first dense block, a first converter layer, a second dense block, a second converter layer, a third dense block, a global average pooling layer, and a Kono network (KAN) module. The improved densely connected convolutional network basic model is constructed based on the dense block and the converter layer, including:
[0096] A first dense block, a second dense block, and a third dense block are constructed based on the dense block.
[0097] A first converter layer and a second converter layer are constructed based on the converter layer.
[0098] In the above-mentioned malicious code classification method based on the improved DenseNet, through the collaborative work of multiple dense blocks and converter layers, the model can fuse feature information at different levels, and can analyze and judge malicious code from multiple aspects, thereby improving the classification accuracy; through the improved densely connected convolutional network basic model, this method can more effectively extract the feature information of malicious code images, improve the classification accuracy and generalization ability of the model, so that the improved DenseNet model can have high computational efficiency and robustness when processing large-scale malicious code datasets. This improved network structure can provide an efficient and reliable solution for the malicious code classification task, and thus can better cope with various complex network security threats.
[0099] In an exemplary embodiment, the network structure of the improved DenseNet basic model can be shown in the following table:
[0100]
[0101] In one optional embodiment, the Kono Network (KAN) module is a new neural network architecture that uses a learnable activation function at the edge of the network. For the input x, the expression of the KAN module can be:
[0102]
[0103] φ l,j,i (·)=w b ·b(·)+w s Spline(·)
[0104] Where KAN(x) is the Kono network module, is the activation function matrix of the lth layer, φ l,j,i (·) is the activation function connecting the i-th neuron in layer l and the j-th neuron in layer l+1, b(·) and Spline(·) are the basis function and spline function respectively, w b and w s are basis function weights and spline function weights respectively.
[0105] Optionally, the expressions for basis functions and spline functions can be:
[0106] b(τ)=Silu(τ)=τ / (1+e -τ )
[0107]
[0108] Where τ is the input of the basis function and spline function, Silu(·) is the activation function, ` is the basis function index parameter, c θis the coefficient optimized during training of the θth basis function, B θ (·) is the θth B-spline basis function defined on the network.
[0109] Schematically, the flexibility of splines enables them to adaptively model complex relationships in the data by adjusting their shape, thereby minimizing approximation errors and enhancing the network's ability to learn subtle patterns from high-dimensional data.
[0110] The above-mentioned malicious code classification method based on the improved DenseNet can provide an efficient, interpretable and generalizable solution for processing complex functions and high-dimensional data through the unique structure and theoretical basis of the Cono network module.
[0111] In one optional embodiment, the first classification model is a multi-classification model, and the second classification model is a binary classification model, such as Figure 4 As shown, based on the enhanced binary malicious code image, the first classification model and the second classification model are combined to generate the final malicious code identification result, including:
[0112] Step S401: Input the enhanced binary malicious code image into the first classification model, perform preliminary multi-classification, and generate preliminary classification results.
[0113] Step S402 : performing texture similarity determination on the preliminary classification result to generate a texture similarity determination result.
[0114] Step S403: If the texture similarity determination result is a texture difference, a final malicious code identification result is generated based on the preliminary classification result.
[0115] Step S404: If the texture similarity determination result is texture similarity, the preliminary classification result is input into the second classification model for texture binary classification to obtain the image texture subdivision classification result, and the final malicious code recognition result is generated based on the image texture subdivision classification result.
[0116] The above-mentioned malicious code classification method based on the improved DenseNet can more accurately identify the category of malicious code by combining a hierarchical classification strategy of a multi-classification model and a binary classification model. This strategy can not only improve the classification accuracy and robustness of the model, but also optimize computational efficiency and improve the real-time performance of malicious code detection, thereby providing an efficient, reliable, and highly adaptable solution for malicious code detection, which can better cope with complex and changing malicious code threats.
[0117] In an exemplary embodiment, please refer to Figure 5 , taking the public dataset Malimg as an example, the malicious code classification method based on the improved DenseNet provided by this application may include the following steps;
[0118] Step S1, Data Preprocessing: The Malmg dataset includes 9,339 malicious samples from 25 different families. The server can divide the Malmg dataset into training, validation, and test sets in a ratio of 8:1:1. Since the initial image sizes vary, the server can perform pixel normalization to set the image width and height to 64 pixels. The training set images are then augmented using the FFM image restoration algorithm. The specific steps of step S1 are as follows:
[0119] Step S11, obtaining the width w and height h of the image I;
[0120] Step S12: Initialize a mask matrix mask of size [w, h], where all elements are initialized to 0, indicating that no area of the image I is masked;
[0121] Step S13: Divide the original image I into 16×16 rectangular blocks of the same size;
[0122] Step S14: traverse all blocks and generate a 2×2 mask area at a random position in each block, indicating that the area of image I is masked, thereby obtaining the image to be repaired;
[0123] Step S15: traverse each mask area and use the FFM algorithm to restore the pixel values to obtain a new image I';
[0124] Step S16: Repeat S12 to S15 until 5 new images are generated for each original image.
