Method for evaluating robustness of an antivirus based on detection of a boundary prediction

Abstract

A method for evaluating the robustness of antivirus software based on boundary detection prediction, which realizes efficient quantification through three innovative modules: the boundary detection engine uses dynamic mask technology and iterative dichotomy search algorithm to accurately locate byte-level boundary points and expand key context areas, and outputs labeled data set after intelligent merging; the boundary prediction model is based on multi-scale convolutional neural network, which outputs full-file domain probability tensor through feature pyramid construction, double attention mechanism and improved loss function; the robustness quantifier generates adversarial samples using the predicted high-risk bytes, verifies the attack success rate and generates quantification indicators, and visually displays the overlap between predicted and real boundary areas through visual boundary probability distribution map. Through testing, the evaluation speed of this method reaches 3.0 seconds / sample, which is 6.5 times faster than traditional methods, the boundary prediction rate is about 90%, the disturbance rate is only 0.1%, the accurate full-coverage evaluation is realized, and finally the structured report is generated, which provides accurate guidance for boundary reinforcement of antivirus software detection.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a robustness evaluation method for antivirus software based on detection boundary prediction, used to quantitatively analyze the vulnerability of static detection boundaries of antivirus software. Background Technology

[0002] With the explosive growth in the number of malware, antivirus software, as a key line of defense for cybersecurity, faces unprecedented challenges in its detection capabilities and robustness. According to the latest statistics from AV-TEST 2024, the total number of malware samples worldwide has exceeded 13 billion, with 450,000 new samples added daily. Meanwhile, the average loss from a single cyberattack is as high as $2.73 million, posing a serious threat to personal and corporate security. Although AI-driven malware detection technologies have demonstrated detection rates exceeding 90% in laboratory environments, they suffer from significant limitations in real-world deployments: high false positive rates and ongoing maintenance costs restrict their application in real-world scenarios. Therefore, current mainstream antivirus software still widely relies on rule-based (such as signature matching and heuristic analysis) static detection mechanisms, which offer advantages such as low false positives and high efficiency. However, recent research has shown that such detection methods have the following inherent flaws: First, antivirus software detection rules are fragmented, with detection boundaries consisting of non-contiguous byte segments, meaning that modifications to local key bytes can undermine the rule's effectiveness; second, the unlimited query capability of antivirus software allows attackers to pinpoint key byte sequences that violate the rules using simple binary search; and finally, the advancements in artificial intelligence have increased the risk of antivirus software rule models being stolen, making the prediction of key byte sequences using deep learning models a new type of adversarial attack.

[0003] Therefore, antivirus software vendors urgently need to design robustness assessment tools for antivirus software to address this vulnerability and strengthen the detection boundaries of antivirus software based on assessment feedback. However, traditional assessment methods have the following drawbacks: First, existing assessment systems suffer from a lack of dimensionality; traditional methods only focus on macro-level detection rate indicators, such as detection rate, but fail to reveal the inherent vulnerabilities of detection rules. Second, their localization capabilities are fundamentally flawed; traditional black-box assessment methods only return binary results of "1 / 0," failing to reveal the specific reasons for bypassing or the spatial distribution characteristics of boundary points. Finally, the assessment coverage is severely insufficient; faced with variants of malware, attackers may modify bytes at any segment location in the sample, and existing injection-based attack methods typically only modify the header, code segment, and append segment, resulting in insufficient assessment coverage. Summary of the Invention

[0004] To address the shortcomings of traditional evaluation methods, such as limited evaluation dimensions, weak localization capabilities, and insufficient coverage of evaluation areas, this invention proposes a boundary prediction-based robustness evaluation method for antivirus software. This method utilizes a novel detection boundary prediction and breakthrough approach to verify the robustness of antivirus software. Specifically, this invention compensates for the limitations of traditional methods' limited evaluation dimensions by utilizing boundary region detection rate; enhances localization capabilities through interpretable design; and overcomes the deficiency of insufficient coverage by predicting the entire file domain.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] This invention consists of three modules: a detection boundary detection engine, a detection boundary prediction model, and a robust quantizer. The detection boundary is composed of multiple discrete rules (either feature code matching or heuristic rules). Overcoming the detection boundary of antivirus software requires precisely locating the key bytes that can invalidate the rules, i.e., the boundary points. The context bytes of these boundary points constitute the boundary region.

[0007] The boundary detection engine uses dynamic masking technology and an iterative binary search algorithm to accurately locate byte-level boundary points that cause detection failure. It outputs a labeled boundary region dataset, containing the coordinates of boundary points and their context extension regions.

[0008] The boundary prediction model is based on a deep multi-scale network prediction model trained on a boundary region dataset, outputting a byte-level probability tensor. This tensor quantifies the boundary risk value of each byte and marks high-risk boundary bytes that exceed a preset threshold.

[0009] The robustness quantizer processes the predicted tensor and boundary region mask to verify the attack success rate, thereby quantifying the robustness of antivirus software against adversarial attacks at the detection boundary. Furthermore, the robustness quantizer can visualize the predicted tensor of the boundary prediction model, allowing security personnel to analyze and strengthen the detection boundary.

