File fragment classification method and device based on hybrid neural network, equipment, product and medium

Abstract

The invention discloses a file fragment classification method and device based on a hybrid neural network, equipment, a product and a medium, and relates to the field of file fragment recognition. The invention constructs a hybrid neural network model which comprises a depth sequence sensing module and a fine-grained feature enhancement module. The model can synchronously capture local time sequence dependence and a global incidence relation, and deep understanding of byte-level sequence features is achieved. Then constructing a training set, performing optimization determination on hyper-parameters trained by the hybrid neural network model by adopting a TPE algorithm, and then training the hybrid neural network model based on the hyper-parameters to obtain a trained hybrid neural network model; and performing file fragment classification by using the trained hybrid neural network model. The file fragment classification method and device can improve the accuracy of file fragment classification.

Description

Technical Field

[0001] The present application relates to the field of file fragment identification, and in particular to a file fragment classification method, device, equipment, product and medium based on a hybrid neural network. Background Art

[0002] In recent years, the application of digital forensics technology in judicial trials, administrative law enforcement, and other fields has become increasingly prominent. This technology provides crucial support for tracing the source of sensitive corporate information leaks, determining facts, and holding people accountable, effectively safeguarding privacy and data protection. However, some insiders conceal their crimes by destroying file systems and formatting hard drives, resulting in frequent file fragmentation. This limits the effectiveness of traditional file system-based forensics methods.

[0003] During digital forensics, forensic investigators often have to deal with incomplete or maliciously damaged digital data. In these cases, they must abandon the available information in the file system structure and instead conduct in-depth analysis of the binary data, reconstructing usable files from fragments for content review. To achieve this goal, analysts need to identify which fragments may belong to the same file. Specifically, they must first classify the fragments by file type, then search for corresponding data blocks within the same data type, and use precise splicing techniques to maximize file recovery. Therefore, accurate file fragment classification is a key step in the file carving process and a fundamental prerequisite for improving the efficiency of forensic analysis.

[0004] Extensive research and technological advancements have significantly driven the development of file fragment classification technology. Diverse feature extraction methods, such as byte frequency analysis, n-gram analysis, and entropy analysis, offer a rich array of options for feature representation. The application of machine learning techniques enables automatic learning and identification of file types from massive amounts of data. Current research has demonstrated promising results by combining neural networks with techniques such as byte offsets, grayscale image conversion, and attention mechanisms. However, these approaches fail to effectively balance computational overhead with classification accuracy, often overlooking the temporal characteristics of byte sequences. Furthermore, a single architecture limits the representational power of features, resulting in inaccurate classification results. Summary of the Invention

[0005] The purpose of this application is to provide a file fragmentation classification method, device, equipment, product and medium based on a hybrid neural network, which can improve file fragmentation.

[0006] To achieve the above objectives, this application provides the following solutions:

[0007] In a first aspect, the present application provides a file fragment classification method based on a hybrid neural network, comprising:

[0008] Constructing a hybrid neural network model; the hybrid neural network model includes: a deep sequence perception module and a fine-grained feature enhancement module; the deep sequence perception module is used to perform sequence perception on file fragments to obtain deep sequence perception vectors of the file fragments; the fine-grained feature enhancement module performs fine-grained feature enhancement on the deep sequence perception vectors to obtain fine-grained feature enhancement vectors of the file fragments, and classifies the fine-grained feature enhancement vectors to obtain classification results;

[0009] Construct a training set;

[0010] Based on the training set, the TPE algorithm is used to optimize and determine the hyperparameters of the hybrid neural network model training;

[0011] Training the hybrid neural network model according to the training set and the hyperparameters to obtain a trained hybrid neural network model;

[0012] File fragment classification is performed using the trained hybrid neural network model.

[0013] In a second aspect, the present application provides a file fragmentation classification device based on a hybrid neural network, wherein the file fragmentation classification device based on a hybrid neural network applies the above-mentioned file fragmentation classification method based on a hybrid neural network, and the file fragmentation classification device based on a hybrid neural network comprises:

[0014] A model construction module is used to construct a hybrid neural network model; the hybrid neural network model includes: a deep sequence perception module and a fine-grained feature enhancement module; the deep sequence perception module is used to perform sequence perception on file fragments to obtain deep sequence perception vectors of the file fragments; the fine-grained feature enhancement module performs fine-grained feature enhancement on the deep sequence perception vectors to obtain fine-grained feature enhancement vectors of the file fragments, and classifies the fine-grained feature enhancement vectors to obtain classification results;

[0015] Training set construction module, used to construct training sets;

[0016] A hyperparameter determination module, configured to optimize and determine the hyperparameters of the hybrid neural network model training using the TPE algorithm based on the training set;

[0017] A model training module is used to train the hybrid neural network model according to the training set and the hyperparameters to obtain a trained hybrid neural network model;

[0018] The classification module is used to classify file fragments using the trained hybrid neural network model.

