Malicious code detection method and system based on improved ghostnetv2

Abstract

The application discloses a malicious code detection method and system based on an improved GhostNetV2 and a medium, relates to the technical field of network information security, and comprises the following steps: extracting an Android software code binary file to be detected, and converting the binary file into an RGB image; performing image enhancement processing on the RGB image by using a local histogram equalization algorithm; converting the RGB image into a single-channel image, and extracting corresponding image texture features; inputting the image texture features into a trained lightweight malicious software detection model of the improved GhostNetV2 for detection, and obtaining a detection result. The method effectively improves detection precision by performing image enhancement through local histogram equalization, adopts the improved lightweight deep learning model to detect malicious software, reduces the parameter quantity, improves detection efficiency, and enhances detection performance and robustness.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, specifically to a malicious code detection method and system based on an improved GhostNetV2. Background Technology

[0002] Currently, malware detection methods mainly rely on decompilation techniques. These methods typically extract features from both malware and benign software by decompiling them, and then use artificial intelligence models to train these features for malware identification and classification. However, existing decompilation-based malware detection methods have some significant problems: (1) Malware developers use protective measures such as packing and anti-debugging techniques to prevent the decompilation process, leading to decompilation failure; (2) The decompilation process requires a large amount of computing resources and time, especially for complex applications, resulting in low efficiency.

[0003] To overcome these problems, image-based malware detection methods have gradually emerged as a new research direction in recent years. This method converts the executable files of Android applications (such as .dex files) into images, thus avoiding the complexity of traditional decompilation and improving detection efficiency. Research shows that images can effectively represent the structure and features of programs without decompilation, resulting in higher efficiency. Currently, image-based malware detection methods have made some progress. For example, Ding et al. converted .dex files into grayscale images and used convolutional neural networks (CNNs) for malware classification, achieving an accuracy of 95.6%; Singh et al. proposed a classification method based on grayscale co-occurrence matrix (GLCM) and local binary pattern (LBP) features, achieving an accuracy of 93.24%. Furthermore, some studies have used RGB images to improve malware detection accuracy. RGB images can store code information of different categories in the R, G, and B channels respectively, thereby improving detection accuracy. Wang et al. converted DEX and XML files into RGB images and used multi-class features for classification, achieving an accuracy of 97.84%.

[0004] While these methods have achieved good results in traditional malware detection, image-based malware detection methods face new challenges with the emergence of adversarial examples (e.g., modifying image textures or attacking the classifier itself to bypass detection). Malware developers can bypass existing detection models through carefully designed adversarial perturbations, thereby reducing detection accuracy. Therefore, current image-based malware detection techniques still have many problems. In particular, malware developers can generate adversarial examples by subtly adjusting the input image, significantly reducing detection effectiveness. To address this challenge, there is an urgent need to develop new detection methods that can not only effectively identify traditional malware but also enhance resistance to adversarial examples. Summary of the Invention

[0005] The purpose of this invention is to provide a malicious code detection method, system, and medium based on an improved GhostNetV2, so as to solve the technical problems existing in the prior art.

[0006] This invention is achieved through the following technical solution:

[0007] In a first aspect, embodiments of the present invention provide a malicious code detection method based on an improved GhostNetV2, comprising:

[0008] Extract the binary file of the Android software code to be detected, and convert the binary file into an RGB image;

[0009] The local histogram equalization algorithm is used to enhance the RGB image.

[0010] Convert the RGB image to a single-channel image and extract the corresponding image texture features;

[0011] The image texture features are input into a trained, improved GhostNetV2 lightweight malware detection model for detection, and the detection results are obtained.

[0012] Secondly, the present invention provides a malicious code detection system based on an improved GhostNetV2, comprising: a code visualization module, an image enhancement module, a texture feature extraction module, and a detection module;

[0013] The code visualization module is used to extract the binary file of the Android software code to be detected and convert the binary file into an RGB image.

[0014] The image enhancement module is used to perform image enhancement processing on RGB images using a local histogram equalization algorithm.

[0015] The texture feature extraction module is used to convert RGB images into single-channel images and extract the corresponding image texture features;

[0016] The detection module is used to input the image texture features into a trained, lightweight malware detection model based on improved GhostNetV2 for detection, and obtain the detection results.

[0017] Thirdly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, the computer program including program instructions, which, when executed by a processor, cause the processor to perform the method described in the above embodiments.

