Malicious code detection method and system based on improved GhostNetV2

Abstract

The invention discloses a malicious code detection method and system based on improved GhostNetV2 and a medium, and relates to the technical field of network information security, the method comprises the following steps: extracting a binary file of an Android software code to be detected, and converting the binary file into an RGB image; performing image enhancement processing on the RGB image by using a local histogram equalization algorithm; converting the RGB image into a single-channel image, and extracting corresponding image texture features; and inputting the image texture features into a trained lightweight malicious software detection model of the improved GhostNetV2 for detection to obtain a detection result. According to the method, image enhancement is carried out through local square equalization, the detection precision is effectively improved, an improved lightweight deep learning model is adopted to detect malicious software, the parameter quantity is reduced, the detection efficiency is improved, and the detection performance and robustness are enhanced.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and in particular to a malicious code detection method and system based on an improved GhostNetV2. Background Art

[0002] Currently, malware detection methods mainly rely on decompilation technology. These methods usually decompile malware and benign software, extract their features, and use artificial intelligence models to train these features to identify and classify malware. However, existing malware detection methods based on decompilation have some significant problems: (1) Malware developers use protective measures such as packing technology and anti-debugging methods to prevent the decompilation process, which leads to decompilation failure; (2) The decompilation process consumes a lot of computing resources and time, especially for complex applications, which is inefficient.

[0003] To overcome these problems, image-based malware detection methods have emerged as an emerging research direction in recent years. This approach converts Android application executable files (such as .dex files) into images, avoiding the complexity of traditional decompilation and improving detection efficiency. Research has shown that images can effectively represent the structure and characteristics of programs, eliminating the need for decompilation and achieving higher efficiency. Currently, image-based malware detection methods have made some progress. For example, Ding et al. converted .dex files into grayscale images and used a convolutional neural network (CNN) for malware classification, achieving an accuracy of 95.6%. Singh et al. proposed a classification method based on gray-level co-occurrence matrices (GLCMs) and local binary pattern (LBP) features, achieving an accuracy of 93.24%. Furthermore, some research has used RGB images to improve malware detection accuracy. RGB images store different code categories in the R, G, and B channels, thereby improving detection accuracy. Wang et al. converted DEX and XML files into RGB images and used multi-class features for classification, achieving an accuracy of 97.84%.

[0004] While these methods have achieved promising results in traditional malware detection, the emergence of adversarial examples (for example, by modifying image textures or attacking the classifier itself to bypass detection) has posed new challenges to image-based malware detection. Malware developers can bypass existing detection models through carefully designed adversarial perturbations, thereby reducing detection accuracy. Therefore, current image-based malware detection techniques still face numerous challenges. In particular, malware developers can generate adversarial examples by subtly adjusting input images, significantly reducing detection effectiveness. To address this challenge, there is an urgent need to develop new detection methods that can not only effectively identify traditional malware but also enhance their resistance to adversarial examples. Summary of the Invention

[0005] The purpose of the present invention is to provide a malicious code detection method, system and medium based on improved GhostNetV2 to solve the technical problems existing in the prior art.

[0006] The present invention is achieved through the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a malicious code detection method based on an improved GhostNetV2, comprising:

[0008] Extract the binary file of the Android software code to be tested and convert it into an RGB image;

[0009] Use the local histogram equalization algorithm to perform image enhancement on RGB images;

[0010] Convert the RGB image into a single-channel image and extract the corresponding image texture features;

[0011] The image texture features are input into a trained improved GhostNetV2 lightweight malware detection model for detection to obtain a detection result.

[0012] In a second aspect, an embodiment of the present invention provides a malicious code detection system based on an improved GhostNetV2, comprising: a code visualization module, an image enhancement module, a texture feature extraction module, and a detection module;

[0013] The code imaging module is used to extract the Android software code binary file to be detected and convert the binary file into an RGB image;

[0014] The image enhancement module is used to perform image enhancement processing on the RGB image using a local histogram equalization algorithm;

[0015] The texture feature extraction module is used to convert the RGB image into a single-channel image and extract the corresponding image texture features;

[0016] The detection module is used to input the image texture features into the trained improved GhostNetV2 lightweight malware detection model for detection to obtain a detection result.

[0017] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the method described in the above embodiment.

