Malware classification method, system and storage medium based on feature space transformation

Abstract

The application provides a malware classification method and system based on feature space transformation and a storage medium, relates to the technical field of malware classification, and comprises the following steps: obtaining a binary byte sequence of malware to be classified, modeling the binary byte sequence as a Markov chain, and taking the value of a binary byte as the state of the Markov chain; constructing a state transition probability matrix based on the transition relationship of each state in the Markov chain, wherein the elements in the state transition probability matrix are used to represent the transition probability between bytes; applying a mapped feature space transformation to the state transition probability matrix to generate an enhanced feature map, wherein the feature space transformation adopts a power-law function to perform nonlinear mapping on each element in the matrix; and inputting the enhanced feature map into a pre-trained convolutional neural network model for feature extraction and classification to obtain the family classification result of the malware to be classified.

Description

Technical Field

[0001] This invention relates to the field of malware classification technology, specifically to a malware classification method, system, and storage medium based on feature space transformation. Background Technology

[0002] In recent years, with the rapid development of information technology, the number and variants of malware have exploded, posing a serious threat to cybersecurity. Malware often employs techniques such as packing, encryption, and obfuscation to evade detection, posing a significant challenge to traditional detection methods based on static or dynamic analysis. Static analysis methods rely on reverse engineering and feature extraction, but struggle to cope with code obfuscation and polymorphism techniques. While dynamic analysis methods can capture runtime behavior, their execution path coverage is limited and resource consumption is high. Furthermore, traditional machine learning methods heavily rely on manually designed features, resulting in high feature engineering costs and limited generalization capabilities, making them unsuitable for the rapid classification of massive amounts of malware.

[0003] In existing technologies, a malware classification method based on Markov graphs and deep learning, disclosed in CN111259397A, constructs a Markov image by modeling malware byte sequences as Markov chains and generating a state transition probability matrix, and then uses a custom deep convolutional neural network for classification. While this method reduces byte redundancy and avoids information loss due to image scaling to some extent, the generated Markov images suffer from visual defects such as sparse pixels and insufficient brightness, affecting the effectiveness of feature representation. Furthermore, this approach relies on a specifically designed network structure, lacks modularity and flexibility, and is difficult to adapt to the ever-evolving mainstream convolutional neural network architectures, limiting its generalization ability and practical value in real-world complex scenarios.

[0004] The information disclosed in the background section is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this invention is to provide a malware classification method, system, and storage medium based on feature space transformation, in order to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] The malware classification method based on feature space transformation includes the following steps:

[0008] Step 1: Obtain the binary byte sequence of the malware to be classified, and model the binary byte sequence as a Markov chain, where the state of the Markov chain corresponds to the value of the binary byte.

[0009] Step 2: Construct a state transition probability matrix based on the transition relationships of each state in the Markov chain, where the elements in the state transition probability matrix are used to characterize the transition probability between bytes;

[0010] Step 3: Apply the state transition probability matrix The feature space transformation of the mapping is used to generate an enhanced feature map, wherein the feature space transformation employs a power-law function to perform a nonlinear mapping on each element in the state transition probability matrix;

[0011] Step 4: Input the enhanced feature map into a pre-trained convolutional neural network model for feature extraction and classification to obtain the family classification result of the malware to be classified.

[0012] Furthermore, the specific execution process of step 1 is as follows:

[0013] First, the executable file of the malware to be classified is read, and the binary byte sequence in the file is extracted and represented as a random process. ,in: Represents the first byte in the binary byte sequence. bytes, The index is a byte, and , Its value is obtained by directly reading the byte data at the corresponding position in the binary byte sequence. This indicates the total number of bytes contained in the binary byte sequence;

[0014] Based on this random process Construct a Markov chain whose state space is represented as follows: ,in: Represents the first in the Markov chain A state, This represents the total number of states contained in the Markov chain;

[0015] The Markov chain satisfies the following state transition properties:

[0016] ;

[0017] in, Indicates before byte In the case of the first byte The conditional probability; Indicates that in the known number of... byte In the case of the first byte The conditional probability.

[0018] Furthermore, since each element in a binary byte is one byte, and the range it represents is... The Markov chain has 256 possible states, and a state transition probability matrix is ​​generated based on the transition probability of each state.

[0019] The state transition probability matrix The expression is as follows:

[0020] ;

[0021] in, The Line number Column elements Indicates from state Transition to state The probability of;

[0022] The calculation formula is as follows:

[0023] ;

[0024] In the formula, Representing state Following closely The probability of occurrence , ; For the summation index, .

