Malicious software multi-classification method based on TCN-SE-ChebyKAN fusion model

Abstract

The invention belongs to the technical field of network security, and particularly relates to a malicious software multi-classification method based on a TCN-SE-ChebyKAN fusion model. 1, the data preprocessing module is used for carrying out cleaning and duplicate removal operations on an original data set and balancing data distribution by virtue of SeqGAN; word embedding representation is carried out; the processed data are input into a malicious software classification module for model training and classification; 2, the TCN-SE-ChebyKAN classification module is used for deeply mining a time dependency relationship in an API calling sequence by utilizing the strong long-distance dependency modeling capability of TCN; an SE module is introduced; and the ChebyKAN completes nonlinear feature dimension reduction and classification decision by using a polynomial activation function. The model can directly receive API call sequence data as input, and output malicious software categories and corresponding threat levels. Compared with a traditional detection method and a learning model, the classification efficiency and precision are remarkably improved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method for multi-classification of malware based on the TCN-SE-ChebyKAN fusion model. Background Technology

[0002] In recent years, the rapid development of internet technology has led to a surge in the number and types of malware, posing a significant challenge to cybersecurity. In enterprise network environments, malware typically infiltrates devices using covert methods such as disguising system patches and bundling applications. It then exploits system vulnerabilities to steal sensitive data, tamper with system configurations, and commit other malicious acts, severely compromising enterprise network security. Once a business system is compromised by malware, the threat hunting efforts of the enterprise's security operations center will be directly disrupted. Incidents such as critical data breaches or business shutdowns can result in substantial economic losses and negatively impact the company's reputation.

[0003] Faced with such a severe malware threat, the effectiveness of detection technology is crucial. However, static analysis methods for malware suffer from poor code feature extraction when dealing with obfuscated code and variant samples. Dynamic analysis methods, on the other hand, can effectively capture behavioral characteristics by monitoring API call sequences, making them more advantageous when dealing with complex malware samples.

[0004] Traditional detection methods based on signature feature matching and heuristic rules are highly efficient when dealing with known malware, but they perform poorly in terms of accuracy and false positive rate when facing novel malware. With the development of machine learning and deep learning technologies, the field of malware detection has undergone a revolutionary change. Deep learning, in particular, has been widely used in malware detection in recent years due to its powerful automatic feature extraction capabilities and advantages in complex pattern modeling. Kolosnjaji et al. successfully achieved accurate malware classification by constructing a model architecture containing convolutional and recurrent network layers to deeply mine feature information in API call sequences; Catak et al. not only released the valuable Mal-API-2019 dataset but also used a single-layer LSTM model for detection tasks, validating the model's effectiveness on this dataset and providing standard data support for subsequent related research. Li & Zheng conducted experiments using LSTM and GRU recurrent neural network models, fully leveraging their advantages in processing temporal data to effectively capture the temporal dependencies in API call sequences, achieving good results in malware detection tasks. Demirkiran et al.'s RTF model was innovatively applied to malware multi-class classification tasks, achieving efficient multi-class differentiation thanks to its unique network structure and training strategy, further expanding the application boundaries of malware detection models. Furthermore, Panda et al. combined Word2Vec word embedding technology with a 1D-CNN network, transforming API call sequences into semantic vectors and utilizing the local feature extraction capabilities of convolutional neural networks to accurately capture the dependencies before and after API calls, significantly improving the performance of the detection model. Cui et al. proposed API 2Vec++, based on graph embedding and BERT pre-training techniques, modeling API call relationships as a graph structure and leveraging the powerful semantic understanding capabilities of the pre-trained model to achieve accurate multi-class classification of malware. Qian Liping et al.'s CAFTrans framework focuses on feature correlation and multimodal fusion, providing new research ideas and technical directions for the malware detection field by introducing attention mechanisms and multi-source data fusion strategies. Bak1r et al. proposed the TuneDroid method, which dynamically adjusts the CNN model through code visualization and Bayesian optimization. Experiments have shown that its detection performance is significantly better than that of traditional models.

[0005] However, current dynamic analysis methods based on API call sequences suffer from the following technical drawbacks: high computational complexity and neglect of long-distance dependencies. 1. Insufficient capture of long-distance temporal dependencies: Existing dynamic analysis methods based on API call sequences struggle to effectively capture long-distance dependencies across time periods in malware behavior. Traditional convolutional networks require layering numerous convolutional layers to expand the receptive field, resulting in high computational complexity and insufficient modeling of long-distance associations, failing to comprehensively represent the temporal behavior patterns of malware. 2. Weak modeling of high-order nonlinear relationships between features: Traditional models rely on fully connected layers for feature processing, making it difficult to effectively combine complex high-order nonlinear features in API call sequences. This leads to insufficient mining of deep feature associations in malware behavior, affecting the accuracy of multi-classification tasks. 3. Discriminative features are susceptible to interference from redundant information: After feature extraction, multi-channel features in API call sequences contain a large amount of redundant information unrelated to malicious behavior. Existing models lack effective mechanisms for dynamically enhancing key channel features and suppressing redundant features, causing discriminative features to be interfered with by noise, reducing the model's ability to identify malicious patterns. 4. High cost of manual intervention: Traditional malware multi-classification methods rely on manual design of feature engineering (such as manually screening API call features and defining malicious behavior rules) and parameter tuning. This not only requires deep expertise in the malware domain, but is also inefficient and difficult to adapt to the needs of large-scale malware sample detection. Summary of the Invention

[0006] To address the aforementioned issues, this invention proposes a malware multi-classification method based on a TCN-SE-ChebyKAN fusion model. This method organically integrates the advantages of TCN and ChebyKAN networks, presenting a malware multi-classification model based on a fusion of TCN and ChebyKAN networks. It utilizes TCN's causal convolution and dilated convolution to model long-range temporal dependencies, introduces the SE attention mechanism to extract multi-channel features, and replaces the traditional fully connected layers with high-order nonlinear combinations through ChebyKAN's Chebyshev multinomial transformation. This provides an effective solution for malware multi-classification and malware detection.