[0018] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0019] This invention provides a malicious code detection method, system, and medium based on an improved GhostNetV2. It effectively improves detection accuracy by enhancing images through local histogram equalization, and uses an improved lightweight deep learning model to detect malware, reducing the number of parameters, improving detection efficiency, and enhancing detection performance and robustness. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of the present invention and should not be considered as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort. In the drawings:

[0021] Figure 1 A flowchart illustrating a malicious code detection method based on an improved GhostNetV2, provided in the first embodiment of the present invention;

[0022] Figure 2 The image is after local histogram equalization.

[0023] Figure 3 Histograms of malicious Android images before and after using the LHE algorithm;

[0024] Figure 4 The image is after Gabor processing;

[0025] Figure 5 Diagram of the improved GhostNetV2 framework;

[0026] Figure 6 A schematic diagram of the Ghost module with CS;

[0027] Figure 7 This is a schematic diagram of the ECA module.

[0028] Figure 8 A comparison chart showing the detection accuracy of ordinary images and images using the LHE algorithm;

[0029] Figure 9 This is a schematic diagram of the confusion matrix of images analyzed using the LHE algorithm based on 20 models;

[0030] Figure 10 This is a schematic diagram of the visualization classification results obtained by the malicious code detection method based on the improved GhostNetV2.

[0031] Figure 11 This is a structural block diagram of a malicious code detection system based on an improved GhostNetV2, provided as another embodiment of the present invention. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments and accompanying drawings. The illustrative embodiments and descriptions of the present invention are only used to explain the present invention and are not intended to limit the present invention.

[0033] Example 1

[0034] like Figure 1 As shown, the first embodiment of the present invention provides a malicious code detection method based on an improved GhostNetV2, which includes the following steps:

[0035] Extract the binary file of the Android software code to be detected, and convert the binary file into an RGB image;

[0036] The local histogram equalization algorithm is used to enhance the RGB image.

[0037] Convert the RGB image to a single-channel image and extract the corresponding image texture features;

[0038] The image texture features are input into a trained, improved GhostNetV2 lightweight malware detection model for detection, and the detection results are obtained.

[0039] In this embodiment, the binary file of the Android software code is converted into an RGB image, and Local Histogram Equalization (LHE) is applied for image enhancement. Next, the Gabor method is used to convert the RGB three-channel image into a single-channel image, ensuring that the detection accuracy of malicious code is not affected, while effectively reducing the time overhead of training and prediction. Simultaneously, the GhostNetV2 model is improved to obtain an improved GhostNetV2 lightweight malware detection model. In this model, the ReLU activation function is replaced with the PReLU activation function, channel transformation is introduced in the Ghost module, and the SE mechanism is modified, employing a more efficient channel attention mechanism (ECA) to further improve detection performance.

[0040] Specifically, regarding the collection of the dataset: This embodiment of the invention includes a total of 11,552 malware samples, of which 5,978 are from CICmalDroid, 2,453 from VirusShare, and 3,121 from Drebin. These malware samples employ various obfuscation techniques, including code refactoring, function and variable renaming, insertion of junk code, and code encryption and decryption. Simultaneously, the dataset also includes 10,060 benign samples, of which 4,185 are from Google Play and 5,875 from CICmalDroid. All downloaded benign samples have undergone security scanning using VirusTotal and Kaspersky.

[0041] Android code visualization: As the core file, classes.dex is an executable file running on the Dalvik virtual machine, containing the entire application's runtime code and variable space allocation. Therefore, the classes.dex file is converted into an image to serve as input for a malicious code detection algorithm. The specific process is as follows:

[0042] First, the APK file is decompiled to extract the binary classes.dex file. Next, the data sequence in the binary file is read in groups of 8 bits and converted to unsigned decimal integers. These integers will be used as grayscale values, ranging from 0 to 255, representing the horizontal pixel values ​​of the image. Finally, based on the distribution of grayscale values, they are dynamically mapped to different RGB color spaces. For example, grayscale values ​​0-63 are mapped to cyan, 64-127 to green, 128-191 to yellow, and 192-255 to red.

[0043] While malicious code, benign samples, and adversarial examples may differ only slightly at the pixel level, they exhibit significant differences in local image texture. Enhancing image contrast can not only highlight the local texture differences between malicious and benign samples but also amplify the texture differences between malicious and adversarial samples. This method helps classifiers better identify and analyze these texture differences, thereby improving the accuracy of malicious code identification.