[0018] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0019] The embodiments of the present invention provide a malicious code detection method, system, and medium based on an improved GhostNetV2, which effectively improves detection accuracy by performing image enhancement through local histogram equalization, uses an improved lightweight deep learning model to detect malware, reduces the number of parameters, improves detection efficiency, and enhances detection performance and robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the examples. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be considered as limiting the scope. A person of ordinary skill in the art can also derive other relevant drawings based on these drawings without inventive effort. In the drawings:

[0021] Figure 1 A flowchart of a malicious code detection method based on an improved GhostNetV2 provided in the first embodiment of the present invention;

[0022] Figure 2 is the image after local histogram equalization processing;

[0023] Figure 3 The histogram of Android malicious images before and after using the LHE algorithm;

[0024] Figure 4 is the image after Gabor processing;

[0025] Figure 5 This is the improved GhostNetV2 framework diagram;

[0026] Figure 6 It is a schematic diagram of the structure of the Ghost module with CS;

[0027] Figure 7 It is a structural diagram of the ECA module;

[0028] Figure 8 Comparison of detection accuracy between normal images and images using the LHE algorithm;

[0029] Figure 9 Schematic diagram of the confusion matrix of the image using the LHE algorithm based on 20 model analysis;

[0030] Figure 10 This is a diagram showing the visual classification results obtained by the malicious code detection method based on the improved GhostNetV2;

[0031] Figure 11 A structural block diagram of a malicious code detection system based on improved GhostNetV2 provided in another embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with examples and drawings. The exemplary embodiments of the present invention and their descriptions are only used to explain the present invention and are not intended to limit the present invention.

[0033] Example 1

[0034] like Figure 1 As shown, the first embodiment of the present invention provides a malicious code detection method based on improved GhostNetV2, comprising the following steps:

[0035] Extract the binary file of the Android software code to be tested and convert it into an RGB image;

[0036] Use the local histogram equalization algorithm to perform image enhancement on RGB images;

[0037] Convert the RGB image into a single-channel image and extract the corresponding image texture features;

[0038] The image texture features are input into a trained improved GhostNetV2 lightweight malware detection model for detection to obtain a detection result.

[0039] In this embodiment, the binary file of the Android software code is converted into an RGB image, and local histogram equalization (LHE) technology is applied for image enhancement. Then, the Gabor method is used to convert the RGB three-channel image into a single-channel image, ensuring that the detection accuracy of malicious code is not affected while effectively reducing the time overhead of training and prediction. At the same time, the GhostNetV2 model is improved to obtain an improved GhostNetV2 lightweight malware detection model. In this model, the ReLU activation function is replaced with the PReLU activation function, channel transformation is introduced in the Ghost module, and the SE mechanism is modified to adopt a more efficient channel attention mechanism (ECA) to further improve detection performance.

[0040] Specifically, the dataset is collected as follows: This embodiment of the present invention contains a total of 11,552 malware samples, of which 5,978 are from CICMalDroid, 2,453 are from VirusShare, and 3,121 are from Drebin. These malware samples use a variety of obfuscation techniques, including code refactoring, function and variable renaming, junk code insertion, and code encryption and decryption. At the same time, the dataset also includes 10,060 benign samples, of which 4,185 are from Google Play and 5,875 are from CICMalDroid. All downloaded benign samples have been scanned by VirusTotal and Kaspersky.

[0041] Android code visualization: As a core file, classes.dex is an executable file running on the Dalvik virtual machine, containing the entire application's running code and variable space allocation. Therefore, the classes.dex file is converted into an image as input to the malicious code detection algorithm. The specific process is as follows:

[0042] First, the APK file is decompiled to extract the binary classes.dex file. Next, the data sequence in the binary file is read in groups of 8 bits and converted into decimal unsigned integers. These integers are used as grayscale values, ranging from 0 to 255, representing the horizontal pixel values ​​of the image. Finally, based on the interval distribution of grayscale values, they are dynamically mapped to different RGB color spaces. For example, grayscale values ​​0-63 are mapped to cyan, 64-127 are mapped to green, 128-191 are mapped to yellow, and 192-255 are mapped to red.

[0043] While the differences between malicious code, benign samples, and adversarial examples may be subtle at the pixel level, they can be noticeable in local image texture. By enhancing image contrast, we can not only highlight the local texture differences between malicious and benign samples, but also amplify the texture differences between malicious and adversarial samples. This approach helps the classifier better identify and analyze these texture differences, thereby improving the accuracy of malicious code recognition.