[0007] This invention adopts the following technical solution: a multi-classification method for malware based on the TCN-SE-ChebyKAN fusion model includes the following steps:

[0008] Step 1: Data Preprocessing

[0009] 1. Clean and deduplicate the original dataset of the Mal-API-2019 malware to remove redundant information and duplicate samples, ensuring data quality and consistency. Then, use SeqGAN to balance the data distribution, laying a solid data foundation for subsequent analysis.

[0010] The API call sequence is extracted based on spaces. The API names are standardized to lowercase and special characters are removed. Then, the sequence is deduplicated while maintaining the call order to further reduce the interference of redundant information and prepare for model training.

[0011] Because the number of samples in each category of the aforementioned dataset varies significantly, directly using it for model training would cause the model to shift towards the majority class, affecting its classification performance. Therefore, SeqGAN (Sequence Generative Adversarial Network) is introduced to balance the data distribution. Through reinforcement learning, SeqGAN generates semantically reasonable API sequences to expand the minority class samples, ensuring that the number of samples in each category of the balanced dataset is uniformly 1001. The dataset is then divided into training and test sets in an 8:2 ratio, laying the foundation for subsequent model training and performance evaluation.

[0012] 2. After completing the data processing, word embedding representation is performed. Word2Vec is used to perform semantic vector representation on the API call sequence, converting discrete symbols into semantically rich numerical expressions so that the model can better understand and process the data.

[0013] 3. Input the processed data into the malware classification module to perform model training and classification operations, thereby achieving effective identification and classification of malware.

[0014] The second step is the Temporal Convolutional Network (TCN).

[0015] Deep temporal feature extraction is performed on the API call sequence after word embedding to capture long-distance dependencies. The temporal convolutional network includes:

[0016] 1. Causal Convolution

[0017] A one-way structure is adopted, which only uses API call information at the current and historical moments to avoid future data interference and ensure temporal causality.

[0018] Causal convolution combines the value of the next layer at time t with the value of the previous layer x. 1… x t The value is used to calculate y at time t of the previous layer. t Value, such that y t The value is close to the actual value, and the calculation method is shown in formula (1).

[0019]

[0020] In the formula, P(x) is the probability density function of the function, and T is the time delay.

[0021] 2. Dilated convolution

[0022] Three dilated convolutional layers are set up with hole coefficients of 1, 2 and 4 respectively. The receptive field is expanded by an interval sampling mechanism to capture the long-distance dependence of multi-stage malicious behavior. The calculation formula of the receptive field is shown in formula (2).

[0023] RF=(K-1)×d+1 (2);

[0024] In the formula, RF is the receptive field size, K is the convolution kernel size, and d is the hole coefficient.

[0025] 3. Residual Module

[0026] Each module contains two dilated convolutional layers, a weight normalization layer (ReLU activation), and a dropout layer, which fuse initial features and deep features to avoid information loss and suppress overfitting. At the same time, it adapts the channel dimension differences through 1×1 convolution.

[0027] The third step is the compression and excitation module (SE).

[0028] Weight calibration is performed on the multi-channel features output by the temporal convolutional network to enhance discriminative features and suppress redundant noise.

[0029] The compression and excitation modules include:

[0030] 1. Global Feature Compression

[0031] Global average pooling is used to compress the sequence length of each channel into a channel descriptor vector, capturing the global statistical features of the channels.

[0032] The feature map F∈R output by the temporal convolutional network L×C Global average pooling is performed to compress the spatial dimension (sequence length L) of each channel into a channel descriptor vector z∈R. C The calculation formula is shown in formula (3).

[0033]

[0034] In the formula, F(i,c) represents the feature value of the feature map at the i-th time step and the c-th channel, z c Let H be the global statistical feature of the c-th channel, H be the height of the feature map, and W be the width of the feature map.

[0035] 2. Channel Dependency Modeling

[0036] A two-layer fully connected network (dimensionality reduction ratio r = 16) is used to perform a nonlinear transformation on the descriptor z to learn the dependencies between channels. The calculation formulas are shown in formulas (4) and (5).

[0037] f1=ReLU(W1·z+b1) (4);

[0038] S=σ(W2·f1+b2) (5);

[0039] In the formula, formula (4) represents the dimensionality reduction of the first fully connected layer. r is the dimensionality reduction ratio (take r = 16), b1 is the bias term, and formula (5) represents the dimensionality increase of the second fully connected layer. b2 is the bias term, σ is the sigmoid activation function, and the final generated channel attention weight vector s∈R C .

[0040] 3. Feature Channel Reweighting

[0041] The channel attention weight S is multiplied channel by channel with the original feature map F to obtain the weighted feature map. The calculation formula is shown in formula (6).

[0042] F'(i, c) = s c ×F(i,c) (6);

[0043] In the formula, S c Let be the importance weight of the c-th channel.

[0044] Step 4, ChebyKAN

[0045] 1. The ChebyKAN (Chebyshev-KAN) network is introduced to optimize the data processed by the temporal convolutional network and compression and activation modules, which solves the limitations of deep pattern mining and enhances the convergence robustness of the training process. The ChebyKAN network replaces the B spline function in the traditional KAN with Chebyshev polynomials and performs high-order nonlinear combination of input features through globally orthogonal polynomial basis functions.