[0044] Local Histogram Equalization (LHE) is widely used in image enhancement, effectively improving local contrast and detail in images. Unlike global histogram equalization, LHE divides the image into multiple small regions and performs independent histogram equalization on each region, thereby better highlighting the detailed features of each region and optimizing image quality.

[0045] The main steps of creating a local histogram are as follows:

[0046] (1) Define local regions: Use an 8×8 sliding window to slide across the original malicious image to divide the malicious image into multiple overlapping small regions, each of which is called a local window.

[0047] (2) Calculate histogram: Statistically analyze the pixel values ​​in each window and calculate the number of pixels at each gray level.

[0048] (3) Calculate the cumulative distribution function: Based on the histogram, calculate the cumulative distribution function (CDF) of each gray level within the local region, as shown in the formula below:

[0049]

[0050] Where i represents the gray level and P(r) represents the probability of a pixel value.

[0051] (4) Calculate the mapping function: Calculate the mapping function for each gray level based on the CDF, mapping the original pixel value to the new y value.

[0052] y=round((L-1)*CDF(i)) (2),

[0053] Where L represents the number of gray levels, which is usually 256.

[0054] (5) Pixel value mapping of local area: Use the mapping function to map the pixel value of each pixel in the local area to obtain the enhanced pixel value.

[0055] (6) Repeat steps (1) to (5) on the entire image: apply local histogram equalization on the entire image in a sliding window manner.

[0056] (7) Synthesizing malicious images: Integrating the enhanced pixel values ​​of all local regions to obtain the final enhanced image. For example... Figure 2 As shown.

[0057] Figure 3 Histograms of the RGB channels in malware images were compared. Figure 3 (a) shows that when local histogram equalization is not used, the distribution of pixel values ​​in the RGB channels is more concentrated, especially in the R channel. Figure 3 (b) shows that after applying local histogram equalization, the distribution of pixel values ​​becomes more uniform and the range of pixel values ​​in the image becomes wider.

[0058] Complex textures and adversarial perturbations in images are typically high-frequency information. While images after local histogram equalization (HQE) already possess relatively recognizable features, HQE also has some drawbacks for images with complex textures. First, due to overlapping local windows, processing malicious images is computationally intensive, requiring more computational resources. Second, HQE may introduce noise or discontinuities, especially at window boundaries, resulting in more non-adversarial high-frequency information remaining in the image. High-pass filters can help remove low-frequency background interference and highlight these high-frequency features. However, if both complex textures and adversarial perturbations are in the high-frequency range, band-pass filters may be more suitable, as they can suppress perturbations in specific frequency ranges while preserving important details. Therefore, this embodiment uses a band-pass filter to retain more adversarial high-frequency information (adversarial perturbations) at an appropriate cutoff frequency, enabling the classifier to achieve better classification performance.

[0059] This embodiment uses a Gabor filter, which combines the characteristics of a Gaussian filter and a sine wave. It possesses multi-scale and direction selectivity, enabling efficient extraction of texture and edge information from malicious images. The Gabor filter is sensitive to specific frequencies and local regions, while also exhibiting strong noise robustness. Furthermore, its parameters can be adjusted according to specific needs, as shown in the following formula:

[0060]

[0061] Where (x,y) defines the Gabor filter kernel size; σ is the standard deviation, used to control the smoothness of the filter; the direction parameter θ determines the direction of the Gabor filter; the wavelength parameter λ defines the period of the sinusoidal component in the Gabor filter; the aspect ratio γ describes the stretching of the Gabor filter's elliptical shape; and the phase offset ψ can be used to adjust the filter's response to specific phase features in the image. Set (x,y)=(3,3), σ=3, θ=180, λ=180, γ=0.5, ψ=0. The image processed by Gabor technology is shown below. Figure 4 As shown.

[0062] To further improve the malware detection rate and model performance, this invention improves the GhostNetV2 model in the following three aspects: First, PReLU is used instead of ReLU as the activation function for the entire GhostNetV2 model to reduce the model's generalization error. Second, channel shuffle is embedded in the second GhostModule of the GhostNetV2 bottleneck module to improve network communication and performance. Finally, ECA is used instead of SE to further improve the model's recognition accuracy while reducing network parameters and computational cost. Figure 5 This is a diagram of the overall model framework of the improved GhostNetV2.