[0125] Step S2, build an image classification model: improve the DenseNet121 network. First, reduce the number of model layers and use only three DenseBlock and two Transition layers to reduce the number of parameters and prevent model overfitting; second, use the KAN structure instead of the MLP structure in the fully connected layer to improve the fitting ability of the model.
[0126] Step S3, model training and testing: Use the improved DenseNet model to build a cascade classifier. The first level is a multi-classification DenseNet model that outputs preliminary classification results, and the second level is a binary classification DenseNet model that further subdivides the two types of images with similar textures. The specific operation steps of the cascade classifier are as follows:
[0127] Step S31: using the data-enhanced training set to train an improved multi-classification DenseNet model;
[0128] Step S32: using two types of malicious codes with similar textures in the training set to train an improved binary classification DenseNet model;
[0129] Step S33: input the test set images into the multi-classification DenseNet model to obtain preliminary classification results;
[0130] Step S34: If the preliminary classification result does not belong to the two categories with similar textures, it is directly output as the final result. If it belongs to the two categories with similar textures, the original image is input into the two-classification DenseNet model again for classification to obtain the final result.
[0131] In an exemplary embodiment of the present application, please refer to Figures 6 to 9 To fully verify the performance of the improved DenseNet-based malicious code classification method provided in this application, the following four experiments were designed and configured with the following parameters: the model learning rate was set to 0.002, the number of training rounds was set to 100, the weight decay parameter was set to 0.5, the batch size was set to 64, the loss function was the cross-entropy loss function; and the optimizer was the Adam with Weight Decay Fix (AdamW). The improved DenseNet-based malicious code classification method is hereinafter referred to as CasKDNet.
[0132] Specifically, Experiment 1, Model Performance Experiment
[0133] The changing trends of accuracy and loss value during CasKDNet model training with the number of iterations are as follows: Figure 6 and Figure 7 As shown. Figure 6 It can be observed that in the first 10 training rounds, the model has basically reached a convergence state, indicating a relatively fast convergence speed. As the number of training rounds increases, the model's accuracy on the training set can reach up to 100%, and on the test set, the accuracy can reach up to 99.69%. Figure 7 It can be observed that the minimum loss values on both the training set and the test set are close to 0, indicating that the model has well learned the texture features of each family of malicious code images and can make scientific classification predictions.
[0134] Specifically, Experiment 2, ablation experiment
[0135] To explore the impact of different modules on the performance of the CasKDNet model, three CasKDNet variants were set up for ablation experiments. CasKDNet-1 does not use the cascade classifier, CasKDNet-2 does not use the KAN structure, and CasKDNet-3 does not use image enhancement. The performance of each model on the test set is shown in the following table:
[0136]
[0137] From the data in the table, we can conclude that when the cascade classifier is not used, the model's accuracy, precision, recall, and F1-score decrease by an average of 1.27%; when KAN is not used, the four model indicators decrease by an average of 0.22%; when image enhancement is not performed, the model performance is not significantly affected.
[0138] Specifically, Experiment 3: Comparison with other malicious code classification methods
[0139] To verify the effectiveness of CasKDNet, we compared the CasKDNet model with other malicious code classification models proposed on the Mal img dataset in the past five years. The results are shown in the following table:
[0140]
[0141] From the data in the table, we can see that compared with existing research methods, the CasKDNet model has better results and has advantages in all indicators.
[0142] Specifically, Experiment 4, Model Robustness Experiment
[0143] To verify the robustness of the CasKDNet model, we select all malicious code images correctly classified by the model from the test set of the Mal img dataset. In the context of white-box attacks, we use the Fast Gradient Sign Method (FGSM) and the Iterative Fast Gradient Sign Method (I-FGSM) to generate adversarial samples for the original images, attack the model, and observe the attack success rate. Figure 8 It can be used to reflect the attack success rate of FGSM algorithm and I-FGSM algorithm under different perturbation parameters. Figure 8 It can be seen that as the perturbation parameter increases, the attack success rates of both algorithms show an increasing trend. The FGSM algorithm has the highest attack success rate of 12.7%, indicating a model classification accuracy of 87.3%. The I-FGSM algorithm has the highest attack success rate of 37.5%, indicating a model classification accuracy of 62.5%. This shows that the CasKDNet model has good robustness and can effectively defend against adversarial attacks.