[0046] 2. The outer function of the KAN network is responsible for capturing global features, while the inner function performs fine fitting of local details in the form of spline functions; the general form of the KAN network is shown in Equation (7).

[0047]

[0048] In the formula, φ q，p The domain of the single variable function representing the mapping input variable is [0, 1], and its range is the set of real numbers R, φ q，p (x p φ represents a trainable activation function. q The domain and range are both R.

[0049] The internal function of formula (7) forms a KAN layer with n inputs and 2n+1 outputs, and the output function forms a KAN layer with 2n+1 inputs and n outputs. Therefore, KAN(x) is essentially composed of two KAN layers. To make KAN easier to optimize, a residual activation strategy is proposed in the original KAN paper. By introducing the basis function b(x), the trainable activation function φ(x) is made up of the basis function b(x) and the spline function spline(x), as shown in formula (8).

[0050] φ(x)=w b b(x)+w s spline(x) (8);

[0051] In the formula, w b and w s It is redundant and can be absorbed into b(x) and the spline function spline(x), with b(x) set as the SiLU function, as shown in formula (9).

[0052]

[0053] spline(x) is parameterized as a linear combination of B-spline curves, as shown in formula (10).

[0054]

[0055] In the formula, c i Denotes the trainable parameters, spline(x) is a combination of one-dimensional functions, and b i (x) is a predefined Base-spline basis function; during training, the spline parameters c i Continuous optimization is performed to adjust the spline shape, thereby fitting the training data.

[0056] 3. Improved design based on Chebyshev polynomials

[0057] To address the issue that the B-spline function in traditional KAN has strong locality and is difficult to capture the global structure of the data, the good global approximation and orthogonality properties of the Chebyshev polynomial are used to replace the B-spline function in traditional KAN, as shown in formula (11).

[0058]

[0059] In the formula, a k T represents the trainable parameters. k Let m be a Chebyshev polynomial of order k, where m is the order of the polynomial.

[0060] Furthermore, in step one, the length of the API sequence is set to 150, and Word2Vec is used to perform semantic vector representation on the API call sequence, with the embedding layer dimension set to 100 dimensions.

[0061] Furthermore, in step one, the raw data is the Mal-API-2019 malware.

[0062] Furthermore, in step one, SeqGAN is used to generate semantically reasonable API sequences to expand the minority class samples, so that the number of samples in each category of the balanced dataset is uniformly 1001. Then the dataset is divided into training set and test set in a ratio of 8:2.

[0063] Furthermore, in step two, the input is a 100-dimensional semantic vector after word embedding, and the output is a multi-channel temporal feature. The TCN output is input into the SE module, and the feature weights are optimized through the channel attention mechanism.

[0064] Furthermore, in step three, the dimensionality reduction ratio r = 16.

[0065] Furthermore, in step four, an improved design based on Chebyshev polynomials is used to replace the B-spline function of the traditional KAN with Chebyshev polynomials (order m=4). Its global orthogonality is used to capture global patterns in the data, thereby improving the ability to mine complex patterns. Through the linear combination of trainable parameters and Chebyshev polynomials, high-order nonlinear transformation of features is achieved, breaking through the limitations of local basis functions.

[0066] Furthermore, the TCN-SE-ChebyKAN fusion model leverages TCN's powerful long-distance dependency modeling capabilities to deeply mine the temporal dependencies within API call sequences. In malware behavior patterns, API calls exhibit complex temporal sequences and dependencies. For example, API call sequences may involve multi-stage operations such as file encryption, network data transmission, and privilege escalation. TCN can accurately capture this crucial information. The introduction of the SE module adaptively calibrates the weights of feature channels, enhancing the saliency of key features and allowing the model to focus more on features that are discriminative for classification tasks. The ChebyKAN network utilizes a multinomial activation function to perform nonlinear feature dimensionality reduction and classification decisions, effectively reducing the dimensionality of high-dimensional complex features extracted from the TCN and SE modules and mapping them to eight different malware category spaces. Through these operations, the model can effectively extract high-dimensional and complex deep-level features from API call sequences, accurately revealing the intrinsic behavioral patterns of malware and completing malware multi-classification tasks.

[0067] Furthermore, this method classifies malware samples into eight categories: Worms, Virus, Trojans, Downloaders, Backdoors, Droppers, Spyware, and Adware, corresponding to different types of malware, in order to accurately identify and distinguish the characteristics and behaviors of various types of malware.

[0068] Furthermore, the data preprocessing module is used to clean, deduplicatize, and standardize the original malware API call sequence data, balance the data distribution through SeqGAN, and complete the semantic vector transformation of features using Word2Vec.

[0069] Furthermore, the TCN-SE-ChebyKAN classification module includes a temporal convolutional network (TCN), a compression and activation network (SE), and an improved ChebyKAN network, used to extract temporal features of API call sequences, optimize channel weights, and mine higher-order nonlinear relationships between features.

[0070] Furthermore, malware category determination is performed, and the category to which the malware belongs is determined based on the model output.

