Deep learning-based automatic analysis method and system for malicious samples

Abstract

This invention discloses a method and system for automatic analysis of malicious samples based on deep learning, belonging to the field of sample analysis technology. The method includes: sample data integration, sample feature extraction, construction of an automatic malicious sample analysis model, and intelligent analysis. This scheme constructs a network traffic correlation graph, introduces a time decay factor, converts protocol types into embedding vectors, generates protocol-aware attention weights, and weighted concatenation to obtain protocol-aware enhanced features. Protocol-aware gated features are obtained based on gated vectors, and statistical feature vectors at three scales are extracted. Cross-scale interactive features are obtained based on interactive gated vectors. A protocol bias term is introduced to calculate dynamic attention weights, generating encoding vectors. Multi-branch reconstruction is performed, and reconstruction errors are calculated. The malicious probability is predicted based on the encoding vectors to obtain a comprehensive malicious score, which identifies malicious samples and accurately identifies malicious samples in complex network environments, improving the accuracy and reliability of automatic malicious sample analysis.

Description

Technical Field

[0001] This invention belongs to the field of sample analysis technology, specifically referring to a method and system for automatic analysis of malicious samples based on deep learning. Background Technology

[0002] Automated malicious sample analysis methods, based on deep learning technology, mine potential patterns between normal and malicious samples in historical network traffic data to accurately identify malicious sample characteristic patterns and automatically analyze whether real-time network traffic samples are malicious. This provides an intelligent and efficient detection method for network security protection, helping to intercept malicious attacks in a timely manner and ensuring a safe and stable network environment. However, existing automated malicious sample analysis methods suffer from several drawbacks. Traditional feature extraction focuses only on the independent features of individual samples, ignoring the relationships between samples, time decay characteristics, protocol differences, and multi-scale statistical laws. This leads to low accuracy and high false positive rates in malicious sample identification. Furthermore, existing methods suffer from insufficient sample feature mining and utilization, failing to effectively correlate relationships between samples, protocol characteristics, and multi-timescale laws. This results in insufficient ability to characterize and judge malicious sample features, making it difficult to accurately identify malicious samples in complex network environments, leading to missed or false positives, and ultimately failing to reliably support automated analysis needs. Summary of the Invention

[0003] To address the aforementioned issues and overcome the shortcomings of existing technologies, this invention provides an automatic malicious sample analysis method and system based on deep learning. Addressing the problem that existing automatic malicious sample analysis methods often focus solely on the independent features of individual samples through traditional feature extraction, neglecting inter-sample relationships, time decay characteristics, protocol differences, and multi-scale statistical patterns, leading to low accuracy and high false positive rates in malicious sample identification, this solution calculates edge weights based on source IP, destination IP, and protocol-port similarity to construct a network traffic correlation graph. It introduces a time decay factor to obtain dynamic neighbor aggregation features, converts protocol types into embedding vectors, generates protocol-aware attention weights, and weighted concatenation yields protocol-aware enhanced features. Based on protocol neighbor attention, it obtains neighborhood aggregation features, and based on gating vectors, it obtains protocol-aware gating features. Finally, it extracts statistical feature vectors at short-term, medium-term, and long-term scales, providing rich and highly accurate identification methods for complex and unknown malicious samples. The discriminative feature base improves the accuracy of malicious sample identification. Addressing the shortcomings of existing automated malicious sample analysis methods, such as insufficient sample feature mining and utilization, lack of effective correlation between sample relationships, protocol characteristics, and multi-timescale patterns, and inadequate characterization and judgment capabilities for malicious sample features, which leads to difficulty in accurately identifying malicious samples in complex network environments, resulting in missed or false positives and unreliable support for automated analysis needs, this solution obtains cross-scale interactive features based on interactive gating vectors. It introduces protocol bias terms to calculate dynamic attention weights, generates encoding vectors, and reconstructs short-term, medium-term, and long-term statistical features and protocol-aware gating features through four parallel branches. The reconstruction error is weighted and summed according to branch weights, and the malicious probability is predicted based on the encoding vectors. The total reconstruction error and malicious probability are then fused to obtain a comprehensive malicious score, which is used to identify malicious samples and accurately identify malicious samples in complex network environments, thus improving the accuracy and reliability of automated malicious sample analysis.

[0004] The technical solution adopted by this invention is as follows: The automatic analysis method for malicious samples based on deep learning provided by this invention includes the following steps:

[0005] Step S1: Sample data integration;

[0006] Step S2: Sample feature extraction;

[0007] Step S3: Construct an automated analysis model for malicious samples;

[0008] Step S4: Intelligent Analysis.

[0009] Further, in step S1, the sample data integration involves collecting historical network traffic sample data. This historical network traffic sample data includes the start time, duration, protocol type, source IP address, source port, destination IP address, destination port, TCP flags, number of packets, number of bytes, standard deviation of packet length, average packet length, minimum packet length, maximum packet length, standard deviation of arrival time interval, and sample type of the network traffic session. The sample type includes normal samples and malicious samples. The historical network traffic sample data is preprocessed, and the sample type is used as a data label to construct a network traffic sample dataset with data labels.

[0010] Further, in step S2, the sample feature extraction specifically includes the following steps:

[0011] Step S21: Network traffic association graph construction; Based on the network traffic sample dataset, each sample is regarded as a node in the graph. The edge weights between sample nodes are calculated by fusing multi-dimensional association features, and an adjacency matrix is ​​constructed according to the association strength threshold to obtain the network traffic association graph.