[0063] (1) GhostNetV2 uses the ReLU activation function, which only allows non-negative activation values, thus limiting the nonlinear expressive power of the network. To address this limitation, existing research has proposed various alternative activation functions. In this study, inspired by these related works, we selected the PReLU activation function. PReLU (Parametric Rectified Linear Unit) is an extension of ReLU, introducing learnable parameters to allow negative activation values. Using the PReLU activation function improves the network's ability to learn complex nonlinear functions, enhances the model's expressive power, and has certain anti-overfitting properties, which helps reduce the model's generalization error. The formula is shown in (4):

[0064] f (x) = max(0, x) + α min(0, x) (4)

[0065] Here, x represents the input value or the input of a neuron in the neural network, and α represents a learnable parameter that controls the slope of the negative input portion. The max(0,x) function takes the larger value to handle positive inputs, and the min(0,x) function takes the smaller value to handle negative inputs.

[0066] (2) In the bottleneck module of GhostNetV2, to reduce computational cost, only the first Ghost module is parallelized with DFC (Dynamic Filter Convolutional Neural Network). However, in the second Ghost module, the first set of features is generated through ordinary convolution, while the second set of features is obtained by performing a cheap operation on the first set. Because there is a lack of effective connection between these two sets of feature maps, the model's learning ability is insufficient. To address this issue, this embodiment proposes a Channel Shuffle (CS) method to enhance the information flow between the two sets of feature maps, such as... Figure 6 As shown, channel shuffling has relatively low computational cost, mainly involving matrix reshaping, transposition, and concatenation, and its computational complexity is lower than that of convolution operations. Therefore, introducing channel shuffling can improve model performance and information flow without significantly increasing the computational burden.

[0067] (3) Experimental results show that the SE module in the original model does not pay enough attention to malicious features in malicious code images. SENet (Squeeze-and-Excitation Network) is a deep learning network architecture based on channel attention mechanism. SENet (Squeeze-and-Excitation Networks) optimizes local feature representation by adaptively learning channel weights. However, due to the introduction of global pooling operations, SENet usually adjusts the importance of features globally, which may lead to the neglect of local details. In addition, the dimensionality reduction operation in SENet may have side effects on the channel attention mechanism. Therefore, this embodiment adopts an attention mechanism for malicious features. Since ECA (Efficient Channel Attention) is an efficient channel attention module, its unique feature is that it uses one-dimensional convolution to realize local cross-channel interaction, avoiding dimensionality reduction and global pooling operations, thereby reducing parameters and computation. The ECA module can intelligently select the size of the convolution kernel, determine the coverage of the interaction, and adapt to feature mappings of different scales. While improving the performance of deep convolutional neural networks, the ECA module simplifies the complexity of the model and performs well in tasks such as image classification, object detection, and instance segmentation, bringing significant improvements to the performance and effect of the model. Compared to other channel attention modules such as SENet, the ECA module is simpler and more efficient, involving only a small number of parameters and calculations, such as... Figure 7 As shown, the GhostNetV2 model enhances its ability to detect malicious features by introducing the ECA module, thereby improving its performance in malicious code image recognition.

[0068] To test the effectiveness of the malicious code detection method based on the improved GhostNetV2 provided in this embodiment of the invention, multiple experiments were conducted to evaluate its effectiveness.

[0069] The hardware environment for the experiment was as follows: CPU: Intel(R) Xeon(R) Platinum 8481C; Memory: 80G; GPU: GeForce RTX 4090D.

[0070] The software environment for the experiment was Ubuntu 20.04 and Python 3.11.

[0071] Performance metrics: Four metrics were used for evaluation: Precision, Recall, F1-Score, Accuracy, and Confusion Matrix. Precision reflects the detection model's classification ability, particularly its ability to predict malware, rather than all correctly classified samples. Recall measures the detection model's ability to predict actual malware. Recall refers to the proportion of samples that are actually malware that are correctly identified as malware. The F1-Score is a composite metric that evaluates the model's ability to predict malware by the harmonic mean of precision and recall. Accuracy represents the overall performance of the detection model in classifying applications as malware or benign software. The Confusion Matrix visually displays the classification model's prediction results by comparing the true labels with the predicted labels. The definitions of the above evaluation metrics are as follows:

[0072]

[0073] Accuracy =(TP+TN) / (TP+FP+TN+FN) (8)

[0074] In this context, TP stands for True Positive, TN stands for True Negative, FP stands for False Positive, and FN stands for False Negative.