[0044] Local Histogram Equalization (LHE) is widely used in image enhancement. This method can effectively improve local contrast and detail in an image. Unlike global histogram equalization, local histogram equalization divides the image into multiple small regions and performs independent histogram equalization on each region, thereby better highlighting the detailed features of each region and achieving the goal of optimizing image quality.

[0045] The main steps of the local histogram equalization are as follows:

[0046] (1) Define local regions: Use an 8×8 sliding window to slide across the original malicious image and divide the malicious image into multiple overlapping small regions. Each small region is called a local window.

[0047] (2) Calculate the histogram: count the pixel values ​​in each window and calculate the number of pixels at each gray level.

[0048] (3) Calculate the cumulative distribution function: According to the histogram, calculate the cumulative distribution function CDF of each gray level in the local area. The formula is as follows:

[0049]

[0050] Where i represents the grayscale level and P(r) represents the probability of the pixel value.

[0051] (4) Calculate the mapping function: Calculate the mapping function for each gray level according to the CDF, and map the original pixel value to the new y value.

[0052] y=round((L-1)*CDF(i)) (2),

[0053] Where L represents the number of gray levels, usually 256.

[0054] (5) Pixel value mapping for the local area: Use the mapping function to map the pixel value of each pixel in the local area to obtain the enhanced pixel value.

[0055] (6) Repeat steps (1) to (5) for the entire image: Apply local histogram equalization to the entire image in a sliding window manner.

[0056] (7) Synthesize malicious image: Integrate the enhanced pixel values ​​of all local areas to obtain the final enhanced image. Figure 2 shown.

[0057] Figure 3 Comparison of histograms of RGB channels in malware images. Figure 3 (a) shows that when local histogram equalization is not used, the distribution of pixel values ​​in the RGB channels is more concentrated, especially in the R channel. Figure 3 (b) shows that after applying local histogram equalization, the distribution of pixel values ​​becomes more uniform and the pixel value range of the image becomes wider.

[0058] Complex textures and adversarial disturbances in images are usually high-frequency information. Although the image after local histogram equalization already has relatively recognizable features. However, for images with complex image textures, local histogram equalization also has some disadvantages. First, due to the overlap of local windows, the computational complexity of processing malicious images is large, so more computing resources are required. Second, the local histogram equalization may introduce some noise or discontinuity, especially at the window boundaries, resulting in more non-adversarial high-frequency information in the image. High-pass filters can help remove low-frequency background interference and highlight these high-frequency features. However, if the complex texture and adversarial disturbances are both in the high-frequency part, a band-pass filter may be more suitable because it can suppress disturbances in a specific frequency range while retaining important details. Therefore, a band-pass filter is used in this embodiment to retain more adversarial high-frequency information (adversarial disturbances) at an appropriate cutoff frequency, so that the classifier can obtain better classification performance.

[0059] This embodiment uses a Gabor filter, which combines the characteristics of a Gaussian filter and a sine wave. It has multi-scale and directional selectivity, and can efficiently extract texture and edge information from malicious images. The Gabor filter is sensitive to specific frequencies and local regions, and has strong noise robustness. Its parameters can be adjusted according to specific needs. Its formula is as follows:

[0060]

[0061] Among them, (x, y) defines the size of the Gabor filter convolution kernel; σ is the standard deviation, which is used to control the smoothness of the filter; the direction parameter θ determines the direction of the Gabor filter; the wavelength parameter λ defines the period of the sine wave component in the Gabor filter; the aspect ratio γ describes the degree of stretching of the Gabor filter elliptical shape; the phase offset ψ can be used to adjust the filter's response to specific phase features in the image. Set (x, y) = (3, 3), σ = 3, θ = 180, λ = 180, γ = 0.5, ψ = 0. The image processed by Gabor technology is as follows Figure 4 shown.

[0062] To further improve the malicious code detection rate and model performance, the present invention improves the GhostNetV2 model in the following three aspects: First, PReLU is used instead of ReLU as the activation function of the entire GhostNetV2 to reduce the generalization error of the model. Second, a channel shuffle is embedded in the second GhostModule of the GhostNetV2 bottleneck module to improve network communication and enhance network performance. Finally, ECA is used instead of SE to further improve the recognition accuracy of the model while reducing network parameters and computational complexity. Figure 5 This is the overall model framework diagram of the improved GhostNetV2.