[0012] Step S22: Dynamic Neighbor Feature Aggregation; Traverse each sample node in the network traffic association graph, calculate its start time difference with all neighbor sample nodes, obtain the time decay factor, fuse the adjacency relationship and the time decay factor, and weight and aggregate the features of the neighbor sample nodes to obtain the dynamic neighbor aggregated features.

[0013] Step S23: Protocol awareness enhancement; the one-hot vector of the protocol type is transformed into a protocol type embedding vector through the embedding matrix. The protocol awareness attention weights that match the dimensions of the original features are generated through a multilayer perceptron. The original features are weighted element by element. The weighted features are concatenated with the dynamic neighbor aggregated features to obtain the protocol awareness enhanced features.

[0014] Step S24: Gated Neighborhood Enhancement; For sample nodes in the network traffic correlation graph, combine their own and their neighbor sample nodes' protocol type embedding vectors with protocol-aware enhancement features to generate protocol neighbor attention. By weighted aggregation of the protocol-aware enhancement features of neighbor sample nodes, obtain neighborhood aggregation features. After concatenating the neighborhood aggregation features with the original features of the sample nodes, generate fusion intermediate features through linear transformation. Perform linear transformation on the fusion intermediate features and activate them with Sigmoid to obtain a gate vector. Multiply the fusion intermediate features element-wise to obtain protocol-aware gated features.

[0015] Step S25: Multi-scale statistical features; Based on the start time of each network traffic sample data, the sliding time window is divided into three scales: short-term, medium-term and long-term. Within each window, statistical features are extracted from all the samples included to obtain the statistical feature vector of each sample at the three scales.

[0016] Furthermore, in step S3, the construction of the automatic malicious sample analysis model is based on protocol-aware gating features and statistical feature vectors at three scales, and the automatic malicious sample analysis model is constructed according to a neural network; specifically, it includes the following steps:

[0017] Step S31: Cross-protocol dynamic encoder; includes the following steps:

[0018] Step S311: Cross-scale feature interaction; Perform linear transformation on the statistical feature vectors of each scale, calculate the positive interaction gating vectors and negative interaction gating vectors between short-term and medium-term, and between medium-term and long-term scales, and obtain cross-scale interaction features based on the interaction gating vectors.

[0019] Step S312: Protocol-aware dynamic encoding; concatenate the cross-scale interaction features, protocol-aware gating features and protocol type embedding vectors to obtain unified fusion features. Perform linear transformation on the unified fusion features using three independent weight matrices to obtain the query vector, key vector and value vector of the attention mechanism. Introduce the protocol bias term, calculate the dynamic attention weights, and sum the value vectors by weight to obtain the final encoding vector.

[0020] Step S32: Multi-branch reconstruction decoder; including the following steps:

[0021] Step S321: Multi-branch feature reconstruction; The multi-branch reconstruction decoder contains 4 parallel branches, based on the encoding vector, corresponding to the reconstruction of short-term, medium-term, long-term and protocol-aware gated features respectively. Each branch adopts a structure combining deconvolutional layers, batch normalization layers and sigmoid activation functions.

[0022] Step S322: Multi-branch reconstruction error; calculate the reconstruction error of each branch separately, and sum the reconstruction errors according to the weight of each branch to obtain the total reconstruction error;

[0023] Step S33: Malicious sample judgment; Based on the encoding vector, predict the malicious probability, and take half of the sum of the total reconstruction error and the standardized malicious probability as the comprehensive malicious score. Set a score threshold. If the comprehensive malicious score is greater than or equal to the score threshold, the sample is judged as a malicious sample; otherwise, the sample is judged as a normal sample, and the data label is output.

[0024] Furthermore, in step S4, the intelligent analysis involves collecting real-time network traffic sample data, preprocessing the real-time network traffic sample data, extracting protocol-aware gating features and statistical feature vectors at three scales, inputting them into the malicious sample automatic analysis model for processing, and obtaining the sample type corresponding to the real-time network traffic sample data based on the output data labels.

[0025] The present invention provides an automatic malicious sample analysis system based on deep learning, which includes a sample data integration module, a sample feature extraction module, a malicious sample automatic analysis model construction module, and an intelligent analysis module.

[0026] The sample data integration module collects historical network traffic sample data, preprocesses the historical network traffic sample data, constructs a network traffic sample dataset, and sends the data to the sample feature extraction module.

[0027] The sample feature extraction module receives data sent by the sample data integration module, calculates edge weights, constructs a network traffic correlation graph, introduces a time decay factor, obtains dynamic neighbor aggregation features, converts protocol types into embedding vectors, generates protocol-aware attention weights, weights and concatenates them to obtain protocol-aware enhanced features, obtains neighborhood aggregation features based on protocol neighbor attention, obtains protocol-aware gated features based on gated vectors, extracts statistical feature vectors at three scales, and sends the data to the malicious sample automatic analysis model construction module.

[0028] The malicious sample automatic analysis model module receives data sent by the sample feature extraction module, obtains cross-scale interaction features based on the interaction gating vector, introduces the protocol deviation term to calculate dynamic attention weights, generates encoding vectors, reconstructs short-term, medium-term, and long-term statistical features and protocol-aware gating features respectively, reconstructs errors by weighted summation according to branch weights, predicts malicious probability based on encoding vectors, obtains comprehensive malicious score, judges malicious samples, and sends the data to the intelligent analysis module.