[0071] The beneficial effects of this invention are as follows: A malware multi-classification method based on a TCN-SE-ChebyKAN fusion model is proposed. This method integrates a Temporal Convolutional Network (TCN), a compression and activation network (SE), and an improved ChebyKAN network to train a highly efficient model. This model accurately captures long-range temporal dependencies and high-order nonlinear relationships between features in API call sequences, enabling accurate classification and threat level determination of malware. The model can directly accept preprocessed API call sequence data as input and output malware categories and corresponding threat levels, demonstrating excellent performance on the Mal-API-2019 dataset. Compared to traditional detection methods and single deep learning models, it significantly improves classification efficiency and accuracy, with the following advantages:

[0072] (1) Enhanced ability to capture long-range temporal dependencies: By combining causal convolution and dilated convolution in the TCN module with residual module design, the ability to capture long-range temporal dependencies in API call sequences is significantly improved. This enables the model to more comprehensively understand the dynamic behavior patterns of malware, providing strong support for accurate classification.

[0073] (2) Improved feature discriminativeness: By introducing the SE module to construct a channel attention mechanism, the feature channel weights are adaptively optimized, enhancing the saliency of key features and effectively suppressing redundant information interference. This allows the model to focus more on the core features that play a decisive role in the classification task, thereby improving classification accuracy.

[0074] (3) Enhanced ability to model high-order nonlinear relationships: By using the ChebyKAN module to replace the traditional B-spline function with Chebyshev polynomials, the ability to mine and model high-order nonlinear relationships between features is enhanced. This enables the model to analyze the complex correlations of malware features more deeply, breaking through the limitations of traditional neural networks in feature representation.

[0075] (4) Synergistic advantages of model fusion: By combining the advantages of TCN, SE, and ChebyKAN, the model integrates the capabilities of long-term dependency capture, key feature enhancement, and high-order relation modeling. This fusion enables the model to parse API call sequence data from multiple dimensions. Experimental results show that the fused model outperforms the single-module model in all evaluation metrics, verifying its effectiveness and superiority.

[0076] (5) Automated end-to-end process: Only the API call sequence needs to be standardized and preprocessed. No manual feature engineering is required. The classification results and threat level can be output by directly inputting the raw sequence data, which greatly improves the efficiency and automation level of malware detection. Attached Figure Description

[0077] Figure 1 This is a flowchart of multiple classifications of malware.

[0078] Figure 2 This is a diagram of a causal dilated convolution architecture.

[0079] Figure 3 This is a diagram of the TCN temporal convolutional network architecture.

[0080] Figure 4 It is a diagram of an incomplete module structure.

[0081] Figure 5 This is the SE module structure diagram.

[0082] Figure 6 This is a diagram of the KAN network structure.

[0083] Figure 7 This is a line and bar chart comparing model performance on the Mal-API-2019 dataset. Detailed Implementation

[0084] Example 1

[0085] A malware multi-classification method based on the TCN-SE-ChebyKAN fusion model is proposed to address the shortcomings of existing technologies in capturing long-distance temporal dependencies and modeling high-order nonlinear relationships between features.

[0086] A malware multi-classification method based on the TCN-SE-ChebyKAN fusion model includes the following steps:

[0087] Step 1: Data Preprocessing

[0088] The original dataset was cleaned and deduplicated, and the length of the API sequence was set to 150. Word2Vec was used to perform semantic vector representation on the API call sequence, and the embedding layer dimension was set to 100. Discrete symbols were converted into semantically rich numerical expressions so that the model could better understand and process the data. The processed data was then input into the malware classification module for model training and classification.

[0089] The relevant operations were performed using the Mal-API-2019 benchmark dataset in the field of malware dynamic behavior analysis. This dataset captures Windows malware API call sequences through a sandbox and stores them in CSV format. It contains 7107 samples, covering 8 types of malware. The sample quantity distribution of each category is as follows: Worms 1001, Virus 1001, Trojans 1001, Downloaders 1001, Backdoors 1001, Droppers 891, Spyware 832, and Adware 379.

[0090] 1. Clean and deduplicate the original dataset of the Mal-API-2019 malware to remove redundant information and duplicate samples, ensuring data quality and consistency. Then, use SeqGAN to balance the data distribution, laying a solid data foundation for subsequent analysis.

[0091] The API call sequence is extracted based on spaces. The API names are standardized to lowercase and special characters are removed. Then, the sequence is deduplicated while maintaining the call order to further reduce the interference of redundant information and prepare for model training.

[0092] Because the number of samples in each category of the aforementioned dataset varies significantly, directly using it for model training would cause the model to shift towards the majority class, affecting its classification performance. Therefore, SeqGAN (Sequence Generative Adversarial Network) is introduced to balance the data distribution. Through reinforcement learning, SeqGAN generates semantically reasonable API sequences to expand the minority class samples, ensuring that the number of samples in each category of the balanced dataset is uniformly 1001. The dataset is then divided into training and test sets in an 8:2 ratio, laying the foundation for subsequent model training and performance evaluation.

[0093] 2. After completing the data processing, word embedding representation is performed. Word2Vec is used to perform semantic vector representation on the API call sequence, converting discrete symbols into semantically rich numerical expressions so that the model can better understand and process the data.

[0094] 3. Input the processed data into the malware classification module to perform model training and classification operations, thereby achieving effective identification and classification of malware.

[0095] The second step is the Temporal Convolutional Network (TCN).

[0096] API call sequences, as core data reflecting malware behavior, contain complex nonlinear distributions of temporal dependencies and dynamic semantic features. To address the problems of unstable gradient propagation, weak long-distance dependency capture, and difficulty in controlling model memory range in traditional temporal models when processing API call sequences, Temporal Convolutional Networks (TCNs) are introduced to extract deep features from API call sequences.