[0010] The antivirus software robustness evaluation method based on boundary prediction includes the following steps:

[0011] Step 1: The boundary detection engine takes a malware sample library as input, uses dynamic masking technology and an iterative binary search algorithm to locate single-byte-level boundary points, and outputs a labeled boundary region dataset.

[0012] Step 2: The boundary prediction model takes the boundary region dataset as input, extracts global features of the file through a multi-scale convolutional neural network, and outputs a byte-level probability tensor of the entire file domain.

[0013] Step 3: The robust quantizer module takes the byte-level probability tensor of the boundary prediction model as input and outputs the attack success rate of the model's predicted attack and a visualized boundary probability distribution map.

[0014] Furthermore, step 1 specifically includes the following steps:

[0015] Step 1.1: Malicious sample structure analysis. Perform static format analysis on the input malicious software sample to identify key structural sections of the executable file, in order to prepare for subsequent modification operations.

[0016] Step 1.2: Dynamic mask iterative detection. Use a binary search algorithm to find the key locations of antivirus software rule detection and determine the final key detection boundary points. After locating the first boundary point, start the verification process. Expand the initially located basic boundary point area in both forward and backward directions to cover the key context bytes necessary for the rule to take effect. Set the first key area to zero and start searching for the next new boundary point and its associated key area again until all rules in the sample become invalid.

[0017] Step 1.3: Boundary region optimization. After sorting all detected boundary regions in ascending order by file offset, perform intelligent merging: calculate whether adjacent regions overlap. If there is overlap between intervals, merge them into continuous regions. At the same time, filter out ultra-small regions to eliminate noise interference.

[0018] Step 1.4: Construct sample boundary labels. After all samples have obtained all corresponding boundary regions, construct a label vector of the same length as the sample, and label all boundary regions with 1 and the rest with 0. All samples and corresponding labels will be divided into training set and test set. The training set is used for training the prediction model in step 2, and the test set is used for robustness evaluation in step 3.

[0019] Furthermore, step 2 specifically includes the following steps:

[0020] Step 2.1, Byte Embedding and Position Encoding: Each byte value of the input training sample is mapped to an 8-dimensional dense vector through a learnable embedding layer. At the same time, a trainable position encoding matrix is ​​introduced. The two are added together to generate a position-aware embedding representation E, which explicitly preserves the absolute offset of the byte in the file, providing a spatial context basis for subsequent convolution operations.

[0021] Step 2.2: Multi-scale convolutional feature extraction. Three independent convolutional paths with different scales are used to process the embedded features in parallel. The three outputs are activated by non-linear transformations to form a feature pyramid with decreasing resolution but increasing semantic level. While preserving local details, global contextual association is established, providing a multi-granular feature base for subsequent attention fusion.

[0022] Step 2.3, Feature Alignment and Fusion: To address the resolution differences of multi-scale feature maps, nearest neighbor interpolation is used to align the three output features to the maximum dimension. The aligned feature maps are then stitched together along the channel axis to form a fusion of macroscopic, mesoscopic, and microscopic features. This operation breaks through the limitations of single-scale receptive fields, achieves cross-level semantic complementarity, and provides rich input sources for the attention mechanism.

[0023] Step 2.4: Dual Attention Enhancement. A collaborative mechanism of channel and spatial attention is adopted to strengthen feature focusing: Channel attention extracts channel importance through global average pooling, learns the weight distribution through a fully connected layer, and generates a channel mask weighted feature map, which significantly improves the response of rule-sensitive channels; Spatial attention fuses max / average pooling features and generates a spatial weight map through convolution, dynamically focusing on high-risk file offset regions. The two are collaboratively enhanced through element-wise multiplication, which significantly strengthens the features of boundary regions.

[0024] Step 2.5, Upsampling and Probability Prediction: Spatial resolution is gradually restored through three levels of transposed convolution: the feature map length is doubled and the number of channels is halved at each level. An activation function is used to ensure gradient stability. The decoded high-dimensional features are processed by the boundary prediction head: first, a convolution is used to extract the local context, and after batch normalization and activation, another convolution is used to compress the channel dimension. Finally, a byte-level probability tensor is output. Linear interpolation strictly aligns the output to the original file length to ensure that each byte obtains an accurate risk score.

[0025] Step 2.6, Loss Function and Optimization: To address the sample imbalance problem where boundary points account for a very low percentage (<1%) of the sample byte sequence, a two-pronged loss strategy is adopted: First, an improved focusing loss function is applied, which automatically assigns higher weights to boundary points (positive samples) that are difficult to identify, significantly improving the ability to discover sparse boundary points; second, a buffer zone is set outside the true boundary region, introducing additional penalties to suppress the high probability of false alarms within the buffer zone. The two losses work together to optimize the model and balance recall (finding all boundary points) and precision (reducing false alarms).