[0029] The intelligent analysis module receives data sent by the malicious sample automatic analysis model module, and obtains the sample type corresponding to the real-time network traffic sample data based on the output of the malicious sample automatic analysis model.

[0030] The beneficial effects achieved by the present invention using the above solution are as follows:

[0031] (1) In view of the problem that the existing automatic analysis methods for malicious samples only focus on the independent features of a single sample and ignore the correlation between samples, time decay characteristics, protocol differences and multi-scale statistical laws, resulting in low accuracy and high false judgment rate of malicious sample identification, this scheme calculates the edge weights of source IP, destination IP and protocol-port similarity, constructs network traffic correlation graph, introduces time decay factor to obtain dynamic neighbor aggregation features, accurately captures the clustering and dynamism of samples, reduces the missed judgment caused by isolated sample analysis and improves the accuracy of malicious pattern recognition; converts protocol type into embedding vector, generates protocol-aware attention weight, and obtains protocol-aware enhanced features by weighted concatenation, making feature processing more targeted, effectively distinguishing malicious behavior under different protocols and reducing false judgment caused by protocol differences; obtains neighborhood aggregation features based on protocol neighbor attention, obtains protocol-aware gating features based on gating vector, filters irrelevant neighbors and redundant information, improves feature purity and provides high-quality input for subsequent model construction; extracts statistical feature vectors of short-term, medium-term and long-term scales, provides a rich and highly discriminative feature basis for accurately identifying complex and unknown malicious samples, and improves the accuracy of malicious sample identification.

[0032] (2) To address the problems in existing automatic malicious sample analysis methods, such as insufficient sample feature mining and utilization, failure to effectively correlate relationships between samples, protocol characteristics and multi-timescale patterns, and insufficient ability to characterize and judge malicious sample features, resulting in difficulty in accurately identifying malicious samples in complex network environments, and easy to miss or misjudge, thus failing to reliably support the needs of automatic analysis, this solution obtains cross-scale interactive features based on interactive gating vectors, dynamically integrates complementary information of different scales, and solves the one-sidedness of single-scale analysis; introduces protocol deviation terms to calculate dynamic attention weights and generate encoding vectors, ensuring that the encoding vectors preferentially retain core malicious information related to protocols, and more comprehensively reflect the multi-dimensional features of complex malicious samples; four parallel branches reconstruct short-term, medium-term and long-term statistical features and protocol-aware gating features respectively, ensuring that the encoding vectors do not lose key malicious information, more sensitively capture unknown malicious patterns, and reduce missed judgments; weighted summation of reconstruction errors according to branch weights highlights the contribution of high-value errors to malicious judgment; based on the encoding vector, the malicious probability is predicted, and the total reconstruction error and malicious probability are fused to obtain a comprehensive malicious score, judge malicious samples, accurately identify malicious samples in complex network environments, and improve the accuracy and reliability of automatic malicious sample analysis. Attached Figure Description

[0033] Figure 1 A flowchart illustrating the automatic analysis method for malicious samples based on deep learning provided by this invention;

[0034] Figure 2 A schematic diagram of the deep learning-based automatic malicious sample analysis system provided by the present invention;

[0035] Figure 3 This is a flowchart illustrating step S2;

[0036] Figure 4 This is a flowchart illustrating step S3.

[0037] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. Detailed Implementation

[0038] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0039] In the description of this invention, it should be understood that the terms "upper", "lower", "front", "rear", "left", "right", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0040] Example 1, see Figure 1 The present invention provides an automatic analysis method for malicious samples based on deep learning, which includes the following steps:

[0041] Step S1: Sample data integration; collect historical network traffic sample data, preprocess the historical network traffic sample data, and construct a network traffic sample dataset;

[0042] Step S2: Sample feature extraction; calculate edge weights, construct network traffic association graph, introduce time decay factor, obtain dynamic neighbor aggregation features, convert protocol type into embedding vector, generate protocol-aware attention weights, weighted concatenation to obtain protocol-aware enhanced features, obtain neighborhood aggregation features based on protocol neighbor attention, obtain protocol-aware gated features based on gate vector, and extract statistical feature vectors at three scales.

[0043] Step S3: Construct an automatic analysis model for malicious samples; obtain cross-scale interaction features based on interaction gating vectors, introduce protocol bias terms to calculate dynamic attention weights, generate encoding vectors, reconstruct short-term, medium-term, and long-term statistical features and protocol-aware gating features respectively, sum and reconstruct errors according to branch weights, predict malicious probability based on encoding vectors, obtain comprehensive malicious score, and judge malicious samples.

[0044] Step S4: Intelligent analysis; Based on the output of the malicious sample automatic analysis model, obtain the sample type corresponding to the real-time network traffic sample data.

[0045] Example 2, see Figure 1 This embodiment is based on the above embodiment. In step S1, sample data integration involves collecting historical network traffic sample data, preprocessing the historical network traffic sample data, using the sample type as a data label, and constructing a network traffic sample dataset with data labels.

[0046] The historical network traffic sample data includes the start time, duration, protocol type, source IP address, source port, destination IP address, destination port, TCP flags, number of packets, number of bytes, standard deviation of packet length, average packet length, minimum packet length, maximum packet length, standard deviation of arrival time interval, and sample type of the network traffic session.

[0047] The sample types include normal samples and malicious samples;

[0048] The preprocessing includes missing value handling, encoding, and normalization.