[0144] In addition, in order to explore the contribution of data enhancement method based on FFM image restoration algorithm to model robustness, a comparative experiment was set up. The training set before data enhancement was used for training, and the trained model was attacked. The results are as follows: Figure 9 As shown. Figure 9It can be concluded that when data augmentation is not used, the attack success rates of both algorithms are significantly improved. The highest attack success rate for the FGSM algorithm is 70.3%, and the highest attack success rate for the I-FGSM algorithm is 91.4%. This means that the trained model is basically ineffective and cannot defend against adversarial attacks. It can be seen that data augmentation is the direct reason for the improvement of model robustness.
[0145] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.
[0146] Based on the same inventive concept, the embodiment of the present application also provides a malicious code classification device based on an improved DenseNet for implementing the above-mentioned malicious code classification method based on an improved DenseNet. The implementation solution provided by the device is similar to the implementation solution described in the above-mentioned method. Therefore, the specific limitations of one or more malicious code classification device embodiments based on an improved DenseNet provided below can be found in the above-mentioned limitations on the malicious code classification method based on an improved DenseNet, and will not be repeated here.
[0147] In an exemplary embodiment, Figure 10 As shown, a malicious code classification device 100 based on an improved DenseNet is provided, comprising:
[0148] The malicious code acquisition module 101 can be used to acquire the initial binary malicious code and pre-process the initial binary malicious code to generate an enhanced binary malicious code image.
[0149] The basic model construction module 102 can be used to construct an improved densely connected convolutional network basic model based on dense blocks and converter layers.
[0150] The classification model training module 103 can be used to generate a first classification model and a second classification model based on the improved densely connected convolutional network basic model training.
[0151] The classification result generation module 104 may be configured to generate a final malicious code identification result based on the enhanced binary malicious code image and in combination with the first classification model and the second classification model.
[0152] In one optional embodiment, the malicious code acquisition module 101 may also be used to:
[0153] Convert the initial binary malicious code into a grayscale image and normalize it to a fixed size to generate a binary malicious code grayscale image;
[0154] The data of binary malicious code grayscale image is enhanced based on the Fast Marching Image Inpainting (FFM) algorithm to generate enhanced binary malicious code image.
[0155] In one optional embodiment, the malicious code acquisition module 101 may also be used to:
[0156] Initialize the image to be repaired based on the binary malicious code grayscale image, and obtain the width data and height data of the image to be repaired;
[0157] Initialize the mask matrix based on the width data and height data;
[0158] Divide the binary malicious code grayscale image into multiple rectangular image blocks of the same size;
[0159] Traverse the rectangular image blocks and generate a mask area at a random position in each rectangular image block;
[0160] Traverse each mask area, use the fast marching image restoration algorithm to perform data enhancement, and update the image to be restored and the mask matrix.
[0161] In one optional embodiment, the basic model building module 102 may also be used to:
[0162] constructing a first dense block, a second dense block, and a third dense block based on the dense block;
[0163] A first converter layer and a second converter layer are constructed based on the converter layer.
[0164] In one optional embodiment, the classification result generating module 104 may also be used to:
[0165] Inputting the enhanced binary malicious code image into the first classification model, performing preliminary multi-classification, and generating preliminary classification results;
[0166] Performing texture similarity judgment on the preliminary classification results to generate texture similarity judgment results;
[0167] If the texture similarity determination result is a texture difference, a final malicious code identification result is generated based on the preliminary classification result;
[0168] If the texture similarity determination result is texture similarity, the preliminary classification result is input into the second classification model for texture binary classification to obtain the image texture subdivision classification result, and the final malicious code identification result is generated based on the image texture subdivision classification result.
[0169] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the malicious code classification method based on the improved DenseNet are implemented as described above.
[0170] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.
[0171] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the components described as separate parts may or may not be physically separated, and the parts displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the disclosed solution. A person of ordinary skill in the art can understand and implement it without expending creative work.
[0172] The above-described embodiments merely represent several implementation methods of the embodiments of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that a person skilled in the art may make various modifications and improvements without departing from the concept of the embodiments of the present application, and these modifications and improvements fall within the scope of protection of the embodiments of the present application.