[0019] In a third aspect, the present application provides a computer device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-mentioned file fragment classification method based on hybrid neural network.

[0020] In a fourth aspect, the present application provides a computer program product, including a computer program, characterized in that when the computer program is executed by a processor, it implements the above-mentioned file fragment classification method based on hybrid neural network.

[0021] In a fifth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned file fragment classification method based on a hybrid neural network.

[0022] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0023] The present application provides a file fragmentation classification method, device, equipment, product and medium based on a hybrid neural network. The present application constructs a hybrid neural network model, including: a deep sequence perception module and a fine-grained feature enhancement module; the model can simultaneously capture local temporal dependencies and global correlation relationships, and achieve a deep understanding of byte-level sequence features. Then, a training set is constructed, and the TPE algorithm is used to optimize and determine the hyperparameters for training the hybrid neural network model. Then, the hybrid neural network model is trained based on the hyperparameters to obtain a trained hybrid neural network model; the trained hybrid neural network model is used to classify file fragments. The present application can improve the accuracy of file fragment classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 A flowchart of a file fragment classification method based on a hybrid neural network provided in one embodiment of the present application;

[0026] Figure 2 A diagram showing the working principle of a hybrid neural network model provided in one embodiment of the present application;

[0027] Figure 3 A diagram showing the working principle of the embedding layer provided in one embodiment of the present application;

[0028] Figure 4A schematic diagram of the structure of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0030] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0031] In an exemplary embodiment, Figure 1 As shown, a file fragment classification method based on a hybrid neural network is provided, comprising the following steps 101 to 105. In which:

[0032] Step 101: construct a hybrid neural network model (hereinafter referred to as the ByteGT model); the hybrid neural network model includes: a deep sequence perception module and a fine-grained feature enhancement module; the deep sequence perception module is used to perform sequence perception on file fragments to obtain deep sequence perception vectors of the file fragments; the fine-grained feature enhancement module performs fine-grained feature enhancement on the deep sequence perception vector to obtain fine-grained feature enhancement vectors of the file fragments, and classifies the fine-grained feature enhancement vectors to obtain classification results.

[0033] Step 102: construct a training set.

[0034] Step 103: Based on the training set, the TPE algorithm is used to optimize and determine the hyperparameters of the hybrid neural network model training.

[0035] Step 104: Train the hybrid neural network model according to the training set and the hyperparameters to obtain a trained hybrid neural network model.

[0036] Step 105: classify file fragments using the trained hybrid neural network model.

[0037] Implementing the above steps 101 to 105 can improve the accuracy of file fragment classification.

[0038] In another exemplary embodiment, the above-mentioned deep sequence perception module includes a binary data extraction module, an embedding layer, a bidirectional GRU layer, a one-dimensional convolution and a residual connection module connected in sequence, wherein the binary data extraction module is used to perform binary data extraction on the file fragments to obtain the original data of the file fragments; the embedding layer is used to embed the original data to obtain an L×E embedding vector; wherein E is the embedding dimension and L is the sequence length of the original data; the bidirectional GRU layer is used to perform sequence perception on the embedding vector to obtain a sequence perception vector; the one-dimensional convolution is used to perform dimensionality reduction on the sequence perception vector to obtain a sequence perception vector after dimensionality reduction; the residual connection module is used to perform residual connection on the embedding vector and the sequence perception vector after dimensionality reduction to obtain a deep sequence perception vector.

[0039] like Figure 2 As shown in Figure 2, the working process of the depth sequence perception module is as follows:

[0040] Step 201: Extract binary data of file fragments.

[0041] Step 202: The original data is embedded through a trainable embedding layer to convert the sequence of length L into a feature vector of L×E to capture its potential correlation characteristics, such as Figure 3 As shown. Specifically:

[0042] A1. Set the embedding vocabulary size and embedding dimension E. Since file fragments are byte sequences with values ​​ranging from 0 to 255, the vocabulary size is set to 256. This design concept is similar to one-hot encoding. The embedding vector dimension parameter E is determined through TPE hyperparameter tuning.