[0049] The missing value handling method involves filling missing values ​​with the median of samples of the same protocol type;

[0050] The encoding process involves using one-hot encoding to convert categorical data into numerical data.

[0051] The standardization process uses a max-min scaling method to unify numerical data to the range [0, 1].

[0052] Example 3, see Figure 1 and Figure 3 This embodiment is based on the above embodiment. In step S2, the sample feature extraction specifically includes the following:

[0053] Step S21: Network Traffic Association Graph Construction; Traditional feature extraction only focuses on the independent features of a single sample, ignoring the relationships between samples. Malicious samples are often not isolated; analyzing only a single sample can easily lead to misjudgment. This step transforms discrete network traffic samples into a structured association graph, quantifying the association strength between samples through edge weights, and filtering out clusters of related samples. Based on the network traffic sample dataset, each sample is considered a node in the graph. The edge weights between sample nodes are calculated through multi-dimensional association feature fusion, and then determined according to the association strength threshold. Construct an adjacency matrix. The value of the adjacency matrix is ​​1 if the edge weight is greater than or equal to the association strength threshold, and 0 otherwise, resulting in a network traffic association graph. The formula used is as follows:

[0054] ;

[0055] ;

[0056] In the formula, and These are the edge weights and protocol-port similarity between the i-th and j-th samples, respectively, and sIP. i and sIP j These are the source IP addresses of the i-th and j-th samples, respectively, dIP i and dIP j These are the destination IP addresses of the i-th and j-th samples, respectively. i and p j These are the protocol types of the i-th and j-th samples, respectively, dP i and dP j These are the destination ports of the i-th sample and the j-th sample, respectively. It is a logical AND operator; It is an indicator function; if the condition inside the parentheses is true, then... ,otherwise ;

[0057] Step S22: Dynamic Neighbor Feature Aggregation; Network traffic has a temporal sequence, and the correlation strength between samples decays over time. However, the correlation graph does not consider the time factor, easily including irrelevant samples across time windows as neighbors, resulting in noise in the aggregated features and reducing the purity of malicious patterns. A time decay factor is introduced to dynamically adjust the weights of neighbor samples, aggregating only the features of neighbors with similar times to the current sample, improving the timeliness and relevance of the aggregated features. Each sample node in the network traffic correlation graph is traversed, and its start time difference with all neighbor sample nodes is calculated to obtain the time decay factor. The adjacency relationship and the time decay factor are fused, and the features of neighbor sample nodes are weighted and aggregated to obtain the dynamic neighbor aggregated features. The formula used is as follows:

[0058] ;

[0059] ;

[0060] In the formula, and These are the start times of sample node i and its neighbor sample node j, respectively. It is the time decay coefficient. , These are elements in the adjacency matrix A. f is the time decay factor between sample node i and its neighbor sample node j. j represents the original features of sample node j, and M is the number of samples in the network traffic sample dataset. It is a smoothing term. , It is the dynamic neighbor aggregation feature of sample node i;

[0061] Step S23: Protocol Awareness Enhancement; The network traffic characteristics of different protocols differ significantly, and the manifestations of malicious behavior are strongly correlated with protocols. However, traditional feature extraction uses a uniform feature processing method for all protocols, failing to highlight protocol-specific malicious patterns. This step transforms protocol types into embedding vectors, generating protocol-specific attention weights to strengthen the dimensions in the original features related to the malicious patterns of that protocol. Simultaneously, dynamic neighbor aggregation features are integrated to form enhanced protocol-aware features. The one-hot vectors of protocol types are transformed into protocol type embedding vectors using an embedding matrix. A multilayer perceptron is used to generate protocol-aware attention weights matching the dimensions of the original features. The original features are then weighted element-wise, and the weighted features are concatenated with the dynamic neighbor aggregation features to obtain the enhanced protocol-aware features. The formulas used are as follows:

[0062] ;

[0063] ;

[0064] In the formula, e i h is the protocol type embedding vector of sample node i. i W is the one-hot vector of the protocol type of sample node i. t It is the embedding matrix, f i These are the original features of sample node i. It is the Sigmoid activation function. It is a multilayer perceptron. It is a feature concatenation operation. It is element-wise multiplication. It is the protocol-aware enhancement feature of sample node i;

[0065] Step S24: Gated Neighborhood Enhancement; Neighbor aggregation does not consider the protocol relevance and feature importance of neighbor samples. Based on protocol embedding and protocol-aware enhancement features, the importance of neighbor samples to the current sample is quantified, irrelevant neighbors are filtered out, and the neighborhood aggregation features are combined with the original features to retain single sample details and neighbor cluster information. Based on the gating vector, effective information in the fused intermediate features is dynamically filtered to suppress noise. For sample nodes in the network traffic correlation graph, protocol neighbor attention is generated by combining their own and their neighbor sample node's protocol type embedding vectors with protocol-aware enhancement features. The protocol-aware enhancement features of neighbor sample nodes are weighted and aggregated to obtain neighborhood aggregation features. After concatenating the neighborhood aggregation features with the original features of the sample nodes, a fused intermediate feature is generated through linear transformation. The fused intermediate feature is then linearly transformed and activated by Sigmoid to obtain a gating vector, which is multiplied element-wise with the fused intermediate feature to obtain the protocol-aware gating feature. The formula used is as follows:

[0066] ;

[0067] ;

[0068] ;

[0069] ;