[0063] (1) GhostNetV2 uses the ReLU activation function, which only allows non-negative activation values, thus limiting the network's nonlinear expression capabilities. To address this limitation, existing related studies have proposed a variety of alternative activation functions. In this study, inspired by these related works, we chose the PReLU activation function. PReLU (Parametric Rectified Linear Unit) is an extended form of ReLU that introduces learnable parameters, thereby allowing negative activation values. The use of the PReLU activation function improves the network's ability to learn complex nonlinear functions, enhances the model's expression capabilities, and has certain anti-overfitting properties, which helps to reduce the model's generalization error. The formula is shown in (4):

[0064] f (x) = max(0, x) + α min(0, x) (4)

[0065] Here, x represents the input value or the input to a neuron in the neural network, and α represents a learnable parameter that controls the slope of the negative input. The function with the larger value of max(0,x) is used to process positive inputs, while the function with the smaller value of min(0,x) is used to process negative inputs.

[0066] (2) In the bottleneck module of GhostNetV2, in order to reduce the amount of computation, only the first Ghost module is run in parallel with the DFC (dynamic filter convolutional neural network). However, in the second Ghost module, the first set of features is generated by ordinary convolution, while the second set of features is obtained by performing cheap operations on the first set. Due to the lack of effective connection between the two sets of feature maps, the learning ability of the model is insufficient. To solve this problem, this embodiment proposes a channel shuffle (CS) method to enhance the information flow between the two sets of feature maps, such as Figure 6 As shown in Figure 2, channel shuffling is relatively computationally inexpensive, primarily involving matrix reshaping, transposition, and concatenation, and its computational complexity is lower than that of convolution operations. Therefore, introducing channel shuffling can improve model performance and information flow without significantly increasing the computational burden.

[0067] (3) Experimental results show that the SE module in the original model does not pay enough attention to the malicious features in the malicious code image. SENet (Squeeze-and-Excitation Network) is a deep learning network architecture based on the channel attention mechanism. SENet (Squeeze-and-Excitation Networks) optimizes local feature representation by adaptively learning channel weights. However, due to the introduction of global pooling operations, SENet usually adjusts the importance of features globally, which may lead to the neglect of local detail information. In addition, the dimensionality reduction operation in SENet may have side effects on the channel attention mechanism. Therefore, this embodiment adopts an attention mechanism for malicious features. Since ECA (Efficient Channel Attention) is an efficient channel attention module, its uniqueness lies in the use of one-dimensional convolution to achieve local cross-channel interaction, avoiding dimensionality reduction and global pooling operations, thereby reducing parameters and computational complexity. The ECA module can intelligently select the size of the convolution kernel, determine the coverage of the interaction, and adapt to feature maps of different scales. While improving the performance of deep convolutional neural networks, the ECA module simplifies the complexity of the model and performs well in tasks such as image classification, target detection, and instance segmentation, bringing significant improvements to the performance and effect of the model. Compared with other channel attention modules such as SENet, the ECA module is simpler and more efficient, involving only a small number of parameters and calculations, such as Figure 7 As shown in the figure, the introduction of the ECA module in the GhostNetV2 model can enhance the model's ability to focus on malicious features, thereby improving the model's performance in malicious code image recognition.

[0068] In order to test the effectiveness of the malicious code detection method based on the improved GhostNetV2 provided by an embodiment of the present invention, multiple experiments were conducted to evaluate its effectiveness.

[0069] The hardware environment of the experiment is as follows: CPU: Intel(R) Xeon(R) Platinum 8481C; memory: 80G; GPU: GeForce RTX 4090D.

[0070] The experimental software environment is: OS is Ubuntu 20.04; Python 3.11.

[0071] Experimental performance indicators: Evaluation is carried out through four indicators, namely precision (Precision), recall (Recall), F1 score (F1-Score), accuracy (Accuracy) and confusion matrix (Confusion Matrix). Precision reflects the classification ability of the detection model, especially its ability to predict malware, rather than all correctly classified samples. Recall measures the ability of the detection model to predict actual malware. Recall refers to the proportion of samples that are correctly identified as malware among all samples that are actually malware. The F1 score is a comprehensive indicator that evaluates the model's ability to predict malware through the harmonic average of precision and recall. Accuracy indicates the overall performance of the detection model in classifying applications as malware or benign software. The confusion matrix intuitively displays the prediction results of the classification model by comparing the true label with the predicted label. The above evaluation indicators are defined as follows:

[0072]

[0073] Accuracy =(TP+TN) / (TP+FP+TN+FN) (8)

[0074] Among them, TP is a true positive example, TN is a true negative example, FP is a false positive example, and FN is a false negative example.