[0026] Step 2.7: Probability Normalization Output. Perform min-max normalization on the original prediction tensor. This operation enhances the relative significance of high-risk areas and solves the problem of missed reports caused by the overall low prediction scores of some samples. Finally, output the full-file domain probability tensor, where bytes greater than the set threshold are marked as high-risk boundary points.

[0027] Step 2 of this invention continuously optimizes and iterates the prediction model by minimizing the loss, resulting in a trained prediction model. This model can predict boundary regions on the input test set and output the corresponding probability tensor, providing a data foundation for robustness evaluation.

[0028] Furthermore, step 3 specifically includes the following steps:

[0029] Step 3.1, Attack Success Rate Verification and Robustness Quantization: The robustness quantizer first receives the probability tensor and boundary region mask output by the boundary prediction model for the test set samples. It locates high-risk byte positions by setting a probability threshold and adds adversarial perturbations at these positions to generate malicious file variants. Then, it executes the antivirus engine detection process and calculates key indicators: Boundary prediction rate = number of correctly predicted boundary regions / total number of boundary regions × 100%, average number of boundary points = total number of boundary points / total number of samples, prediction accuracy indicator, and perturbation rate indicator. These quantitative indicators directly reflect the robustness of the detection boundary under adversarial attacks.

[0030] Step 3.2, Boundary prediction visualization analysis: The quantizer generates a boundary point prediction score curve, which contains two layers of visualization elements: (1) the context boundary region of the real boundary point is identified by the light blue area; (2) the byte-level boundary probability prediction score is displayed by the green curve. When the peak of the green curve is highly coincident with the light blue area, the prediction is judged to be valid.

[0031] Step 3.3: Quantification Report Generation. The robustness quantifier integrates visual analysis and attack test data to generate a structured evaluation report containing the following core contents: Boundary prediction rate directly quantifies the robustness of the antivirus software against adversarial attacks at the detection boundary; a higher boundary prediction rate indicates poorer robustness. Average number of boundary points reflects the complexity of the antivirus software's detection boundary; a larger average number of boundary points indicates higher robustness. Prediction accuracy quantifies the attack's ability to identify boundary points; a stronger identification ability indicates weaker robustness of the antivirus software. Perturbation rate reflects the modification efficiency of the attack process; a higher perturbation rate indicates stronger robustness of the antivirus software. High-risk boundary regions mark the areas containing predicted high-risk bytes, forming a structured output of "[(start address 1, end address 1), (start address 2, end address 2)]". This report, while evaluating the robustness of the antivirus software, can provide security analysts with the antivirus software's prediction of high-risk boundary regions for samples, thereby optimizing the coverage of the rule base and hardening strategies.

[0032] Furthermore, step 2.6 of this invention employs an improved Focal Loss method to dynamically adjust the weights of positive samples, and strengthens the learning of difficult samples by adjusting the factor γ=2. Its core calculation is as follows: Improve the recall rate of sparse boundary points; introduce a spatial constraint penalty mechanism, and set a 50-byte buffer band Ω outside the true boundary region. penalty ,pass Suppressing high-probability false alarms in non-boundary regions, total loss Achieve a balance between recall and precision.

[0033] Furthermore, in step 2.7 of this invention, the original prediction tensor is subjected to the minimum-maximum normalization formula as follows: Bytes greater than 0.5 are marked as high-risk boundary points.

[0034] Further preferred, step 1.2 specifically includes:

[0035] ①Initial iteration: Use a binary search algorithm to find the key location for antivirus software rule detection. First, set the search range: the lower bound is the beginning of the file and the upper bound is the end of the file. Repeat the following operation until the search range is narrowed to only one byte wide: Each time, take the middle position of the current search range and generate a new sample file - set all data from the middle position to the end of the file to zero, while keeping the original data from the beginning to the middle position. Submit this sample to the antivirus software for detection. If the detection result is benign, update the lower bound of the search range to this middle position. If the detection result is malicious, update the upper bound of the search range to this middle position. When the search range is narrowed to only one byte difference, determine the upper bound position at this time as the final key detection boundary point.

[0036] ② Dynamic mask expansion verification: After successfully locating the first boundary point, the verification process is started. Starting from the position of the previous boundary point, the range of bytes that need to be zeroed is gradually expanded in the area before it. The initial zeroing range is very small, and the range covered by zeroing is continuously increased forward. Each time a new sample after zeroing is generated and submitted for detection, the expansion stops when the sample is detected as benign for the first time. This benign result indicates that the rule has failed. Thus, the minimum forward zeroing length required for the rule to become ineffective is found. The final result is to expand the initially located basic boundary point area in both forward and backward directions, expanding it forward by a certain number of bytes and backward by a fixed number of bytes. This expanded area covers the key context bytes necessary for the rule to take effect.

[0037] ③ Iterative boundary search: After the first critical region is discovered, its contents are filled with zeros. After processing, the sample will no longer be identified as malicious. Thereafter, the algorithm in the initial iteration of step ① is repeated: Based on the file that has been cleared, the search for the next new boundary point and its associated critical region is restarted. This process can be executed continuously until all the rules in the sample become invalid.