[0070] In the formula, It is the protocol neighbor attention of sample node i to its neighbor sample node j, e j and e k These are the protocol type embedding vectors for sample node j and sample node k, respectively. and These are the protocol-aware enhancement features of sample node j and sample node k, respectively. T is the transpose operation, and a is the attention parameter vector. It is the set of neighbors of sample node i. , and These are the neighborhood aggregation features, fused intermediate features, and protocol-aware gating features of sample node i, respectively. agg and b agg These are the aggregated weight matrix and the aggregated bias term, W. middle and b middle These are the fusion weight matrix and the fusion bias term, W. g and b g These are the gated weight matrix and the gated bias term, respectively. It is a linear rectified function with leakage. It is a modified linear unit activation function;

[0071] Step S25: Multi-scale statistical features; Malicious samples vary greatly over time, and may only exhibit local patterns in single-sample features, making them difficult to capture using a single time scale. Furthermore, single-sample features cannot reflect the statistical regularity of traffic. Therefore, statistical features are extracted from each sample window (short-term, medium-term, and long-term) to supplement the missing global time dimension of single-sample features. Using the start time of each network traffic sample data as a benchmark, statistical features are extracted according to short-term H... S Mid-term H M and long-term H L The sliding time window is divided into three scales. Within each window, 8-dimensional statistical features are extracted from all included samples, resulting in an 8-dimensional statistical feature vector for each sample across the three scales. These statistical features include the mean number of packets, the standard deviation of the number of packets, the mean number of bytes, the standard deviation of the number of bytes, the mean duration, the maximum packet length, the number of samples, and the mean standard deviation of the arrival time interval. The formulas used are as follows:

[0072] ;

[0073] In the formula, H S H M and H L These represent the sizes of the short-term, medium-term, and long-term sliding time windows, H. S =60 seconds, H M =300 seconds, H L =600 seconds, Is the i-th sample in size H S The 8-dimensional statistical feature vector within the window. , , , , , , and These are, respectively, starting from the start time of the i samples and having a size of H. S The mean of packet count, standard deviation of packet count, mean of byte count, standard deviation of byte count, mean of duration, maximum packet length, number of samples, and mean of arrival time interval for all samples within the window.

[0074] By performing the above operations, this solution addresses the problem in existing automatic malicious sample analysis methods where traditional feature extraction only focuses on the independent features of a single sample, ignoring the correlation between samples, time decay characteristics, protocol differences, and multi-scale statistical laws, leading to low accuracy and high false positive rates in malicious sample identification. This solution constructs a network traffic correlation graph by calculating edge weights based on source IP, destination IP, and protocol-port similarity, introducing a time decay factor to obtain dynamic neighbor aggregation features. This accurately captures the clustering and dynamism of samples, reducing false negatives caused by isolated sample analysis and improving the accuracy of malicious pattern identification. Furthermore, it transforms protocol types into... Embedded vectors are used to generate protocol-aware attention weights, which are then weighted and concatenated to obtain protocol-aware enhanced features. This makes feature processing more targeted, effectively distinguishing malicious behavior under different protocols and reducing misjudgments caused by protocol differences. Neighborhood aggregation features are obtained based on protocol neighbor attention, and protocol-aware gating features are obtained based on gating vectors. Irrelevant neighbors and redundant information are filtered out, improving feature purity and providing high-quality input for subsequent model construction. Statistical feature vectors at short-term, medium-term, and long-term scales are extracted, providing a rich and highly discriminative feature foundation for accurately identifying complex and unknown malicious samples, thus improving the accuracy of malicious sample identification.

[0075] Example 4, see Figure 1 and Figure 4 This embodiment is based on the above embodiment. In step S3, the automatic analysis model for malicious samples is constructed based on protocol-aware gating features and statistical feature vectors at three scales, and the automatic analysis model for malicious samples is constructed according to a neural network. Specifically, it includes the following steps:

[0076] Step S31: Cross-protocol dynamic encoder; includes the following steps:

[0077] Step S311: Cross-scale feature interaction; complementary information may exist between features at different scales. Using them independently will lose their correlation value, and single-scale features may contain noise, easily leading to model misjudgment. Interaction gating vectors are used to achieve bidirectional information fusion of features at different scales, strengthening complementary information and suppressing single-scale noise. A linear transformation is performed on the statistical feature vectors of each scale to unify the dimensions. Forward and reverse interaction gating vectors are calculated between short-term and medium-term, and between medium-term and long-term scales. Cross-scale interactive features are obtained based on these interaction gating vectors. The formulas used are as follows:

[0078] ;

[0079] ;

[0080] ;

[0081] ;

[0082] ;

[0083] ;

[0084] ;

[0085] In the formula, , and These are the i-th sample in size H. S H M and H L The result of linear transformation of the statistical feature vector within the window, W SM and b SM These are the trainable weight matrix and bias term for short- to medium-scale interactions, W. MS and b MS These are the trainable weight matrix and bias term for interactions from medium to short-term scales, W. ML and b ML These are the trainable weight matrix and bias term for interactions from medium to long-term scales, W. LM and b LM These are the trainable weight matrix and bias terms for interactions from long-term to medium-term scales. and These are the positive interaction gating vectors from short-term to medium-term and from medium-term to long-term, respectively. and These are the reverse interaction gating vectors from medium-term to short-term and from long-term to medium-term, respectively. , and These are the short-term, medium-term, and long-term cross-scale interaction features of the i-th sample, respectively.