[0097] The word-embedded vectors are input into the TCN module. Causal convolution ensures that only historical and current API call information is used (avoiding interference from future data). Dilated convolution (with 3 layers and dilation coefficients of 1, 2, and 4) expands the receptive field and captures long-distance temporal dependencies in the API sequence (such as multi-stage operation chains of malware). The initial features and deep features are fused through the residual module to avoid information loss and accelerate training convergence, outputting multi-channel temporal features.

[0098] To address the problem of traditional convolutional neural networks (CNNs) leaking past information and interfering with future predictions when processing time-series data, TCN introduces causal convolution to ensure the causal relationships in time-series data. Causal convolution employs a unidirectional structure, restricting the model to rely only on current and past time-series information, thus isolating future data and preventing information leakage. This mechanism provides an effective method for processing sequence data, enabling more accurate capture of the temporal dependencies within the data.

[0099] TCN (Transient Convolutional Network) introduces dilated convolution to progressively increase the receptive field, ensuring the capture of long-range dependencies in time-series data. It also overcomes the limitations of traditional neural networks, which require stacking multiple convolutional layers to enhance time-series sequence modeling capabilities. It differs significantly from ordinary convolution in its input data sampling method. Ordinary convolution incorporates every input data point into the computation, while dilated convolution uses an interval sampling mechanism, flexibly adjusting the sampling interval by setting a dilation coefficient to achieve skip sampling.

[0100] Deep temporal feature extraction is performed on the API call sequence after word embedding to capture long-distance dependencies. The temporal convolutional network includes:

[0101] 1. Causal Convolution

[0102] Causal convolution ensures temporal order. Traditional convolution is prone to information leakage when processing temporal data. Therefore, a causal convolution structure is adopted. By restricting the output at the current moment to depend only on the input at the previous moment (that is, the output is only calculated by the previous API call sequence), the temporal causal relationship of the API call sequence is strictly guaranteed, and future information is avoided from interfering with the model's judgment.

[0103] A one-way structure is adopted, which only uses API call information at the current and historical moments to avoid future data interference and ensure temporal causality.

[0104] Causal convolution uses the values ​​of the next layer at time t and the previous x1…x t The value is used to calculate y at time t of the previous layer. t Value, such that y t The value is close to the actual value, and the calculation method is shown in formula (1).

[0105]

[0106] In the formula, P(x) is the probability density function of the function, and T is the time delay.

[0107] 2. Dilated convolution

[0108] Dilated convolution expands the receptive field. To address the issue that traditional convolution requires multiple layers to capture long-distance dependencies, dilated convolution is introduced. By setting an interval sampling mechanism (dilation coefficient d = 1, 2, 4), the receptive field expands exponentially according to the formula without increasing computational complexity, thus achieving efficient capture of long-distance dependencies in API call sequences.

[0109] Three dilated convolutional layers are set up with hole coefficients of 1, 2 and 4 respectively. The receptive field is expanded by the interval sampling mechanism to capture the long-distance dependence of multi-stage malicious behavior. The calculation formula of the receptive field is as shown in formula (2).

[0110] RF=(K-1)×d+1 (2);

[0111] In the formula, RF is the receptive field size, K is the convolution kernel size, and d is the hole coefficient.

[0112] 3. Residual Module

[0113] To address the vanishing or exploding gradient problem during deep network training, a residual module is introduced in TCN. Each residual block contains two layers of dilated convolution, batch normalization, and ReLU activation function. Through cross-layer connections, the input and output features are directly added, which preserves the original feature information, accelerates network convergence, and improves model stability.

[0114] Each module contains two dilated convolutional layers, a weight normalization layer (ReLU activation), and a dropout layer, which fuse initial features and deep features to avoid information loss and suppress overfitting. At the same time, it adapts the channel dimension differences through 1×1 convolution.

[0115] TCN's causal dilated convolutional structure enhances temporal modeling capabilities in a hierarchical manner. The receptive field of the three dilated convolutions expands layer by layer, which can cover the associated features of multi-stage operations in the API sequence.

[0116] The input is a 100-dimensional semantic vector after word embedding, and the output is a multi-channel temporal feature. The TCN output is input into the SE module, and the feature weights are optimized through the channel attention mechanism.

[0117] In TCN, the residual module combines the features extracted by the model with the initial features to prevent the loss of key information during feature extraction, thereby enhancing the model's stability and data representation ability. Each module in the residual module contains two dilated convolutional layers and a weight normalization layer, using ReLU as the activation function to achieve nonlinear transformation. In the regularization design, TCN introduces a dropout layer in each residual block after the dilated convolution operation, which suppresses overfitting and improves the model's generalization ability through the mechanism of randomly deactivating neurons.

[0118] The third step is the compression and excitation module (SE).

[0119] To address the issue that discriminative features of API call sequences are susceptible to noise interference from redundant channels after temporal features are extracted via TCN, a compression and excitation module (SE) is introduced. This module compresses global channel features through global average pooling and learns the non-linear dependencies between channels using a two-layer fully connected network. Finally, a channel attention weight matrix is ​​generated using the sigmoid function to reweight the multi-scale features output by TCN. This mechanism enhances API call patterns strongly correlated with malicious behavior while suppressing interference from non-critical channels, effectively improving the model's ability to capture discriminative features.

[0120] Weight calibration is performed on the multi-channel features output by the temporal convolutional network to enhance discriminative features and suppress redundant noise.

[0121] The compression and excitation modules include:

[0122] 1. Global Feature Compression

[0123] Global average pooling is used to compress the sequence length of each channel into a channel descriptor vector, capturing the global statistical features of the channels.