[0038] The advantages of the above technical solution, which differ from existing technologies, are as follows:

[0039] This invention evaluates the robustness of antivirus software detection boundaries from a novel perspective. It achieves full-coverage sample boundary region detection through a boundary detection engine, and precise boundary region prediction and multi-dimensional evaluation of antivirus software detection boundary robustness through a boundary prediction model and robustness quantifier. Since real-time interaction with the antivirus software is no longer required during the evaluation phase, the average evaluation time is only 3.0 seconds per sample, a 6.5-fold improvement compared to the best-performing traditional evaluation method's 22.6 seconds per sample. Regarding boundary prediction rate, this invention achieves an average boundary prediction rate of approximately 90% on test samples, with 86.89% of samples having completely predicted boundary regions, an improvement of over 40% compared to the best-performing traditional method. Simultaneously, it achieves high prediction rates with an average perturbation rate of less than 0.1%, a reduction of over 10% compared to state-of-the-art evaluation methods. Because the boundary detection and prediction range of this invention is the complete byte sequence of malware, the evaluation coverage reaches 100%, overcoming the limitation of insufficient coverage in traditional evaluation methods. This demonstrates that the invention can accurately and efficiently locate the vulnerabilities in the detection boundaries of antivirus software, and quantifies the robustness assessment of antivirus software.

[0040] Traditional evaluation methods test the robustness of antivirus software detection boundaries by coarsely injecting a large number of redundant bytes, lacking interpretability and failing to assist security analysts in strengthening detection boundaries. This invention, however, visualizes antivirus software detection boundaries through an interpretable design. For an input malware sample, the invention's prediction model can quickly locate vulnerable byte regions on that sample and quantify the degree of danger (i.e., the probability of being predicted) of the sample byte sequence through prediction scores, thus providing antivirus security analysts with more intuitive guidance on strengthening detection boundaries. Attached Figure Description

[0041] Figure 1 This is a schematic diagram comparing sample byte sequences, detection rules, boundary points, and boundary region concepts.

[0042] Figure 2 This is a schematic diagram of the overall process of an antivirus software robustness evaluation method based on detection boundary prediction. Detailed Implementation

[0043] To explain in detail the technical content, structural features, objectives, and effects of the technical solution, the following description is provided in conjunction with specific embodiments and accompanying drawings.

[0044] like Figure 2 The diagram shows the overall process of the antivirus software robustness evaluation method based on detection boundary prediction, which includes three modules: detection boundary detection engine, detection boundary prediction model, and robustness quantizer. Figure 1The diagram illustrates a comparison of sample byte sequences, detection rules, boundary points, and boundary regions. The detection boundary consists of multiple discrete rules (either feature-based matching or heuristic rules). Overcoming the detection boundary of antivirus software requires precisely locating the key bytes that can invalidate the rules—the boundary points. The context bytes of these boundary points constitute the boundary regions.

[0045] In this invention, the boundary detection engine uses dynamic masking technology and an iterative binary search algorithm to segment and zero out malware samples. Based on the binary feedback (malicious / benign) of the antivirus software detection results, it accurately locates the byte-level boundary points that cause detection failure. It outputs a labeled boundary region dataset, including the coordinates of the boundary points and their context extension areas.

[0046] The boundary prediction model is based on a deep multi-scale network model trained on a boundary region dataset. It uses parallel convolutional paths (large / medium / small scale kernels) to extract global features of the file, and outputs a byte-level probability tensor through feature fusion and attention weighting mechanisms. This tensor quantifies the boundary risk value (0.0~1.0) of each byte and marks high-risk boundary bytes that exceed a preset threshold (e.g., >0.5).

[0047] The robustness quantizer processes the predicted tensor and boundary region mask to verify the attack success rate, thereby quantifying the robustness of antivirus software against adversarial attacks at the detection boundary. Furthermore, the robustness quantizer can visualize the predicted tensor of the boundary prediction model, allowing security personnel to analyze and strengthen the detection boundary.

[0048] Specifically, the antivirus software robustness evaluation method based on detection boundary prediction of the present invention includes the following steps:

[0049] Step 1: The boundary detection engine takes a malware sample library as input, uses dynamic masking technology and an iterative binary search algorithm to locate single-byte-level boundary points, and outputs a labeled boundary region dataset.

[0050] Step 2: The boundary prediction model takes the boundary region dataset as input, extracts global features of the file through a multi-scale convolutional neural network, and outputs a byte-level probability tensor of the entire file domain.

[0051] Step 3: The robust quantizer module takes the byte-level probability tensor of the boundary prediction model as input and outputs the attack success rate of the model's predicted attack and a visualized boundary probability distribution map.