[0075] The evaluation of image enhancement methods includes LHE algorithm evaluation and Gabor technology evaluation.

[0076] (1) LHE algorithm evaluation

[0077] Figure 8This figure shows 20 state-of-the-art deep learning models for detecting Android malware using RGB images with LHE. As can be seen, the use of LHE improves the detection accuracy of all models, ranging from approximately 0.1% to 3.1%. The method used in this example and DenseNet169 achieve the highest accuracy, both at 97.5%.

[0078] Table 1 shows the macro-average and weighted average precision, recall, and F1 score of 20 state-of-the-art deep learning models for malware detection on RGB images using the LHE method. Our model achieves the highest precision, recall, and F1 score, each approximately 0.976. These higher precision and recall demonstrate our model's superior performance in malware detection.

[0079] Table 1 Performance comparison of 20 state-of-the-art deep learning models on local histogram equalization (LHE)

[0080]

[0081]

[0082] Figure 9 This figure shows a confusion matrix for 20 models using the LHE method on RGB images. Experimental results show that the method provided in this example accurately classifies 98% of benign images, with only 2% being misclassified as malware. Furthermore, the method successfully identifies 97% of malware images, with only 3% being misclassified as benign.

[0083] Table 2 evaluates the detection performance of 20 state-of-the-art deep learning models on RGB images processed with LHE_Gabor. The results demonstrate a significant reduction in both training and testing time. This improvement is attributed to the fact that Gabor processing converts RGB images into single-channel images, enabling faster training and inference for deep learning models. Notably, despite the reduction in the number of data channels in the images, detection accuracy improved for almost all models. This demonstrates that using single-channel images does not significantly reduce the learning ability of the models. Applying Gabor processing to LHE not only significantly reduces training and testing time but also further improves detection accuracy.

[0084] Table 2 Performance comparison of 20 most advanced deep learning models on LHE_Gabor

[0085]

[0086]

[0087] In order to evaluate the performance of the lightweight malware detection model of the improved GhostNetV2 in this embodiment in the classification task of malware and benign applications, t-SNE (t-distributed Stochastic Neighbor Embedding) is used to visualize the features extracted from the GAP layer. t-SNE is an effective dimensionality reduction technique that maps high-dimensional data to a low-dimensional space while preserving the relative distance and local structure between data points as much as possible. In this embodiment of the present invention, the t-SNE learning rate is set to 200.0, the early exaggeration factor is set to 12.0, the perplexity is set to 30.0, and the number of iterations is set to 1000. Figure 10 The green dots represent benign applications, and the red dots represent malware. Figure 10 The visualization results clearly show a clear separation between malware and benign applications, with only a small degree of overlap, which indicates that the detection method of the embodiment of the present invention has a strong discriminative ability in classifying these two types of samples.

[0088] To further validate the effectiveness of the improvements to the GhostNetV2 model, we conducted a series of ablation experiments. In these experiments, based on the original GhostNetV2, New_GhostNetV2_1 included only the PReLU activation function, while New_GhostNetV2_2 introduced both CS and PReLU. Subsequently, New_GhostNetV2_3 further added the ECA module based on the aforementioned components. These four models were compared across multiple metrics, including accuracy, precision, F1 score, test time, number of parameters, and number of FLOPs.

[0089] As shown in Table 3, although adding PReLU increases the model parameters by 0.034k, both accuracy and F1 score are superior to the original GhostNetV2, while test time is reduced and the failure rate remains almost unchanged. Adding CS further improves accuracy and F1 score, reduces test time, and maintains the same number of parameters. Finally, introducing ECA slightly increases the number of model parameters, but overall reduces it to 1.5M, achieving the highest accuracy and F1 score, while minimizing test time. Therefore, the detection method of this embodiment of the present invention achieves the best overall performance.