[0043] A2. Index encode each byte in the sequence and assign an index of size V to obtain an L×V index vector.

[0044] A3. Then multiply this index vector with the trainable embedding matrix V×E to finally obtain an L×E dimensional embedding vector.

[0045] Step 203: The embedded feature vector is fed into a bidirectional GRU layer to perceive the temporal information in the sequence. This allows the output vector at each time step t to incorporate both preceding and following contextual information, thereby enhancing the model's ability to capture long-range dependencies in the sequence. The number of layers and hidden dimensions of the bidirectional GRU layer are determined by TPE optimization.

[0046] Step 204: The output of the bidirectional GRU layer is reduced to a feature dimension through a 1-dimensional convolution with a kernel size of 1×1.

[0047] Step 205: Perform a residual connection between the reduced-dimensional vector and the original embedded vector to obtain the output of the deep sequence perception module.

[0048] In another exemplary embodiment, the above-mentioned fine-grained feature enhancement module includes a preprocessing module, a Class token embedding module, and a Transformer encoder that are connected once; the preprocessing module is used to packetize and position-embed the deep sequence perception vector to obtain a packetized vector containing all sub-blocks and their positions; the Class token embedding module is used to add a Class token special vector to the head of the packetized vector to obtain a final embedding vector; the Transformer encoder is used to perform key feature enhancement on the final embedding vector through a channel and spatial attention mechanism to obtain a fine-grained feature enhancement vector, and classify the fine-grained feature enhancement vector to obtain a classification result.

[0049] The Transformer encoder consists of a channel attention module, a spatial attention module, a normalization layer, a multi-layer perceptron, and a classification head connected in sequence;

[0050] The channel attention module is used to perform global average pooling and maximum pooling on the final embedding vector using the following formula to obtain the channel attention machine vector;

[0051] F ' =σ(CB(AMP(F))+CB(AAP(F)))⊙F)

[0052] Among them, F ' is the channel attention vector, σ is the Sigmoid function, CB is the convolution module, AMP and AAP are adaptive maximum pooling and adaptive average pooling respectively, and F is the final embedding vector;

[0053] The spatial attention module is used to perform average pooling and maximum pooling on the channel attention vector in the spatial dimension using the following formula to obtain the spatial attention vector;

[0054] F"=σ(f k ([AvgPool(F ' );MaxPool(F ' )]))

[0055] Among them, F” is the spatial attention vector, f k Indicates the convolution operation with a convolution kernel size of k, AvgPool is average pooling, and MaxPool is maximum pooling;

[0056] The normalization layer and the multi-layer perceptron are used to perform residual stacking on the spatial attention vector and the final embedding vector to obtain a stacked vector;

[0057] The classification head is used to classify the fragmented files based on the stacking vectors to obtain a classification result.

[0058] like Figure 2 The working process of the above-mentioned fine-grained feature enhancement module is as follows:

[0059] Step 301: Divide the obtained output of the depth sequence perception module into multiple sub-blocks (tokens).

[0060] Specifically:

[0061] B1. Preprocess the input sequence. The sequence X of length L is [x1, x2, ..., x L ], and divide it into N fixed-length sub-blocks (patches). The length of the sequence after patching is l = L / N. It should be noted that the number of patches N needs to be divisible by L.

[0062] B2. Patch Embedding. Each sub-block P i =[x i·l ,x i·(l+1) ,...,x (i+1)·(l-1) ] is mapped to a high-dimensional space through linear projection:

[0063] Z i =Linear(P i )∈R d

[0064] Where d is the embedding dimension, determined by TPE optimization. This step converts each sub-block into a learnable vector representation, similar to the image block embedding in ViT.

[0065] B3, Positional Encoding. To preserve the sequence order, add position encoding to each sub-block: E pos ∈R N×d :

[0066] Z=[z1+e1,z2+e2,...,z N +e N ]

[0067] Step 302: Add the Class token special vector to the header of the sub-packetized vector to obtain the final embedding vector F to learn and perceive global information.

[0068] Step 303: Input the vector F into the Transformer encoder, and enhance key features through channel and spatial attention mechanisms to suppress irrelevant information. Specifically:

[0069] C1. First, capture the global information of the channel dimension through global average pooling and maximum pooling of channel attention, use convolution to generate weights, strengthen important channels, and weaken irrelevant channels.