[0086] Step S312: Protocol-Aware Dynamic Encoding; Traditional encoders use a uniform attention mechanism for all samples without considering protocol type differences. The importance of malicious features varies across protocols during encoding. Uniform encoding leads to the averaging of protocol-specific malicious patterns, reducing the discriminative power of the encoded vector for malicious samples. A protocol bias term is introduced to dynamically adjust attention weights, generating protocol-specific encoded vectors and providing high-quality feature representations for subsequent reconstruction and prediction. Cross-scale interaction features, protocol-aware gating features, and protocol type embedding vectors are concatenated to obtain a unified fusion feature. Three independent weight matrices are used to linearly transform the unified fusion feature, yielding the query vector, key vector, and value vector for the attention mechanism. A protocol bias term is introduced, dynamic attention weights are calculated, and the value vectors are weighted and summed to obtain the final encoded vector. The formulas used are as follows:

[0087] ;

[0088] ;

[0089] ;

[0090] In the formula, yes The result after linear transformation W is the unified fusion feature of the i-th sample. e It is the weight matrix of the protocol deviation term. It is the protocol deviation term, Q t K t and V t These are the components of the query vector, key vector, and value vector at the t-th attention head, respectively, d q It is the dimension of the query vector. It is the dynamic attention weight of the i-th sample at the t-th attention head, t max It refers to the number of attention heads;

[0091] Step S32: Multi-branch reconstruction decoder; including the following steps:

[0092] Step S321: Multi-branch feature reconstruction; Traditional single-branch decoders only reconstruct a single feature, which cannot fully verify the degree to which the encoded vector retains multi-dimensional malicious features. If the encoded vector loses malicious information in a certain dimension, single-branch reconstruction is difficult to detect, resulting in a weak ability of the model to identify malicious samples that depend on that dimension. The core features are reconstructed through four parallel branches to verify the integrity of the encoded vector's retention of multi-dimensional information. The multi-branch reconstruction decoder contains four parallel branches, based on the encoded vector, corresponding to the reconstruction of short-term, medium-term, long-term, and protocol-aware gated features, respectively. Each branch adopts a structure combining deconvolutional layers, batch normalization layers, and a sigmoid activation function. Each branch shares the encoded vector, but the weight and bias parameters of the deconvolutional layer and the scaling and translation parameters of the batch normalization layer are independent of each branch. The formulas used are as follows:

[0093] ;

[0094] In the formula, It is the reconstructed feature of the i-th sample in the short-term branch. and These are the short-term branch deconvolution layer and the batch normalization layer, z i It is the final encoded vector of the i-th sample;

[0095] Step S322: Multi-branch reconstruction error; the reconstruction errors of different branches have different indicative significance for malicious samples. The reconstruction error of long-term statistical features is more valuable for malicious judgment than that of short-term statistical features. If all errors are equally weighted, the contribution of high-value errors will be diluted, reducing the sensitivity of malicious sample identification. Calculate the reconstruction error of each branch and sum them according to their weights to highlight the contribution of high-value errors to malicious judgment; calculate the reconstruction error of each branch separately, and sum the reconstruction errors according to the weights of each branch to obtain the total reconstruction error; the formula used is as follows:

[0096] ;

[0097] ;

[0098] In the formula, , , and It is the reconstruction error of the four branches, ω S ω M ω L and ω F It is the weight of the four branches, ω S =0.35, ω M =0.35, ω L =0.1, ω F =0.2, It is the square of the L2 norm, Err i It is the total reconstruction error of the i-th sample;

[0099] Step S33: Malicious Sample Judgment; In the automatic analysis of malicious samples, relying solely on the probability of malice is susceptible to interference from normal samples with similar malicious characteristics. Relying solely on reconstruction error may result in high errors in normal samples due to feature fluctuations, leading to misclassification of normal samples as malicious. By fusing malicious probability prediction and standardized total reconstruction error, the advantages of both criteria are combined to form a quantitative and interpretable judgment standard, achieving accurate classification of malicious samples. Based on the prediction of malicious probability using the encoding vector, half of the sum of the standardized total reconstruction error and malicious probability is used as the comprehensive malicious score. A score threshold is set; if the comprehensive malicious score is greater than or equal to the score threshold, the sample is judged as a malicious sample; otherwise, the sample is judged as a normal sample, and data labels are output. The formula used is as follows:

[0100] ;

[0101] ;

[0102] in, It is the probability of malice for the i-th sample. and These are the first and second fully connected layers, respectively. U represents the overall malicious score. and They are Err i and The result after standardization.

[0103] By performing the above operations, this solution addresses the shortcomings of existing automated malicious sample analysis methods. These methods suffer from insufficient sample feature mining and utilization, lack of effective correlation between sample relationships, protocol characteristics, and multi-timescale patterns, resulting in inadequate characterization and judgment capabilities for malicious sample features. Consequently, these methods struggle to accurately identify malicious samples in complex network environments, leading to missed or false positives and failing to reliably support automated analysis needs. This solution addresses these issues by using interactive gating vectors to obtain cross-scale interactive features, dynamically integrating complementary information from different scales to overcome the limitations of single-scale analysis. It introduces protocol bias terms to calculate dynamic attention weights and generate encoding vectors, ensuring that the encoding vectors prioritize the retention of protocol-related core malicious information, thus more comprehensively reflecting the multi-dimensional characteristics of complex malicious samples. Four parallel branches reconstruct short-term, medium-term, and long-term statistical features and protocol-aware gating features, ensuring that the encoding vectors do not lose key malicious information, more sensitively capturing unknown malicious patterns, and reducing missed positives. Weighted summation of reconstruction errors based on branch weights highlights the contribution of high-value errors to malicious judgment. Based on the encoding vector, malicious probability is predicted, and the total reconstruction error and malicious probability are fused to obtain a comprehensive malicious score, which is used to judge malicious samples and accurately identify malicious samples in complex network environments, thereby improving the accuracy and reliability of automated malicious sample analysis.