[0052] The technical solution of the present invention is further optimized, and step 1 is specifically as follows:

[0053] Step 1.1, Malicious Sample Structure Analysis: Perform static format analysis on the input malware sample to identify key structural sections of the executable file (such as the .text code segment, .data data segment, and .rsrc resource segment of a PE (Windows operating system executable file) file). Determine the start and end offsets of each section to establish a complete file address space mapping, preparing for subsequent modification operations.

[0054] Step 1.2, Dynamic Mask Iterative Detection

[0055] ① Initial Iteration. This step uses an iterative binary search algorithm to locate the key positions for antivirus software rule detection, namely the detection boundary points (BP). First, the search range of the file address space is initialized: the lower bound is the beginning of the file, and the upper bound is the end of the file. Specifically, the lower bound value low is set to the file start offset (0x0), and the upper bound value high is set to the file end offset (EOF), forming the initial search range [low, high]. Iteration is continued until the single-byte precision threshold (high-low ≤ 1) is reached: in each iteration, the midpoint position mid = (low + high) / / 2 is calculated, generating a new sample file with dynamic mask samples—all bytes from the mid offset to the end of the file are zeroed out (filled with "0x00" bytes), and the original data from the beginning to the middle position, i.e., the original content of the 0x0 to mid segment, is preserved. Submit the mask sample to the antivirus software detection interface, and update the search range based on the feedback results: if the detection result is "benign" (indicating that the zeroing operation caused the rule to fail), then update low to mid (the boundary point is located in the latter half [mid, high]); if the detection result is "malicious" (the dependent data is not completely zeroed, and the rule is still effective), then update high to mid (the boundary point is located in the first half [low, mid]). When the iteration terminates (high-low≤1), take the high position as the boundary point, that is, when the search range is narrowed down to only one byte difference, the upper bound point position at this time is determined as the final key detection boundary point.

[0056] ② Dynamic Mask Expansion Verification. After locating the first boundary point (BP1), the dynamic mask verification process is initiated. Using the previous boundary point position as a reference, the mask window is gradually increased within the interval [BP1-n1, BP1] (initially n1 = 0). The forward mask range is continuously expanded, generating a new sample after zeroing it each time and submitting it for detection until the sample is detected as benign. Expansion stops when the sample is detected as benign for the first time. This benign result indicates that the rule has failed, thus determining the minimum forward coverage length n1 that invalidates the rule. Finally, the initially located basic boundary point region is expanded in both forward and backward directions. It is expanded forward by a certain number of bytes and backward by a fixed number of bytes (the original description implicitly sets the backward expansion to one byte), that is, the basic boundary region is expanded to [BP1-n1-k, BP1+h] (where k = 20 is the forward expansion bytes and h = 10 is the backward expansion bytes), ensuring coverage of the context bytes associated with the rule.

[0057] ③ Iterative Boundary Search. After locating the first BP1, mask its boundary region [BP1-n1-k, BP1+h] (fill with "0x00"). At this point, the boundary region is invalid, and the processed sample will no longer be identified as malicious or located by antivirus software. The subsequent boundary points {BP2,...,BP1+h} can then be iteratively found according to the description in ①. n}, and the corresponding boundary region [BP n -n n -k,BP n +h]. This step repeats the algorithm from the initial iteration in step ①, starting anew from the zeroed-out file to search for the next entirely new boundary point and its associated critical region. This process can be executed continuously until all rules in the sample become invalid.

[0058] Step 1.3, Boundary Region Optimization. After sorting all detected boundary regions in ascending order of file offset, intelligent merging is performed: It is calculated whether adjacent regions overlap. If there is overlap, they are merged into a continuous region [min_start_address, max_end_address], where min_start_address represents the smallest starting address in the overlapping region and max_end_address represents the largest ending address in the overlapping region. At the same time, ultra-small regions (<5 bytes) are filtered to eliminate noise interference.

[0059] Step 1.4: Construct sample boundary labels. After all samples have obtained all corresponding boundary regions, construct a label vector of the same length as the sample, and label all boundary regions with 1 and the rest with 0. All samples and their corresponding labels will be divided into a training set and a test set. The training set is used for training the prediction model in Step 2, and the test set is used for robustness evaluation in Step 3.

[0060] The technical solution of the present invention is further optimized, and step 2 specifically includes:

[0061] Step 2.1, Byte Embedding and Position Encoding. The training set samples are first standardized: This invention is adapted for boundary region prediction of samples with a fixed length of 1MB (1,048,576 bytes). Therefore, before training the prediction model, all training samples less than 1MB are padded to a length of 1MB with "0x00", and the corresponding labels are also padded to a length of 1MB with 0, forming an input sequence with a batch size of B. For each byte value (0-255) of a sample x, it is mapped to an 8-dimensional dense vector through a learnable embedding layer, while a trainable position encoding matrix is ​​introduced. The two are added together to generate a position-aware embedding representation E = Embed(x) i )+PosEnc(i), where Embed(x) i ) indicates embedding the i-th byte of sample x, and PosEnc(i) represents the position encoding result of the i-th position. The absolute offset of the byte in the file is explicitly preserved, providing a spatial context basis for subsequent convolution operations.