[0070] F ' =σ(CB(AMP(F))+CB(AAP(F)))⊙F)

[0071] Where σ represents the Sigmoid function, CB is the convolution module, AMP and AAP represent adaptive maximum pooling and adaptive average pooling, respectively.

[0072] C2. Then fuse the results of average pooling and maximum pooling in the spatial dimension, generate spatial weights through convolution, focus on key areas, and ignore background noise.

[0073] F"=σ(f k ([AvgPool(F ' );MaxPool(F ' )]))

[0074] Where f k Represents a convolution operation with a kernel size of k.

[0075] C3: Perform multi-layer residual stacking, where the number of layers is obtained by TPE optimization.

[0076] C4. Classify through the classification head to obtain the final category result.

[0077] In another exemplary embodiment, in step 102 above, a training set is constructed based on the FFT-75 data set.

[0078] In another exemplary embodiment, the above step 103 may be implemented using the following steps 401 to 405 .

[0079] Step 401: Initialize the hyperparameters for training the hybrid neural network model.

[0080] Step 402: Input a preset number of file fragment samples in the training set into the classification results of the preset number of file fragment samples output by the hybrid neural network model.

[0081] Step 403: Calculate the kernel density estimation value and EI value of the current iteration based on the classification results of the preset number of file fragment samples using the following formula. Specifically:

[0082] D1. Divide l(x) and g(x) according to the classification results of the current iteration, where l(x) is the best performing group and the rest are g(x).

[0083] D2. Perform kernel density estimation (KDE) on l(x) and g(x) to generate the probability density function. The formula is as follows:

[0084]

[0085] Step 404: Update the hyperparameters and return to the step of inputting a preset number of file fragment samples in the training set into the classification results of a preset number of file fragment samples output by the hybrid neural network model until the maximum number of iterations is reached. Specifically:

[0086] D3. Sample new hyperparameters and select the point with the largest EI value for evaluation. Expected Improvement (EI) is the expected improvement brought by maximizing the hyperparameters. Its formula is as follows:

[0087]

[0088] Among them, the larger the EI value, the more likely the hyperparameter is to be better than the current optimal value.

[0089] D4. Update historical data and repeat until the maximum number of iterations is reached. The maximum number of iterations is set to 20.

[0090] Step 405: Select the optimal hyperparameters based on the kernel density estimate and EI value of each iteration.

[0091] In another exemplary embodiment, before executing step 103, the following settings are performed:

[0092] E1. Construct hyperparameter space;

[0093] E2, the dataset is downsampled and the sampling rate is set to 0.4.

[0094] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0095] 1. The first hybrid architecture to effectively integrate sequence modeling and attention mechanisms for file fragment classification. By combining recurrent neural networks (RNNs) and Transformers in a complementary manner, this model can simultaneously capture local temporal dependencies and global associations, achieving a deep understanding of byte-level sequence features. This advantage stems from the model's hierarchical design, which enables a progressive evolution of feature learning—a leap from local temporal modeling to global semantic perception. This allows the model to abstract and fuse feature representations at different granularities layer by layer.

[0096] 2. An end-to-end neural network framework, eliminating the need for manual preprocessing. Unlike existing methods that rely on grayscale image conversion or manual feature extraction, our model directly processes raw byte data through two innovative modules. These advantages stem from the Deep Sequence Perception Module and the Fine-Grained Feature Enhancement Module. The Deep Sequence Perception Module uses byte embedding and bidirectional gated recurrent units to extract comprehensive temporal dependencies. The Fine-Grained Feature Enhancement Module (FFEM) employs convolutional attention layers to enhance discriminative feature expression while suppressing irrelevant feature variation.

[0097] 3. Extensive experiments were conducted on widely recognized datasets. The results show that the method provided by the embodiment of this application achieved a 6.9% and 7% improvement in classification accuracy in the 512 and 4096 sector size (SS) scenarios, respectively, achieving more competitive performance than other advanced methods. The results are shown in Table 1.