[0104] Example 5, see Figure 1 This embodiment is based on the above embodiment. In step S4, intelligent analysis involves collecting real-time network traffic sample data. The real-time network traffic sample data includes the start time, duration, protocol type, source IP address, source port, destination IP address, destination port, TCP flags, number of packets, number of bytes, standard deviation of packet length, average packet length, minimum packet length, maximum packet length, and standard deviation of arrival time interval for network traffic sessions. After preprocessing the real-time network traffic sample data, protocol-aware gating features and statistical feature vectors at three scales are extracted and input into the malicious sample automatic analysis model for processing. Based on the output data labels, the sample type corresponding to the real-time network traffic sample data is obtained.

[0105] Example 6, see Figure 2 Based on the above embodiments, the present invention provides an automatic malicious sample analysis system based on deep learning, which includes a sample data integration module, a sample feature extraction module, a malicious sample automatic analysis model construction module, and an intelligent analysis module.

[0106] The sample data integration module collects historical network traffic sample data, preprocesses the historical network traffic sample data, constructs a network traffic sample dataset, and sends the data to the sample feature extraction module.

[0107] The sample feature extraction module receives data sent by the sample data integration module, calculates edge weights, constructs a network traffic correlation graph, introduces a time decay factor, obtains dynamic neighbor aggregation features, converts protocol types into embedding vectors, generates protocol-aware attention weights, weights and concatenates them to obtain protocol-aware enhanced features, obtains neighborhood aggregation features based on protocol neighbor attention, obtains protocol-aware gated features based on gated vectors, extracts statistical feature vectors at three scales, and sends the data to the malicious sample automatic analysis model construction module.

[0108] The malicious sample automatic analysis model module receives data sent by the sample feature extraction module, obtains cross-scale interaction features based on the interaction gating vector, introduces the protocol deviation term to calculate dynamic attention weights, generates encoding vectors, reconstructs short-term, medium-term, and long-term statistical features and protocol-aware gating features respectively, reconstructs errors by weighted summation according to branch weights, predicts malicious probability based on encoding vectors, obtains comprehensive malicious score, judges malicious samples, and sends the data to the intelligent analysis module.

[0109] The intelligent analysis module receives data sent by the malicious sample automatic analysis model module, and obtains the sample type corresponding to the real-time network traffic sample data based on the output of the malicious sample automatic analysis model.

[0110] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0111] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention.

[0112] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. A method for automatic analysis of malicious samples based on deep learning, characterized in that: The method includes the following steps: Step S1: Sample data integration; collect historical network traffic sample data, preprocess the historical network traffic sample data, and construct a network traffic sample dataset; Step S2: Sample feature extraction; calculate edge weights, construct network traffic association graph, introduce time decay factor, obtain dynamic neighbor aggregation features, convert protocol type into embedding vector, generate protocol-aware attention weights, weighted concatenation to obtain protocol-aware enhanced features, obtain neighborhood aggregation features based on protocol neighbor attention, obtain protocol-aware gated features based on gate vector, and extract statistical feature vectors at three scales. Step S3: Construct an automatic analysis model for malicious samples; obtain cross-scale interaction features based on interaction gating vectors, introduce protocol bias terms to calculate dynamic attention weights, generate encoding vectors, reconstruct short-term, medium-term, and long-term statistical features and protocol-aware gating features respectively, sum and reconstruct errors according to branch weights, predict malicious probability based on encoding vectors, obtain comprehensive malicious score, and judge malicious samples. Step S4: Intelligent Analysis; Based on the output of the automatic malicious sample analysis model, obtain the sample type corresponding to the real-time network traffic sample data; In step S3, the construction of the automatic malicious sample analysis model is based on protocol-aware gating features and statistical feature vectors at three scales, and the automatic malicious sample analysis model is constructed according to a neural network; specifically, it includes the following steps: Step S31: Cross-protocol dynamic encoder; includes the following steps: Step S311: Cross-scale feature interaction; Perform linear transformation on the statistical feature vectors of each scale, calculate the positive interaction gating vectors and negative interaction gating vectors between short-term and medium-term, and between medium-term and long-term scales, and obtain cross-scale interaction features based on the interaction gating vectors. Step S312: Protocol-aware dynamic encoding; concatenate the cross-scale interaction features, protocol-aware gating features and protocol type embedding vectors to obtain unified fusion features. Perform linear transformation on the unified fusion features using three independent weight matrices to obtain the query vector, key vector and value vector of the attention mechanism. Introduce the protocol bias term, calculate the dynamic attention weights, and sum the value vectors by weight to obtain the final encoding vector. Step S32: Multi-branch reconstruction decoder; including the following steps: Step S321: Multi-branch feature reconstruction; The multi-branch reconstruction decoder contains 4 parallel branches, based on the encoding vector, corresponding to the reconstruction of short-term, medium-term, long-term and protocol-aware gated features respectively. Each branch adopts a structure combining deconvolutional layers, batch normalization layers and sigmoid activation functions. Step S322: Multi-branch reconstruction error; calculate the reconstruction error of each branch separately, and sum the reconstruction errors according to the weight of each branch to obtain the total reconstruction error; Step S33: Malicious sample judgment; Based on the encoding vector, predict the malicious probability, and take half of the sum of the total reconstruction error and the standardized malicious probability as the comprehensive malicious score. Set a score threshold. If the comprehensive malicious score is greater than or equal to the score threshold, the sample is judged as a malicious sample; otherwise, the sample is judged as a normal sample, and the data label is output.