[0062] Step 2.2, Multi-scale Convolution Feature Extraction. Three independent convolutional paths are used in parallel to process embedded features: a 128-kernel large-scale convolution with a stride of 96 scans ultra-long byte sequences, focusing on capturing macroscopic features; a 64-kernel medium-scale convolution with a stride of 48 parses medium-granularity patterns, accurately extracting medium-granular features; and a 32-kernel small-scale convolution with a stride of 24 focuses on fine-granularity patterns, precisely locating microscopic key bytes. The three outputs are then subjected to a nonlinear transformation F using the GELU activation function. i =GELU(Conv i (E)), Conv i (E) and F i These represent the i-th convolutional layer and the output feature, respectively, forming a feature pyramid with decreasing resolution but increasing semantic level. This preserves local details while establishing global contextual relationships, providing a multi-granular feature base for subsequent attention fusion.

[0063] Step 2.3, Feature Alignment and Fusion. To address the resolution differences in multi-scale feature maps, nearest neighbor interpolation is used to align and fuse the output features F of the three convolutional layers. 128 F 64 F 32 Uniformly aligned to the largest dimension F max The features, after being spliced ​​and aligned along the channel axis, form F. cat This operation integrates macroscopic, mesoscopic, and microscopic features. It breaks through the limitations of single-scale receptive fields, achieves cross-level semantic complementarity, and provides rich input sources for attention mechanisms.

[0064] Step 2.4, Dual Attention Enhancement. A collaborative mechanism of channel and spatial attention is employed to enhance feature focusing: Channel attention extracts channel importance through global average pooling, learns the weight distribution through a fully connected layer, and generates a channel mask weighted feature map, significantly improving the response of rule-sensitive channels; Spatial attention fuses max / average pooling features and generates a spatial weight map through convolution, dynamically focusing on high-risk file offset regions. The two are synergistically enhanced through element-wise multiplication, significantly strengthening the features of boundary regions.

[0065] Step 2.5: Upsampling and Probability Prediction. Spatial resolution is gradually restored through three levels of transposed convolution: each level doubles the feature map length and halves the number of channels, using the GELU activation function to ensure gradient stability. The decoded high-dimensional features are processed by a boundary prediction head: first, a 3×1 convolution is used to extract local context, followed by batch normalization and GELU activation, then a 1×1 convolution compresses the channel dimension, and finally, a byte-level probability is output through the Sigmoid normalization function. Linear interpolation strictly aligns the output to the original file length L, ensuring that each byte receives an accurate risk score.

[0066] Step 2.6, Loss Function and Optimization. To address the extreme sample imbalance problem where the proportion of boundary points is less than 1%, a dual-loss joint optimization strategy is designed: an improved Focal Loss function is used to dynamically adjust the weights of positive samples (α). t =0.99), and learning on difficult samples is reinforced by adjusting the factor γ=2. The core calculation is as follows: It can significantly improve the recall rate of sparse boundary points, where q t and Represent the model's predicted probability and the true label vector, respectively, log(q) t +∈) represents the logarithmic probability, where ∈ is a small positive number (e.g., 1e-8) used for numerical stability. The calculation yields the FocalLoss loss result; simultaneously, a spatial constraint penalty mechanism is introduced, setting a 50-byte buffer band Ω outside the true boundary region. penalty ,pass Suppressing high-probability false alarms in non-boundary regions, where q j τ represents the model prediction probability value for position j. penalty To penalize the activation threshold, max(0,·) ensures that only positive deviations exceeding the threshold are penalized, avoiding interference from negative values. Total loss Achieve a balance between recall and precision.

[0067] Step 2.7, Probability Normalization Output. Perform min-max normalization on the original prediction tensor to obtain the final prediction value. The `min()` and `max()` methods calculate the minimum and maximum member values ​​in the target vector, respectively. This operation enhances the relative saliency of high-risk regions, addressing the issue of missed detections caused by overall low prediction scores for some samples. The final output is a full-file domain probability tensor, where bytes > 0.5 are marked as high-risk boundary points.

[0068] By minimizing the loss and iteratively optimizing the prediction model, this step outputs a trained prediction model. It can predict boundary regions on the input test set and output the corresponding probability tensor, providing a data foundation for robustness evaluation.

[0069] The technical solution of the present invention is further optimized, and step 3 specifically includes:

[0070] Step 3.1: Attack Success Rate Verification and Robustness Quantization. The robustness quantizer first receives the probability tensor (shape: [number of test samples, file length]) and boundary region mask output by the boundary prediction model for the test set samples. High-risk byte positions are located by setting a probability threshold (>0.5), and adversarial perturbations are added at these positions to generate malicious file variants. Subsequently, the antivirus engine detection process is executed, calculating key metrics: Boundary prediction rate = (number of correctly predicted boundary regions / total number of boundary regions) × 100%, average number of boundary points = total number of boundary points / total number of samples, prediction accuracy metrics (including average byte precision, recall, and boundary region detection accuracy), and perturbation rate metrics (total number of perturbed bytes and average perturbation ratio). These quantification metrics directly reflect the robustness of the detection boundary under adversarial attacks.