[0124] The feature map F∈R output by the temporal convolutional network L×CGlobal average pooling is performed to compress the spatial dimension (sequence length L) of each channel into a channel descriptor vector z∈R. C The calculation formula is shown in formula (3).

[0125]

[0126] In the formula, F(i,c) represents the feature value of the feature map at the i-th time step and the c-th channel, z c Let H be the global statistical feature of the c-th channel, H be the height of the feature map, and W be the width of the feature map.

[0127] 2. Channel Dependency Modeling

[0128] A two-layer fully connected network (dimensionality reduction ratio r = 16) is used to perform a nonlinear transformation on the descriptor z to learn the dependencies between channels. The calculation formulas are shown in formulas (4) and (5).

[0129] f1=ReLU(W1·Z+b1) (4);

[0130] S=σ(W2·f1+b2) (5);

[0131] In the formula, formula (4) represents the dimensionality reduction of the first fully connected layer. r is the dimensionality reduction ratio (take r = 16), b1 is the bias term, and formula (5) represents the dimensionality increase of the second fully connected layer. b2 is the bias term, σ is the sigmoid activation function, and the final generated channel attention weight vector s∈R C .

[0132] 3. Feature Channel Reweighting

[0133] The channel attention weight S is multiplied channel by channel with the original feature map F to obtain the weighted feature map. The calculation formula is shown in formula (6).

[0134] F′(i,c)=s c ×F(i,c) (6);

[0135] In the formula, S c Let be the importance weight of the c-th channel.

[0136] This operation enhances the characteristics of channels strongly associated with malicious behavior (such as characteristic channels of file operations and network communication APIs) and suppresses interference from redundant channels.

[0137] The channel attention mechanism of the compression and activation module improves the model's ability to focus on key features by dynamically adjusting the weights; the input is the multi-channel temporal features output by TCN, and the output is the weighted optimized features; the SE output is input into the ChebyKAN module.

[0138] Step 4, ChebyKAN

[0139] Even after processing by the TCN and SE modules, the data still suffers from insufficient complex pattern mining and poor convergence stability during training. To address this, the ChebyKAN network is introduced to optimize the data processed by the TCN and SE modules. Compared to traditional fully connected layers or B-spline functions, its global approximation properties enable more efficient capture of deep complex patterns, overcoming the limitations of local basis functions in global feature correlation mining and resolving the problem of insufficient complex pattern mining.

[0140] The traditional KAN (Kolmogorov-Arnold Network) is a novel neural network architecture inspired by the Kolmogorov-Arnold representation theorem. It breaks the design framework of the traditional Multi-Layer Perceptron (MLP) by redefining the relationship between weight parameters and activation functions. KAN places learnable activation functions at the network edge and replaces traditional weight parameters with adaptive univariate spline functions.

[0141] We model high-order nonlinear relationships in the features output by SE to achieve multi-classification decision-making for malware.

[0142] 1. The ChebyKAN (Chebyshev-KAN) network is introduced to optimize the data processed by the temporal convolutional network and compression and activation modules, which solves the limitations of deep pattern mining and enhances the convergence robustness of the training process. The ChebyKAN network replaces the B spline function in the traditional KAN with Chebyshev polynomials and performs high-order nonlinear combination of input features through globally orthogonal polynomial basis functions.

[0143] 2. The outer function of the KAN network is responsible for capturing global features, while the inner function performs fine fitting of local details through spline functions; the general form of the KAN network is shown in Equation (7);

[0144]

[0145] In the formula, φ q，p The domain of the single variable function representing the mapping input variable is [0,1], and its range is the set of real numbers R, φ q，p (x p ) represents a trainable activation function, Φ q The domain and range are both R.

[0146] The internal function of formula (7) forms a KAN layer with n inputs and 2n+1 outputs, and the output function forms a KAN layer with 2n+1 inputs and n outputs. Therefore, KAN(x) is essentially composed of two KAN layers. To make KAN easier to optimize, a residual activation strategy is proposed in the original KAN paper. By introducing the basis function b(x), the trainable activation function φ(x) is made up of the basis function b(x) and the spline function spline(x), as shown in formula (8).

[0147] φ(x)=w b b(x)+w s spline(x) (8);

[0148] In the formula, w b and w s It is redundant and can be absorbed into b(x) and spline function spline(x), b(x) is set as SiLU function, as shown in formula (9);

[0149]

[0150] spline(x) is parameterized as a linear combination of B-spline curves, as shown in formula (10).

[0151]

[0152] In the formula, c i Denotes the trainable parameters, spline(x) is a combination of one-dimensional functions, and b i (x) is a predefined Base-spline basis function; during training, the spline parameters c i Continuous optimization is performed to adjust the spline shape, thereby fitting the training data.

[0153] 3. Improved design based on Chebyshev polynomials

[0154] To address the issue that the B-spline function in traditional KAN has strong locality and is difficult to capture the global structure of the data, the good global approximation and orthogonality properties of the Chebyshev polynomial are used to replace the B-spline function in traditional KAN, as shown in formula (11).

[0155]

[0156] In the formula, a k T represents the trainable parameters. k Let m be a Chebyshev polynomial of order k, where m is the order of the polynomial.

[0157] Traditional KANs use B-spline functions as basis functions, but their local tight support properties (non-zero only in small intervals) result in insufficient ability to capture global patterns. ChebyKAN replaces these with Chebyshev polynomials, leveraging their global orthogonality (non-zero and orthogonal throughout the interval [-1,1]). Compared to B-spline functions, ChebyKAN can represent global patterns with a smaller number of coefficients, enabling direct fitting of long-distance dependent features.