Claims
1. A malicious code classification method based on improved DenseNet, characterized in that: The method comprises: Obtaining an initial binary malicious code, and preprocessing the initial binary malicious code to generate an enhanced binary malicious code image; Improved densely connected convolutional network base model based on dense blocks and converter layers; Generating a first classification model and a second classification model based on the training of the improved densely connected convolutional network basic model; wherein the first classification model is used to generate a preliminary classification result based on the enhanced binary malicious code image; and the second classification model is used to generate an image texture subdivision classification result based on the preliminary classification result; Based on the enhanced binary malicious code image, combined with the first classification model and the second classification model, a final malicious code identification result is generated.
2. The method according to claim 1, characterized in that The obtaining of the initial binary malicious code and preprocessing of the initial binary malicious code to generate an enhanced binary malicious code image includes: Converting the initial binary malicious code into a grayscale image and normalizing it to a fixed size to generate a binary malicious code grayscale image; Data enhancement is performed on the binary malicious code grayscale image based on a fast marching image restoration algorithm to generate the enhanced binary malicious code image.
3. The method according to claim 2, characterized in that The expression of the fast marching image restoration algorithm is: w(p,q)=dir(p,q)·dst(p,q)·lev(p,q) Where p is any point on the boundary of the area to be repaired in the image to be repaired, I(p) is the pixel estimate of point p, Bε(p) is a neighborhood in the known image with point p as the center and ε as the radius, and q is any point in the neighborhood. is the gradient of point q, w(p,q) is the influence weight function of the known pixel point q on the area to be filled, dir(p,q) is the direction factor, dst(p,q) is the geometric distance factor, and lev(p,q) is the level set distance factor.
4. The method according to claim 3, characterized in that The step of performing data enhancement on the binary malicious code grayscale image based on a fast marching image restoration algorithm to generate the enhanced binary malicious code image includes: Initializing the image to be repaired based on the binary malicious code grayscale image, and obtaining width data and height data of the image to be repaired; Initializing a mask matrix based on the width data and the height data; Dividing the image to be repaired into a plurality of rectangular image blocks of the same size; Traversing the rectangular image blocks, generating a mask area at a random position in each rectangular image block; Each of the masked areas is traversed, and data enhancement is performed using the fast marching image restoration algorithm to update the image to be restored and the mask matrix.
5. The method according to claim 1, wherein The improved densely connected convolutional network basic model includes, in order of data flow, an input layer, a convolutional layer, a maximum pooling layer, a first dense block, a first converter layer, a second dense block, a second converter layer, a third dense block, a global average pooling layer, and a Kono network module. The improved densely connected convolutional network basic model is constructed based on the dense block and the converter layer, including: constructing the first dense block, the second dense block, and the third dense block based on the dense block; The first converter layer and the second converter layer are constructed based on the converter layer.
6. The method according to claim 5, characterized in that The expression of the Kono network module is: φ l,j,i (·)=in b ·b(·)+w s ·Spline(·) Where, KAN(x) is the Kono network module, is the lth activation function matrix, φ l,j,i (·) is the activation function connecting the i-th neuron in layer l and the j-th neuron in layer l+1, b(·) and Spline(·) are the basis function and spline function respectively, w b and w s are basis function weights and spline function weights respectively.
7. The method according to any one of claims 1 to 6, characterized in that The first classification model is a multi-classification model, and the second classification model is a binary classification model. The method of generating a final malicious code identification result based on the enhanced binary malicious code image and combining the first classification model and the second classification model includes: Inputting the enhanced binary malicious code image into the first classification model, performing preliminary multi-classification, and generating the preliminary classification result; Performing texture similarity determination on the preliminary classification results to generate a texture similarity determination result; If the texture similarity determination result is a texture difference, generating the malicious code identification final result based on the preliminary classification result; If the texture similarity determination result is texture similarity, the preliminary classification result is input into the second classification model for texture binary classification to obtain the image texture subdivision classification result, and the malicious code identification final result is generated based on the image texture subdivision classification result.
8. A malicious code classification device based on improved DenseNet, characterized in that: The device comprises: A malicious code acquisition module, configured to acquire an initial binary malicious code and pre-process the initial binary malicious code to generate an enhanced binary malicious code image; Basic model building module, used to build an improved densely connected convolutional network basic model based on dense blocks and converter layers; A classification model training module, configured to generate a first classification model and a second classification model based on the improved densely connected convolutional network basic model training; The classification result generation module is used to generate a final malicious code identification result based on the enhanced binary malicious code image in combination with the first classification model and the second classification model.
9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.