[0071] Step 3.2, Boundary Prediction Visualization Analysis. The quantizer generates a boundary point prediction score curve, which contains two layers of visualization elements: (1) a light blue area identifies the context boundary regions (BRs) of the true boundary points (BPs); (2) a green curve displays the byte-level boundary probability prediction score. When the peak of the green curve (score > detection threshold) highly coincides with the light blue area, the prediction is considered valid.

[0072] Step 3.3: Quantification Report Generation. The robustness quantifier integrates visual analysis and attack test data to generate a structured evaluation report containing the following core components: Boundary prediction rate directly quantifies the antivirus software's robustness against adversarial attacks at the detection boundary; a higher boundary prediction rate indicates poorer robustness. The average number of boundary points reflects the complexity of the antivirus software's detection boundary; a larger average number of boundary points indicates higher robustness. The prediction accuracy quantifies the attack's ability to identify boundary points; a stronger identification ability indicates weaker robustness of the antivirus software. The perturbation rate reflects the modification efficiency of the attack process; a higher perturbation rate indicates stronger robustness of the antivirus software. High-risk boundary regions mark areas containing predicted high-risk bytes, forming a structured output of "[(start address 1, end address 1), (start address 2, end address 2)]". This report, while evaluating the robustness of the antivirus software, can provide security analysts with predictions of high-risk boundary regions for samples, thereby optimizing the coverage of the rule base and hardening strategies.

[0073] In summary, addressing the shortcomings of traditional antivirus software evaluation methods, such as limited dimensionality, weak localization capabilities, and insufficient coverage, this invention proposes a novel evaluation method. This method aims to quantitatively analyze the robustness (i.e., the ability to resist bypass attacks) of antivirus software's static detection rules (such as signature matching and heuristic rules). Its core idea is to accurately identify and predict the key byte sequences (called "boundary points") that cause detection failure and their contextual "boundary regions," and based on this, assess the likelihood of an attacker successfully bypassing the detection.

[0074] This invention achieves groundbreaking innovation through three core processes: First, it utilizes an intelligent iterative algorithm to accurately locate the smallest key byte region (boundary region) that causes antivirus software to fail to detect, achieving full coverage of the file byte sequence range and overcoming the shortcomings of traditional methods in assessing insufficient regions; second, it trains a deep learning model to intelligently predict which byte regions in a malicious file only require minor modifications to bypass detection, outputting a full-file byte-level risk scoring map, solving the fundamental problem that traditional methods cannot accurately locate vulnerabilities; finally, it quantitatively evaluates the attack success rate based on the prediction map and generates a visual report, intuitively revealing the distribution of vulnerabilities in the detection rules.

[0075] This invention addresses the pain points of traditional assessment methods: the assessment dimensions are expanded from a single detection rate to include boundary prediction rate, complexity, and perturbation rate; the localization capability is improved from "whether it bypassed" to a visual explanation of "where and why it was bypassed"; and the assessment scope covers file byte sequences. Its significant effects include: a 6.5-fold increase in assessment speed (average 3 seconds / sample), a boundary prediction rate of approximately 90% (far exceeding the 40% of traditional methods), and the need for only an average minor modification of 0.1% to achieve a high prediction rate (significantly reduced perturbation rate). This provides a powerful tool for efficiently and accurately assessing and strengthening the detection boundaries of antivirus software.

[0076] It should be further noted that the above embodiments are merely for understanding the technical solution of the present invention and are not intended to limit the scope of protection of the present invention. Any obvious adjustments and modifications made to the technical solution of the present invention that fall within the inventive concept should also fall within the scope of protection of the present invention.