[0158] Compared to traditional KANs, ChebyKAN demonstrates greater adaptability when handling complex data patterns. Leveraging the globally orthogonal nature of Chebyshev polynomials, it can more efficiently capture global patterns in the data, thus significantly improving the model's generalization ability. During training, ChebyKAN's convergence process is smoother and less volatile, effectively reducing the risk of getting trapped in local optima. This results in superior performance on complex tasks, ultimately outputting accurate and reliable malware classification results.

[0159] Example 2 (Test 1)

[0160] To verify the performance improvement effect of the core modules on the model, comparative experiments were conducted. While retaining TCN as the baseline model, different modules were gradually and systematically introduced. All experiments were conducted on the same dataset, with the same partitioning method, the same number of iterations, and under the same experimental conditions, using Precision, Recall, F1-score, and AUC as evaluation metrics.

[0161] The model performance testing order was as follows: TCN network, TCN+SE network with SE module added, TCN+ChebyKAN network with ChebyKAN module added, TCN+SE+KAN network with SE and KAN modules added, and finally, TCN+SE+ChebyKAN network integrating SE and ChebyKAN modules. The evaluation results are shown in the table. As can be seen from the evaluation metrics, adding each module improved the evaluation metrics to some extent. Among them, integrating SE and ChebyKAN modules achieved optimal results in all metrics, with an F1-score improvement of 3.44% and an AUC improvement of 2.16% compared to the baseline model, verifying the effectiveness of the synergistic effect of each module.

[0162] Table 1 - Impact of different modules on model performance

[0163]

[0164] Example 3 (Test 2)

[0165] The Mal-API-2019 dataset was used to validate the effectiveness of the malware classification model fused with the TCN-SE-ChebyKAN network. Samples from the preprocessed dataset that were not used in the training process were input into LSTM, RGU, 1D-CNN, RTF, Extratrees, and CAFTrans models, and the classification performance of this model was compared. Figure 7 As shown.

[0166] Experimental results show that the TCN+SE+ChebyKAN model significantly improves both ACC and precision. Compared to the three basic models—LSTM, GRU, and 1D-CNN—this model improves ACC by 8.70%, 8.08%, and 4.29%, respectively, and precision by 9.90%, 9.33%, and 5.25%, respectively. In comparison with state-of-the-art models, its ACC is 9.56% higher than the RTF model, 10.33% higher than the Extratrees method, and 2.43% higher than the CAFTrans model; in terms of precision, it is 11.32% higher than the RTF model, 12.47% higher than Extratrees, and 6.11% higher than the CAFTrans model. This systematic advantage further demonstrates the superiority of this novel module combination when processing complex data.

[0167] Table 2 - Classification results of different models

[0168]

[0169] Existing research has shown that traditional metrics such as Precision and Recall are insufficient to comprehensively measure model performance in multi-class classification scenarios. Therefore, AUC and F1 score were selected as the core evaluation metrics. Using these two metrics not only aligns with the characteristics of multi-class classification tasks but also facilitates horizontal comparisons with similar studies, ensuring the scientific rigor and objectivity of the evaluation results. Specific experimental results are shown below. Figure 7 As shown.

[0170] Experimental results show that the TCN-SE-ChebyKAN model also performs exceptionally well in key metrics such as F1 score and AUC. Compared to the recently high-performing CAFTrans model, the F1 score increased from 67.40% to 69.25%, and the AUC value increased from 91.02% to 92.53%, representing increases of 2.74% and 1.66% respectively. This indicates that the model is more competitive in terms of overall performance and generalization ability, effectively validating the effectiveness of modular collaborative design.

[0171] ChebyKAN's global feature mining replaces the B-spline function of traditional KAN with Chebyshev polynomials. It efficiently captures deep and complex patterns by leveraging global orthogonality, thereby improving training convergence stability and generalization ability.

[0172] The TCN-SE-ChebyKAN fusion leverages TCN to extract long-term temporal features through causal convolution (preserving temporal causality) and dilated convolution (expanding the receptive field), while the SE module weights and strengthens key channels. ChebyKAN optimizes classification decisions, and the three work synergistically to improve malware classification performance. This end-to-end semi-automated process requires only standardized preprocessing, eliminating the need for manual feature engineering and supporting real-time evaluation.

Claims

1. A malware multi-classification method based on the TCN-SE-ChebyKAN fusion model, characterized in that, The malware multi-classification method includes the following steps: Step 1: Data Preprocessing 1. Clean and deduplicate the original dataset to remove redundant information and duplicate samples. Then, use SeqGAN to balance the data distribution and lay a solid data foundation for subsequent analysis. The API call sequence is extracted based on spaces, the API names are standardized to lowercase and special characters are removed, and then the sequence is deduplicated while maintaining the call order to further reduce the interference of redundant information; To balance the data distribution, SeqGAN is used to generate semantically reasonable API sequences through reinforcement learning.

2. After completing the data processing, perform word embedding representation operation, and use Word2Vec to perform semantic vector representation on the API call sequence, converting discrete symbols into semantically rich numerical expressions; 3. Input the processed data into the malware classification module for model training and classification. The second step is a temporal convolutional network. Deep temporal feature extraction is performed on the API call sequence after word embedding to capture long-distance dependencies. The temporal convolutional network includes:

1. Causal Convolution It adopts a one-way structure, only using API call information at the current and historical moments to avoid future data interference and ensure temporal causality; Causal convolution combines the value of the next layer at time t with the value of the previous layer x. 1… x t The value is used to calculate y at time t of the previous layer. t Value, such that y t The value is close to the actual value, and the calculation method is shown in formula (1); In the formula, P(x) is the probability density function of the function, and T is the time delay.