[0090] Table 3 Performance comparison based on GhostNetV2 in ablation experiments

[0091]

[0092] Adversarial Sample Evaluation and Detection:

[0093] The purpose of this experiment is to further evaluate the performance of the improved GhostNetV2-based malicious code detection method described in this embodiment of the present invention in detecting unknown malware. Considering the emergence of new adversarial malware samples, which significantly degrade the classification capabilities of neural network models, 8,246 adversarial malware samples and 7,124 benign samples generated by DCGAN were used as the dataset for the following experiments.

[0094] The accuracy of 20 different models on adversarial sample image detection was compared. RGB images of the application and RGB images using LHE_Gabor were tested to evaluate the effectiveness of the images.

[0095] Experimental results show that all 20 models significantly degraded their accuracy when detecting adversarial RGB images. However, the image enhancement method proposed in this embodiment effectively improved their detection accuracy. Furthermore, the detection model achieved the highest accuracy of 92.0% in detecting these unknown malware samples.

[0096] This embodiment of the present invention provides a malicious code detection method based on an improved GhostNetV2. This method effectively improves detection accuracy through image enhancement using local histogram equalization. It also employs an improved lightweight deep learning model for malware detection, reducing the number of parameters and improving detection efficiency, thereby enhancing detection performance and robustness. Combined with adversarial training and other defense strategies, the detection model can effectively respond to adversarial attacks, thereby improving the accuracy and stability of malware detection.

[0097] Example 2

[0098] like Figure 11 As shown, another embodiment of the present invention provides a malicious code detection system based on an improved GhostNetV2, including: a code visualization module, an image enhancement module, a texture feature extraction module and a detection module; the code visualization module is used to extract the Android software code binary file to be detected and convert the binary file into an RGB image; the image enhancement module is used to perform image enhancement processing on the RGB image using a local histogram equalization algorithm; the texture feature extraction module is used to convert the RGB image into a single-channel image and extract the corresponding image texture features; the detection module is used to input the image texture features into a trained improved GhostNetV2 lightweight malware detection model for detection to obtain a detection result.

[0099] The code visualization module includes an image conversion unit, which is used to read the data sequence in the binary file in groups of 8 bits and convert it into a decimal unsigned integer. The integer is used as a grayscale value with a grayscale value range of 0 to 255. According to the interval distribution of the grayscale value, it is dynamically mapped to different RGB color spaces to obtain an RGB image.

[0100] The enhancement processing unit is used to slide an 8*8 sliding window on the RGB image, divide the RGB image into multiple overlapping local windows, count the pixel values ​​in each window, calculate the number of pixels at each grayscale level, calculate the cumulative distribution function of each grayscale level in the local area based on the histogram, calculate the mapping function of each grayscale level based on the distribution function, use the mapping function to map the pixel values ​​of each pixel in the local area to obtain the enhanced pixel value, apply local histogram equalization to the entire RGB image in a sliding window manner, integrate the enhanced pixel values ​​of all local areas, and obtain the final enhanced image.

[0101] The improved lightweight malware detection model based on GhostNetV2 includes a PreLU activation module, a Ghost module with channel shuffling, and an efficient channel attention module. The PreLU activation module introduces learnable parameters and allows for negative activation values, which improves the model's ability to learn complex nonlinear functions, enhances its expressiveness, and provides some resistance to overfitting, helping to reduce generalization error. The Ghost module with channel shuffling enhances the information flow between two sets of feature maps, improving model performance and information flow without significantly increasing computational overhead. The efficient channel attention module utilizes one-dimensional convolution to achieve local cross-channel interactions, avoiding dimensionality reduction and global pooling operations, thereby reducing parameters and computational overhead. The efficient channel attention module intelligently selects the convolution kernel size, determines the interaction coverage, and adapts to feature maps of different scales, improving the performance of deep convolutional neural networks while simplifying model complexity. The efficient channel attention module enhances the model's ability to focus on malicious features, thereby improving its performance in malware image recognition.

[0102] The present invention provides a malicious code detection system based on an improved GhostNetV2. This system effectively improves detection accuracy through image enhancement using local histogram equalization. It also employs an improved lightweight deep learning model for malware detection, reducing the number of parameters and improving detection efficiency, thereby enhancing detection performance and robustness. Combined with adversarial training and other defense strategies, the detection model can effectively counter adversarial attacks, thereby improving the accuracy and stability of malware detection.

[0103] Example 3

[0104] Another embodiment of the present invention further provides an embodiment of a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the method described in the first embodiment.