Claims

1. A robustness evaluation method for antivirus software based on detection boundary prediction, characterized in that... Includes the following steps: Step 1: The boundary detection engine takes a malware sample library as input, uses dynamic masking technology and an iterative binary search algorithm to locate single-byte-level boundary points, and outputs a labeled boundary region dataset. Step 2: The boundary prediction model takes the boundary region dataset as input, extracts global features of the file through a multi-scale convolutional neural network, and outputs a byte-level probability tensor of the entire file domain. Step 2 specifically includes: Step 2.1: Byte Embedding and Position Encoding. Each byte value of the input training sample is mapped to an 8-dimensional dense vector through a learnable embedding layer. At the same time, a trainable position encoding matrix is ​​introduced. The two are added together to generate a position-aware embedding representation. Explicitly preserve the absolute offset of bytes in the file, providing a spatial context for subsequent convolution operations; Step 2.2: Multi-scale convolutional feature extraction. Three independent convolutional paths with different scales are used to process the embedded features in parallel. The three outputs are transformed nonlinearly by activation functions to form a feature pyramid with decreasing resolution but increasing semantic level. While preserving local details, global contextual association is established, providing a multi-granular feature base for subsequent attention fusion. Step 2.3: Feature Alignment and Fusion. Nearest neighbor interpolation is used to align the three output features to the maximum dimension. The aligned feature maps are then stitched together along the channel axis to form F. cat It integrates macroscopic, mesoscopic, and microscopic features; Step 2.4, Dual Attention Enhancement: Employing a collaborative mechanism of channel and spatial attention to strengthen feature focusing: Channel attention extracts channel importance through global average pooling, learns weight distribution through fully connected layers, and generates channel mask weighted feature maps; Spatial attention fuses max / average pooling features and generates spatial weight maps through convolution. Step 2.5, Upsampling and Probability Prediction: Spatial resolution is gradually restored through three levels of transposed convolution: the feature map length is doubled and the number of channels is halved at each level. An activation function is used to ensure gradient stability. The decoded high-dimensional features are processed by the boundary prediction head: first, a convolution is used to extract the local context, and after batch normalization and activation, another convolution is used to compress the channel dimension. Finally, a byte-level probability tensor is output, and linear interpolation strictly aligns the output to the original file length. Step 2.6, Loss Function and Optimization: A two-pronged loss strategy is adopted: First, an improved focusing loss function is applied, which can automatically assign higher weights to boundary points that are difficult to identify. Second, a buffer zone is set outside the true boundary region to introduce additional penalties to suppress the high probability of false alarms within the buffer zone. Step 2.7: Probability normalization output. Perform minimum-maximum normalization on the original prediction tensor, where bytes larger than a set threshold are marked as high-risk boundary points. Step 3: The robust quantizer module takes the byte-level probability tensor of the boundary prediction model as input, performs robust quantization, and outputs a visualized boundary probability distribution map. Step 3 specifically includes: Step 3.1, Attack Success Rate Verification and Robustness Quantization: The robustness quantizer first receives the probability tensor and boundary region mask output by the boundary prediction model for the test set samples. By setting a probability threshold, it locates the high-risk byte positions and adds adversarial perturbations at these positions to generate malicious file variants. Then, it executes the antivirus engine detection process and calculates key indicators: Boundary Prediction Rate = Number of Correctly Predicted Boundary Regions / Total Number of Boundary Regions × 100%, Average Number of Boundary Points = Total Number of Boundary Points / Total Number of Samples, Prediction Accuracy Indicator, and Perturbation Rate Indicator. These quantitative indicators directly reflect the robustness of the detection boundary under adversarial attacks.

2. The method for evaluating the robustness of antivirus software based on detection boundary prediction according to claim 1, characterized in that, Step 1 is as follows: Step 1.1, Malicious Sample Structure Analysis: Perform static format analysis on the input malicious software sample to identify key structural sections of the executable file, preparing for subsequent modification operations; Step 1.2, Dynamic Mask Iterative Detection: Use a binary search algorithm to find the key locations of antivirus software rule detection and determine the final key detection boundary points. After locating the first boundary point, start the verification process, expand the initially located basic boundary point area in both forward and backward directions to cover the key context bytes necessary for the rule to take effect, set the first key area to zero, and start searching for the next new boundary point and its associated key area again until all rules in the sample become invalid. Step 1.3: Boundary region optimization. After sorting all detected boundary regions in ascending order by file offset, perform intelligent merging: calculate whether adjacent regions overlap. If there is overlap between intervals, merge them into continuous regions. At the same time, filter out ultra-small regions to eliminate noise interference. Step 1.4: Construct sample boundary labels. After all samples have obtained all corresponding boundary regions, construct a label vector of the same length as the sample, and label all boundary regions with 1 and the rest with 0. All samples and corresponding labels will be divided into training set and test set. The training set is used for training the prediction model in step 2, and the test set is used for robustness evaluation in step 3.

3. The method for evaluating the robustness of antivirus software based on detection boundary prediction according to claim 1, characterized in that, Step 3 also includes: Step 3.2, Boundary prediction visualization analysis: The quantizer generates a boundary point prediction score curve, which contains two layers of visualization elements: (1) the context boundary region of the real boundary point is identified by the light blue area; (2) the byte-level boundary probability prediction score is displayed by the green curve. When the peak of the green curve is highly coincident with the light blue area, the prediction is judged to be valid. Step 3.3: Quantification Report Generation. The robustness quantifier integrates visualization analysis and attack test data to generate a structured evaluation report containing the following: Boundary prediction rate directly quantifies the robustness of the antivirus software against adversarial attacks at the detection boundary; a higher boundary prediction rate indicates poorer robustness. Average number of boundary points reflects the complexity of the antivirus software's detection boundary; a larger average number of boundary points indicates higher robustness. Prediction accuracy quantifies the attack's ability to identify boundary points; a stronger identification ability indicates weaker robustness of the antivirus software. Perturbation rate reflects the modification efficiency of the attack process; a higher perturbation rate indicates stronger robustness of the antivirus software. High-risk boundary intervals mark the areas containing predicted high-risk bytes, forming a structured output of "[(start address 1, end address 1), (start address 2, end address 2)]".

Images