[0075] The evaluation of image enhancement methods includes evaluation of the LHE algorithm and evaluation of Gabor techniques.

[0076] (1) Evaluation of LHE algorithm

[0077] Figure 8Twenty state-of-the-art deep learning models for detecting Android malware using RGB images with LHE are shown. It can be seen that using the LHE method improves the detection accuracy of all models, ranging from approximately 0.1% to 3.1%. The method used in this embodiment and DenseNet169 achieve the highest accuracy, both at 97.5%.

[0078] Table 1 presents the macro-average and weighted average precision, recall, and F1 score evaluations of 20 state-of-the-art deep learning models using the LHE method for malware detection on RGB images. Our model achieves the highest values ​​in precision, recall, and F1 score, each approximately 0.976. The higher precision and recall indicate that this model performs exceptionally well in malware detection.

[0079] Table 1. Performance Comparison of 20 State-of-the-Art Deep Learning Models on Local Histogram Equilibrium (LHE)

[0080]

[0081]

[0082] Figure 9 The confusion matrix diagram is shown, demonstrating the detection of RGB images using the LHE method with 20 models. Experimental results show that the method provided in this embodiment can accurately classify 98% of benign images, with only 2% of images misidentified as malware. Furthermore, the method successfully identified 97% of malware images, with only 3% of images misclassified as benign.

[0083] Table 2 evaluates the detection performance of 20 state-of-the-art deep learning models on RGB images processed using LHE_Gabor. The results show a significant reduction in both training and testing time. This improvement is attributed to the fact that RGB images are converted to single-channel images after Gabor processing, allowing deep learning models to train and infer faster on these single-channel images. Notably, despite the reduced number of data channels in the images, the detection accuracy of almost all models improved. This indicates that using single-channel images does not significantly reduce the model's learning ability. Applying Gabor processing to LHE not only effectively saves training and testing time but also further improves detection accuracy.

[0084] Table 2. Performance Comparison of 20 State-of-the-Art Deep Learning Models on LHE_Gabor

[0085]

[0086]

[0087] To evaluate the performance of the lightweight malware detection model based on GhostNetV2 in this embodiment on the classification tasks of malware and benign applications, t-SNE (t-distributed stochastic neighborhood embedding) is used to visualize the features extracted from the GAP layer. t-SNE is an effective dimensionality reduction technique that maps high-dimensional data to a low-dimensional space while preserving the relative distances and local structure between data points as much as possible. In this embodiment, the t-SNE learning rate is set to 200.0, the early exaggeration factor is set to 12.0, the perplexity is set to 30.0, and the number of iterations is set to 1000. Figure 10 Green dots represent benign applications, while red dots represent malware. Figure 10 The visualization results clearly show a distinct separation between malware and benign applications, with only a small degree of overlap, indicating that the detection method of this embodiment has a strong ability to distinguish between these two types of samples.

[0088] To further validate the effectiveness of the improvements to the GhostNetV2 model, a series of ablation experiments were conducted. In these experiments, based on the original GhostNetV2, New_GhostNetV2_1 only included the PReLU activation function, while New_GhostNetV2_2 introduced both CS and PReLU. Subsequently, New_GhostNetV2_3 further added an ECA module to the aforementioned components. These four models were compared using multiple metrics, including accuracy, precision, F1 score, test time, number of parameters, and FLOPs.

[0089] As shown in Table 3, although adding PReLU increased the model parameters by 0.034k, both accuracy and F1 score were superior to the original GhostNetV2, while testing time was reduced and the failure rate remained almost unchanged. Adding CS further improved accuracy and F1 score, reduced testing time, and did not increase the number of parameters. Finally, introducing ECA slightly increased the number of model parameters, but the overall number decreased to 1.5M, achieving the highest accuracy and F1 score with the shortest testing time. Therefore, the detection method in this embodiment of the invention exhibits the best overall performance.

[0090] Table 3. Performance Comparison of GhostNetV2 in Ablation Experiments

[0091]

[0092] Adversarial example evaluation and detection:

[0093] The purpose of the experiment was to further evaluate the performance of the malware detection method based on the improved GhostNetV2 described in the embodiments of the present invention in detecting unknown malware. Considering the emergence of new adversarial malware samples, which significantly reduces the classification ability of neural network models, 8246 adversarial malware samples and 7124 benign samples generated by DCGAN were used as the dataset for the following experiments.