[0098] The model achieves balanced and excellent overall performance in terms of accuracy, parameter size, and inference efficiency. In terms of classification accuracy, ByteGT surpasses all baseline models with an accuracy of 73.3%, improving by 2.2 and 1.4 percentage points, respectively, compared to ByteRCNN (71.1%) and XMP (71.9%), which have similar parameter sizes. In terms of computational efficiency, ByteGT's inference time (28.21ms) is 14 times faster than the traditional RNN-based ByteRCNN (399.57ms) and significantly outperforms XMP (46.32ms). Although its parameter size (4.64M) is slightly higher than that of the lightweight CNN model FiFTy (0.29M), ByteGT achieves a significant accuracy improvement of 7 percentage points, fully demonstrating the effectiveness of its architectural design. The results are shown in Table 2.

[0099] Table 1 Comparison of classification accuracy of the designed method with other baseline methods

[0100]

[0101] Table 2 Performance and complexity comparison of the designed method with other baseline methods

[0102]

[0103] Based on the same inventive concept, embodiments of the present application also provide a hybrid neural network-based file fragmentation classification device for implementing the aforementioned method. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of one or more embodiments of the hybrid neural network-based file fragmentation classification device provided below can be found in the aforementioned limitations of the hybrid neural network-based file fragmentation classification method, and will not be further elaborated here.

[0104] In an exemplary embodiment, a file fragment classification device based on a hybrid neural network is provided, comprising:

[0105] A model construction module is used to construct a hybrid neural network model; the hybrid neural network model includes: a deep sequence perception module and a fine-grained feature enhancement module; the deep sequence perception module is used to perform sequence perception on file fragments to obtain deep sequence perception vectors of file fragments; the fine-grained feature enhancement module performs fine-grained feature enhancement on the deep sequence perception vectors to obtain fine-grained feature enhancement vectors of file fragments, and classifies the fine-grained feature enhancement vectors to obtain classification results.

[0106] Training set construction module, used to construct training sets;

[0107] A hyperparameter determination module, configured to optimize and determine the hyperparameters of the hybrid neural network model training using the TPE algorithm based on the training set;

[0108] A model training module is used to train the hybrid neural network model according to the training set and the hyperparameters to obtain a trained hybrid neural network model;

[0109] The classification module is used to classify file fragments using the trained hybrid neural network model.

[0110] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a file fragment classification method based on a hybrid neural network is implemented.

[0111] Those skilled in the art will understand that Figure 4The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0112] In an exemplary embodiment, a computer device is also provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above-mentioned file fragment classification method embodiment based on hybrid neural network when executing the computer program.

[0113] In an exemplary embodiment, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0114] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, which, when executed by a processor, implements the steps in the above-mentioned embodiment of the file fragment classification method based on a hybrid neural network.

[0115] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0116] The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, and the like.

[0117] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0118] This document uses specific examples to illustrate the principles and implementation methods of this application. The description of the above examples is only intended to help understand the method and core concept of this application. At the same time, for those skilled in the art, based on the concept of this application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A file fragment classification method based on hybrid neural network, characterized in that: The file fragment classification method based on hybrid neural network includes: Constructing a hybrid neural network model; the hybrid neural network model includes: a deep sequence perception module and a fine-grained feature enhancement module; the deep sequence perception module is used to perform sequence perception on file fragments to obtain deep sequence perception vectors of the file fragments; the fine-grained feature enhancement module performs fine-grained feature enhancement on the deep sequence perception vectors to obtain fine-grained feature enhancement vectors of the file fragments, and classifies the fine-grained feature enhancement vectors to obtain classification results; Construct a training set; Based on the training set, the TPE algorithm is used to optimize and determine the hyperparameters of the hybrid neural network model training; Training the hybrid neural network model according to the training set and the hyperparameters to obtain a trained hybrid neural network model; File fragment classification is performed using the trained hybrid neural network model.

2. The file fragment classification method based on hybrid neural network according to claim 1 is characterized in that: The deep sequence perception module includes a binary data extraction module, an embedding layer, a bidirectional GRU layer, a 1-dimensional convolution and a residual connection module connected in sequence; The binary data extraction module is used to extract binary data from the file fragments to obtain the original data of the file fragments; The embedding layer is used to embed the original data to obtain an L×E embedding vector; where E is the embedding dimension and L is the sequence length of the original data; The bidirectional GRU layer is used to perform sequence perception on the embedded vector to obtain a sequence perception vector; The one-dimensional convolution is used to reduce the dimension of the sequence perception vector to obtain a sequence perception vector after dimension reduction; The residual connection module is used to perform a residual connection on the embedding vector and the sequence perception vector after dimensionality reduction to obtain a deep sequence perception vector.