2. The method for automatic analysis of malicious samples based on deep learning according to claim 1, characterized in that: In step S2, the sample feature extraction specifically includes the following steps: Step S21: Network traffic association graph construction; Based on the network traffic sample dataset, each sample is regarded as a node in the graph. The edge weights between sample nodes are calculated by fusing multi-dimensional association features, and an adjacency matrix is ​​constructed according to the association strength threshold to obtain the network traffic association graph. Step S22: Dynamic Neighbor Feature Aggregation; Traverse each sample node in the network traffic association graph, calculate its start time difference with all neighbor sample nodes, obtain the time decay factor, fuse the adjacency relationship and the time decay factor, and weight and aggregate the features of the neighbor sample nodes to obtain the dynamic neighbor aggregated features. Step S23: Protocol awareness enhancement; the one-hot vector of the protocol type is transformed into a protocol type embedding vector through the embedding matrix. The protocol awareness attention weights that match the dimensions of the original features are generated through a multilayer perceptron. The original features are weighted element by element. The weighted features are concatenated with the dynamic neighbor aggregated features to obtain the protocol awareness enhanced features. Step S24: Gated neighborhood enhancement; Step S25: Multi-scale statistical features.

3. The method for automatic analysis of malicious samples based on deep learning according to claim 2, characterized in that: In step S24, the gated neighborhood enhancement is to generate protocol neighbor attention by combining the protocol type embedding vectors of the sample nodes in the network traffic association graph with the protocol-aware enhancement features of the sample nodes themselves and their neighboring sample nodes. The protocol-aware enhancement features of the neighboring sample nodes are weighted and aggregated to obtain the neighborhood aggregation features. The neighborhood aggregation features are concatenated with the original features of the sample nodes and a fusion intermediate feature is generated by linear transformation. The fusion intermediate feature is then linearly transformed and activated by Sigmoid to obtain the gate vector, which is then multiplied element-wise with the fusion intermediate feature to obtain the protocol-aware gated feature.

4. The method for automatic analysis of malicious samples based on deep learning according to claim 2, characterized in that: In step S25, the multi-scale statistical features are based on the start time of each network traffic sample data, and the sliding time window is divided into three scales: short-term, medium-term and long-term. Within each window, statistical features are extracted for all the samples included, and the statistical feature vector of each sample at the three scales is obtained.

5. The method for automatic analysis of malicious samples based on deep learning according to claim 1, characterized in that: In step S1, the sample data integration involves collecting historical network traffic sample data. This historical network traffic sample data includes the start time, duration, protocol type, source IP address, source port, destination IP address, destination port, TCP flags, number of packets, number of bytes, standard deviation of packet length, average packet length, minimum packet length, maximum packet length, standard deviation of arrival time interval, and sample type of the network traffic session. The sample type includes normal samples and malicious samples. The historical network traffic sample data is preprocessed, and the sample type is used as a data label to construct a network traffic sample dataset with data labels.

6. The method for automatic analysis of malicious samples based on deep learning according to claim 1, characterized in that: In step S4, the intelligent analysis involves collecting real-time network traffic sample data, preprocessing the real-time network traffic sample data, extracting protocol-aware gating features and statistical feature vectors at three scales, inputting them into the malicious sample automatic analysis model for processing, and obtaining the sample type corresponding to the real-time network traffic sample data based on the output data labels.

7. A deep learning-based automatic malicious sample analysis system, used to implement the deep learning-based automatic malicious sample analysis method as described in any one of claims 1-6, characterized in that: It includes a sample data integration module, a sample feature extraction module, a malicious sample automatic analysis model building module, and an intelligent analysis module; The sample data integration module collects historical network traffic sample data, preprocesses the historical network traffic sample data, constructs a network traffic sample dataset, and sends the data to the sample feature extraction module. The sample feature extraction module receives data sent by the sample data integration module, calculates edge weights, constructs a network traffic correlation graph, introduces a time decay factor, obtains dynamic neighbor aggregation features, converts protocol types into embedding vectors, generates protocol-aware attention weights, weights and concatenates them to obtain protocol-aware enhanced features, obtains neighborhood aggregation features based on protocol neighbor attention, obtains protocol-aware gated features based on gated vectors, extracts statistical feature vectors at three scales, and sends the data to the malicious sample automatic analysis model construction module. The malicious sample automatic analysis model module receives data sent by the sample feature extraction module, obtains cross-scale interaction features based on the interaction gating vector, introduces the protocol deviation term to calculate dynamic attention weights, generates encoding vectors, reconstructs short-term, medium-term, and long-term statistical features and protocol-aware gating features respectively, reconstructs errors by weighted summation according to branch weights, predicts malicious probability based on encoding vectors, obtains comprehensive malicious score, judges malicious samples, and sends the data to the intelligent analysis module. The intelligent analysis module receives data sent by the malicious sample automatic analysis model module, and obtains the sample type corresponding to the real-time network traffic sample data based on the output of the malicious sample automatic analysis model.

Images