[0094] The accuracy of 20 different models in detecting adversarial sample images was compared. RGB images from the application and RGB images using LHE_Gabor were detected to evaluate image effectiveness.

[0095] Experimental results show that the accuracy of all 20 models significantly decreased when detecting adversarial RGB images. However, the image enhancement method proposed in this embodiment can effectively improve its detection accuracy. Furthermore, the detection model achieved the highest accuracy of 92.0% in detecting these unknown malware samples.

[0096] This invention provides a malware detection method based on an improved GhostNetV2. It effectively improves detection accuracy through image enhancement via local histogram equalization, employs an improved lightweight deep learning model for malware detection, reduces the number of parameters, improves detection efficiency, and enhances detection performance and robustness. Combined with adversarial training and other defense strategies, the detection model can effectively cope with adversarial attacks, thereby improving the accuracy and stability of malware detection.

[0097] Example 2

[0098] like Figure 11 As shown, another embodiment of the present invention provides a malicious code detection system based on an improved GhostNetV2, comprising: a code visualization module, an image enhancement module, a texture feature extraction module, and a detection module; the code visualization module is used to extract the binary file of the Android software code to be detected and convert the binary file into an RGB image; the image enhancement module is used to perform image enhancement processing on the RGB image using a local histogram equalization algorithm; the texture feature extraction module is used to convert the RGB image into a single-channel image and extract the corresponding image texture features; the detection module is used to input the image texture features into a trained lightweight malware detection model based on the improved GhostNetV2 for detection and obtain the detection result.

[0099] The code visualization module includes an image conversion unit, which reads the data sequence in the binary file in groups of 8 bits and converts it into unsigned decimal integers. The integers are then used as grayscale values, with the grayscale values ​​ranging from 0 to 255. Based on the distribution of the grayscale values, the data is dynamically mapped to different RGB color spaces to obtain an RGB image.

[0100] The enhancement processing unit uses an 8x8 sliding window to slide across the RGB image, dividing it into multiple overlapping local windows. It then counts the pixel values ​​within each window, calculates the number of pixels at each grayscale level, calculates the cumulative distribution function of each grayscale level within the local region based on the histogram, and calculates the mapping function for each grayscale level. Using this mapping function, it maps the pixel values ​​of each pixel within the local region to obtain the enhanced pixel values. Finally, it applies local histogram equalization to the entire RGB image using a sliding window approach, integrating the enhanced pixel values ​​from all local regions to obtain the final enhanced image.

[0101] The improved lightweight malware detection model of GhostNetV2 includes: a PreLU activation function module, a Ghost module with channel shuffling, and an efficient channel attention module. The PreLU activation function module introduces learnable parameters, allows negative activation values, improves the model's ability to learn complex nonlinear functions, enhances its expressive power, and provides some resistance to overfitting, helping to reduce the model's generalization error. The Ghost module with channel shuffling enhances the information flow between two sets of feature maps, improving model performance and information flow without significantly increasing computational burden. The efficient channel attention module uses one-dimensional convolution to achieve local cross-channel interaction, avoiding dimensionality reduction and global pooling operations, thus reducing parameters and computational cost. The efficient channel attention module can intelligently select the size of the convolution kernel, determine the coverage of the interaction, and adapt to feature maps of different scales, improving the performance of deep convolutional neural networks while simplifying model complexity. The efficient channel attention module can enhance the model's ability to focus on malicious features, thereby improving the model's performance in malware image recognition.

[0102] This invention provides a malware detection system based on an improved GhostNetV2. It effectively improves detection accuracy through image enhancement via local histogram equalization, employs an improved lightweight deep learning model for malware detection, reduces the number of parameters, improves detection efficiency, and enhances detection performance and robustness. Combined with adversarial training and other defense strategies, the detection model can effectively cope with adversarial attacks, thereby improving the accuracy and stability of malware detection.

[0103] Example 3

[0104] In another embodiment of the present invention, a computer-readable storage medium is also provided, which stores a computer program, the computer program including program instructions that, when executed by a processor, cause the processor to perform the method described in the first embodiment above.