3. The file fragment classification method based on hybrid neural network according to claim 2 is characterized in that: In terms of embedding the original data to obtain an L×E embedding vector, the embedding layer is specifically used to: Perform index encoding on each byte in the original data sequence to obtain an L×V index vector, where V is the dimension of the index. Multiply the index vector by the V×E embedding matrix to obtain an L×E embedding vector.

4. The file fragment classification method based on hybrid neural network according to claim 1 is characterized in that: The fine-grained feature enhancement module includes a one-time connected preprocessing module, a Class token embedding module, and a Transformer encoder; The pre-processing module is used to perform packetization and position embedding on the depth sequence perception vector to obtain a packetization vector containing all sub-blocks and their positions; The Class token embedding module is used to add a Class token special vector to the head of the sub-packet vector to obtain a final embedding vector; The Transformer encoder is used to perform key feature enhancement on the final embedding vector through a channel and spatial attention mechanism to obtain a fine-grained feature enhancement vector, and classify the fine-grained feature enhancement vector to obtain a classification result.

5. The file fragment classification method based on hybrid neural network according to claim 4 is characterized in that: The Transformer encoder includes a channel attention module, a spatial attention module, a normalization layer, a multi-layer perceptron and a classification head connected in sequence; The channel attention module is used to perform global average pooling and maximum pooling on the final embedding vector using the following formula to obtain the channel attention machine vector; F ' =σ(CB(AMP(F))+CB(AAP(F)))⊙F); Among them, F ' is the channel attention vector, σ is the Sigmoid function, CB is the convolution module, AMP and AAP are adaptive maximum pooling and adaptive average pooling respectively, and F is the final embedding vector; The spatial attention module is used to perform average pooling and maximum pooling on the channel attention vector in the spatial dimension using the following formula to obtain the spatial attention vector; F”=σ(f k ([AvgPool(F ' );MaxPool(F ' )])); Among them, F” is the spatial attention vector, f k Indicates the convolution operation with a convolution kernel size of k, AvgPool is average pooling, and MaxPool is maximum pooling; The normalization layer and the multi-layer perceptron are used to perform residual stacking on the spatial attention vector and the final embedding vector to obtain a stacked vector; The classification head is used to classify the fragmented files based on the stacking vectors to obtain a classification result.

6. The file fragment classification method based on hybrid neural network according to claim 1 is characterized in that: Construct a training set, and use the TPE algorithm to optimize and determine the hyperparameters of the hybrid neural network model training based on the training set, specifically including: Initialize the hyperparameters for training the hybrid neural network model; Inputting a preset number of file fragment samples in the training set into the classification results of the preset number of file fragment samples output by the hybrid neural network model respectively; The kernel density estimation value and EI value of the current iteration are calculated using the following formula based on the classification results of the preset number of file fragment samples; Updating the hyperparameters and returning to the step of inputting a preset number of file fragment samples in the training set into the classification results of the preset number of file fragment samples output by the hybrid neural network model until a maximum number of iterations is reached; The optimal hyperparameters are selected based on the kernel density estimate and EI value of each iteration.

7. A file fragment classification device based on a hybrid neural network, characterized in that: The file fragment classification device based on the hybrid neural network applies the file fragment classification method based on the hybrid neural network according to claims 1 to 6, and the file fragment classification device based on the hybrid neural network includes: A model construction module is used to construct a hybrid neural network model; the hybrid neural network model includes: a deep sequence perception module and a fine-grained feature enhancement module; the deep sequence perception module is used to perform sequence perception on file fragments to obtain deep sequence perception vectors of the file fragments; the fine-grained feature enhancement module performs fine-grained feature enhancement on the deep sequence perception vectors to obtain fine-grained feature enhancement vectors of the file fragments, and classifies the fine-grained feature enhancement vectors to obtain classification results; Training set construction module, used to construct training sets; A hyperparameter determination module, configured to optimize and determine the hyperparameters of the hybrid neural network model training using the TPE algorithm based on the training set; A model training module is used to train the hybrid neural network model according to the training set and the hyperparameters to obtain a trained hybrid neural network model; The classification module is used to classify file fragments using the trained hybrid neural network model.

8. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the file fragment classification method based on a hybrid neural network according to any one of claims 1 to 6.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the file fragment classification method based on a hybrid neural network according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the file fragment classification method based on a hybrid neural network according to any one of claims 1 to 6 is implemented.

Images