[0105] The computer-readable storage medium may be the internal storage unit of the terminal described in the aforementioned embodiment, such as the hard disk or memory of the terminal. The computer-readable storage medium may also be an external storage device of the terminal, such as a plug-in hard disk equipped on the terminal, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Furthermore, the computer-readable storage medium may also include both the internal storage unit of the terminal and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the terminal. The computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

[0106] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the composition and steps of each example according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0107] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the terminals and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0108] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or can be electrical, mechanical or other forms of connection.

[0109] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A malicious code detection method based on improved GhostNetV2, characterized in that: include: Extract the binary file of the Android software code to be tested and convert it into an RGB image; Use the local histogram equalization algorithm to perform image enhancement on RGB images; Convert the RGB image into a single-channel image and extract the corresponding image texture features; The image texture features are input into a trained improved GhostNetV2 lightweight malware detection model for detection to obtain a detection result.

2. The method according to claim 1, characterized in that The specific method of converting the binary file into an RGB image includes: Read the data sequence in the binary file in groups of 8 bits and convert it into a decimal unsigned integer; The integer will be used as the grayscale value, and the grayscale value range is 0 to 255; According to the interval distribution of grayscale values, it is dynamically mapped to different RGB color spaces to obtain an RGB image.

3. The method according to claim 2, characterized in that The specific method of performing image enhancement processing on the RGB image using the local histogram equalization algorithm includes: Use an 8*8 sliding window to slide across the RGB image and divide the RGB image into multiple overlapping local windows; Count the pixel values ​​in each window and calculate the number of pixels at each gray level; According to the histogram, calculate the cumulative distribution function of each gray level in the local area; Calculate the mapping function for each gray level based on the distribution function; Use the mapping function to map the pixel value of each pixel in the local area to obtain the enhanced pixel value; Apply local histogram equalization to the entire RGB image in a sliding window manner; The enhanced pixel values ​​of all local areas are integrated to obtain the final enhanced image.

4. The method according to claim 1, wherein The image texture features are extracted using a Gabor filter.

5. The method according to claim 1, wherein Also includes: Build a lightweight malware detection model that improves GhostNetV2, specifically including: Use PReLU activation function instead of ReLU activation function; In the bottleneck module of GhostNetV2, the first Ghost module is run in parallel with DFC. In the second Ghost module, the first set of features is generated by ordinary convolution, and the second set of features is obtained by performing a cheap operation on the first set. The first and second sets of features are shuffled. An efficient channel attention module is used to intelligently select the size of the convolution kernel and determine the scope of local cross-channel interaction to adapt to feature maps of different scales.

6. A malicious code detection system based on improved GhostNetV2, characterized in that: include: Code visualization module, image enhancement module, texture feature extraction module and detection module; The code imaging module is used to extract the Android software code binary file to be detected and convert the binary file into an RGB image; The image enhancement module is used to perform image enhancement processing on the RGB image using a local histogram equalization algorithm; The texture feature extraction module is used to convert the RGB image into a single-channel image and extract the corresponding image texture features; The detection module is used to input the image texture features into the trained improved GhostNetV2 lightweight malware detection model for detection to obtain a detection result.

7. The system according to claim 6, characterized in that The code visualization module includes an image conversion unit, which is used to read the data sequence in the binary file in groups of 8 bits and convert it into a decimal unsigned integer. The integer is used as a grayscale value with a grayscale value range of 0 to 255. According to the interval distribution of the grayscale value, it is dynamically mapped to different RGB color spaces to obtain an RGB image.

8. The system according to claim 7, characterized in that The image enhancement module includes an enhancement processing unit, which is used to use an 8*8 sliding window to slide on the RGB image, divide the RGB image into multiple overlapping local windows, count the pixel values ​​in each window, calculate the number of pixels at each grayscale level, calculate the cumulative distribution function of each grayscale level in the local area based on the histogram, calculate the mapping function of each grayscale level based on the distribution function, use the mapping function to map the pixel values ​​of each pixel in the local area to obtain enhanced pixel values, apply local histogram equalization to the entire RGB image in a sliding window manner, integrate the enhanced pixel values ​​of all local areas, and obtain the final enhanced image.

9. The system according to claim 6, wherein: The improved GhostNetV2 lightweight malware detection model includes: a PReLU activation function module, a Ghost module with channel shuffling, and an efficient channel attention module.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 5.

Images