2. Dilated convolution Three dilated convolutional layers are set up with hole coefficients of 1, 2 and 4 respectively. The receptive field is expanded by the interval sampling mechanism to capture the long-distance dependence of multi-stage malicious behavior. The calculation of the receptive field is shown in formula (2); RF=(K-1)×d+1 (2); In the formula, RF is the receptive field size, K is the convolution kernel size, and d is the hole coefficient; 3. Residual Module Each module contains two dilated convolutional layers, a weight normalization layer, and a dropout layer, which fuse initial features and deep features to avoid information loss and suppress overfitting. At the same time, it adapts the channel dimension differences through 1×1 convolution. The third step is the compression and excitation module. Weight calibration is performed on the multi-channel features output by the temporal convolutional network to enhance discriminative features and suppress redundant noise; The compression and excitation modules include:

1. Global Feature Compression Global average pooling is used to compress the sequence length of each channel into a channel descriptor vector, capturing the global statistical features of the channels; The feature map F∈R output by the temporal convolutional network L×C Perform global average pooling to compress the spatial dimension of each channel into a channel descriptor vector z∈R. C The calculation formula is shown in formula (3); In the formula, F(i,c) represents the feature value of the feature map at the i-th time step and the c-th channel, z c Here, H represents the global statistical feature of the c-th channel, H is the height of the feature map, and W is the width of the feature map.

2. Channel Dependency Modeling A two-layer fully connected network is used to perform nonlinear transformation on the descriptor z to learn the dependencies between channels. The calculation formulas are shown in formulas (4) and (5). f1=ReLU(E1·z+b1) (4); s=σ(W2·f1+b2)(5); In the formula, formula (4) represents the dimensionality reduction of the first fully connected layer. r is the dimensionality reduction ratio, b1 is the bias term, and formula (5) represents the dimensionality increase of the second fully connected layer. b2 is the bias term, σ is the sigmoid activation function, and the final generated channel attention weight vector s∈R C ; 3. Feature Channel Reweighting The channel attention weight S is multiplied with the original feature map F channel by channel to obtain the weighted feature map. The calculation formula is shown in formula (6). F′(i,c)=s c ×F(i,c) (6); In the formula, S c The importance weight of the c-th channel; Step 4, ChebyKAN 1. The ChebyKAN network is introduced to optimize the data processed by the temporal convolutional network and compression and activation modules, which solves the limitations of deep pattern mining and enhances the convergence robustness of the training process. The ChebyKAN network replaces the B spline function in the traditional KAN with Chebyshev polynomials and performs high-order nonlinear combination of input features through globally orthogonal polynomial basis functions.

2. The outer function of the KAN network is responsible for capturing global features, while the inner function performs fine fitting of local details through spline functions; the general form of the KAN network is shown in Equation (7); In the formula, φ q，p The domain of the single variable function representing the mapping input variable is [0,1], and its range is the set of real numbers R, φ q，p (x p ) represents a trainable activation function, Φ q Both the domain and the range are R; The internal function of formula (7) forms a KAN layer with n inputs and 2n+1 outputs, and the output function forms a KAN layer with 2n+1 inputs and n outputs. A residual activation strategy is proposed in KAN. By introducing the basis function b(x), the trainable activation function φ(x) is made, which is the sum of the basis function b(x) and the spline function spline(x), as shown in formula (8). φ(x)=w b b(x)+w s spline(x) (8); In the formula, w b and w s It is redundant and can be absorbed into b(x) and spline function spline(x), b(x) is set as SiLU function, as shown in formula (9); spline(x) is parameterized as a linear combination of B-spline curves, as shown in formula (10); In the formula, c i Denotes the trainable parameters, spline(x) is a combination of one-dimensional functions, and b i (x) is a predefined Base-spline basis function; during training, the spline parameters c i Continuous optimization is performed to adjust the spline shape in order to fit the training data; 3. Improved design based on Chebyshev polynomials By utilizing the good global approximation and orthogonality properties of Chebyshev polynomials, the B spline function in the traditional KAN is replaced, as shown in formula (11); In the formula, a k T represents the trainable parameters. k Let m be a Chebyshev polynomial of order k, where m is the order of the polynomial.

2. The malware multi-classification method based on the TCN-SE-ChebyKAN fusion model according to claim 1, characterized in that, In step one, the length of the API sequence is set to 150, and Word2Vec is used to perform semantic vector representation on the API call sequence, with the embedding layer dimension set to 100 dimensions.

3. The malware multi-classification method based on the TCN-SE-ChebyKAN fusion model according to claim 1, characterized in that, In step one, the raw data is the Mal-API-2019 malware.

4. The malware multi-classification method based on the TCN-SE-ChebyKAN fusion model according to claim 1, characterized in that, In step one, SeqGAN is used to generate semantically reasonable API sequences to expand the minority class samples so that the number of samples in each class of the balanced dataset is uniformly 1001. Then the dataset is divided into training set and test set in a ratio of 8:

2.

5. The malware multi-classification method based on the TCN-SE-ChebyKAN fusion model according to claim 1, characterized in that, In step two, the input is a 100-dimensional semantic vector after word embedding, and the output is a multi-channel temporal feature. The TCN output is input into the SE module, and the feature weights are optimized through the channel attention mechanism.

6. The malware multi-classification method based on the TCN-SE-ChebyKAN fusion model according to claim 1, characterized in that, In step three, the dimensionality reduction ratio r = 16.

Images