[0105] The computer-readable storage medium can be an internal storage unit of the terminal described in the foregoing embodiments, such as the terminal's hard drive or memory. The computer-readable storage medium can also be an external storage device of the terminal, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the terminal. Furthermore, the computer-readable storage medium may include both internal storage units and external storage devices of the terminal. The computer-readable storage medium is used to store the computer program and other programs and data required by the terminal. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0106] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0107] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the terminals and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0108] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, or may be electrical, mechanical or other forms of connection.

[0109] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A malicious code detection method based on an improved GhostNetV2, characterized in that, include: Extract the binary file of the Android software code to be detected, and convert the binary file into an RGB image; Image enhancement processing of RGB images is performed using a local histogram equalization algorithm; Convert the RGB image to a single-channel image and extract the corresponding image texture features; The image texture features are input into a trained, lightweight malware detection model based on improved GhostNetV2 to obtain detection results. This also includes: building a lightweight malware detection model that improves GhostNetV2, specifically including: Replace the ReLU activation function with the PReLU activation function; In the bottleneck module of GhostNetV2, the first Ghost module is paralleled with DFC. In the second Ghost module, the first set of features is generated by ordinary convolution, and the second set of features is obtained by performing a cheap operation on the first set. The first set of features and the second set of features are then channel-washed. An efficient channel attention module is used to intelligently select the size of the convolution kernel and determine the range of local cross-channel interactions to adapt to feature maps of different scales.

2. The method according to claim 1, characterized in that, The specific method for converting binary files into RGB images includes: Read the data sequence in the binary file in groups of 8 bits and convert it into an unsigned decimal integer; Integers will be used as grayscale values, with grayscale values ​​ranging from 0 to 255; Based on the range distribution of grayscale values, the data is dynamically mapped to different RGB color spaces to obtain an RGB image.

3. The method according to claim 2, characterized in that, The specific method for image enhancement processing of RGB images using the local histogram equalization algorithm includes: Use an 8x8 sliding window to slide across the RGB image, dividing the RGB image into multiple overlapping local windows; Count the pixel values ​​in each window and calculate the number of pixels at each gray level; Based on the histogram, calculate the cumulative distribution function of each gray level within the local region; Calculate the mapping function for each gray level based on the distribution function; Using a mapping function, pixel values ​​are mapped to each pixel within a local region to obtain enhanced pixel values; Apply local histogram equalization across the entire RGB image using a sliding window approach; The enhanced pixel values ​​of all local regions are combined to obtain the final enhanced image.

4. The method according to claim 1, characterized in that, The image texture features were extracted using a Gabor filter.

5. A malicious code detection system based on an improved GhostNetV2, characterized in that, The system for implementing the method as described in any one of claims 1-4 includes: a code visualization module, an image enhancement module, a texture feature extraction module, and a detection module; The code visualization module is used to extract the binary file of the Android software code to be detected and convert the binary file into an RGB image. The image enhancement module is used to perform image enhancement processing on RGB images using a local histogram equalization algorithm. The texture feature extraction module is used to convert RGB images into single-channel images and extract the corresponding image texture features; The detection module is used to input the image texture features into a trained, improved GhostNetV2 lightweight malware detection model for detection, and obtain the detection results. The improved lightweight malware detection model for GhostNetV2 includes: a PReLU activation function module, a Ghost module with channel shuffling, and an efficient channel attention module.

6. The system according to claim 5, characterized in that, The code visualization module includes an image conversion unit, which reads the data sequence in the binary file in groups of 8 bits and converts it into unsigned decimal integers. The integers are then used as grayscale values, with the grayscale values ​​ranging from 0 to 255. Based on the distribution of the grayscale values, the data is dynamically mapped to different RGB color spaces to obtain an RGB image.

7. The system according to claim 6, characterized in that, The image enhancement module includes an enhancement processing unit. This unit uses an 8x8 sliding window to divide the RGB image into multiple overlapping local windows. It then statistically analyzes the pixel values ​​within each window, calculates the number of pixels at each grayscale level, calculates the cumulative distribution function of each grayscale level within the local region based on the histogram, calculates the mapping function for each grayscale level based on the distribution function, and uses the mapping function to map the pixel values ​​of each pixel within the local region to obtain enhanced pixel values. Finally, it applies local histogram equalization to the entire RGB image using a sliding window approach, and integrates the enhanced pixel values ​​from all local regions to obtain the final enhanced image.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, the computer program including program instructions that, when executed by a processor, cause the processor to perform the method as described in any one of claims 1-4.

Images