[0025] Furthermore, the state transition probability matrix is ​​applied... The feature space transformation of the mapping employs a power-law function to perform a nonlinear mapping on each element in the matrix to generate an enhanced feature map;

[0026] The expression for the power-law function is as follows:

[0027] ;

[0028] In the formula, Represents the state transition probability matrix elements in go through The pixel values ​​obtained after the mapping transformation are used to construct the enhanced feature map; These are adjustment parameters for the power-law transform, used to control the intensity of the characteristic space transformation, and 255 is the pixel value normalization coefficient, used to normalize the pixel value. The calculation results are mapped to The integer interval;

[0029] Iterate through all elements in the state transition probability matrix, and substitute each element into the power law function to calculate the corresponding pixel value.

[0030] Finally, using the state transition probability matrix row index Column index To establish the correspondence, all calculated pixel values Arranged in the same index order, the structure forms a size of The enhanced feature map; where, in the enhanced feature map, the first Line number The pixel values ​​corresponding to each column are the state transition probability matrix. The Middle Line number Column elements go through The result after mapping transformation .

[0031] Furthermore, the specific execution process of step 4 is as follows:

[0032] First, the pre-trained convolutional neural network model is determined to be MobileNetV2, and the initial parameters of the model are the parameters obtained by pre-training on the ImageNet large-scale visual recognition dataset.

[0033] The enhanced feature map is subjected to format adaptation processing, specifically: the single-channel pixel data of the enhanced feature map is adjusted to the input dimension arrangement format required by MobileNetV2, without changing the pixel value size and the index correspondence of the enhanced feature map during the adaptation process;

[0034] The enhanced feature maps after adaptation are divided into training and test sets using 10-fold cross-validation combined with stratified sampling.

[0035] After training, the enhanced feature maps of the test set are adapted and input into the fine-tuned MobileNetV2 model. The model first extracts malware features from the enhanced feature maps through depthwise separable convolution and inverse residual structure, then integrates the extracted features through fully connected layers, and finally outputs the probability distribution of the samples to be classified belonging to each malware family through the softmax activation function. The malware family corresponding to the maximum value in the probability distribution is selected as the family classification result of the malware to be classified.

[0036] Furthermore, the classification performance of the fine-tuned MobileNetV2 model was measured by macro-average accuracy, recall, precision, and... Conduct an assessment;

[0037] The expression for the cross-entropy loss function used in training is as follows:

[0038] ;

[0039] In the formula, This represents the loss value for a single training session. This represents the total number of families of malware to be classified. An index for malware families; The true labels for the samples are obtained through manual annotation of sample family information. The annotation rule is: if a sample belongs to the family of samples... A family of malware, then ,otherwise ; This indicates that the model predicts the sample belongs to the first... The probability of each malware family is obtained from the output of the model's softmax layer;

[0040] Furthermore, using the calculated precision, recall, accuracy, and... The evaluation of the model is based on the following logic:

[0041] First, the values ​​of the four evaluation metrics corresponding to each round of the test set in the 10-fold cross-validation were collected, resulting in 10 raw data points for each evaluation metric. These evaluation metrics include accuracy, recall, precision, and... ;

[0042] Calculate the mean and standard deviation of the 10 raw data points for each set of evaluation indicators;

[0043] Set acceptable thresholds for the model, including accuracy threshold, recall threshold, precision threshold, and so on. Thresholds, and the standard deviation thresholds for each evaluation indicator;

[0044] The calculated average and standard deviation of the four evaluation metrics are compared with the acceptable thresholds: if the average of all evaluation metrics reaches or exceeds the corresponding threshold, and the standard deviations all meet the requirements, the model's classification performance is deemed acceptable, and it can be used for actual malware family classification tasks; if the average of any metric fails to reach the threshold, or the standard deviation of any metric exceeds the limit, the model's performance is deemed unacceptable, and the model returns to the fine-tuning stage, adjusting the initial learning rate of SGD, Mapping adjustment parameters Alternatively, retrain the model for a certain number of training cycles until the model evaluation results meet the acceptable threshold requirements.

[0045] Finally, the average value and standard deviation of the four evaluation indicators of the qualified model are recorded to form a model performance evaluation report, which provides a basis for subsequent model optimization and iteration.

[0046] The present invention also provides a malware classification system based on feature space transformation, wherein the malware classification system based on feature space transformation is used to perform the above-described malware classification method based on feature space transformation, comprising:

[0047] The byte sequence modeling module is used to obtain the binary byte sequence of the malware to be classified, and model the binary byte sequence as a Markov chain, wherein the state of the Markov chain corresponds to the value of the binary byte.

[0048] A transition matrix construction module is used to construct a state transition probability matrix based on the transition relationship of each state in the Markov chain, wherein the elements in the state transition probability matrix are used to characterize the transition probability between bytes;

[0049] The feature space transformation module is used to apply the state transition probability matrix. The feature space transformation of the mapping uses a power-law function to perform a nonlinear mapping on each element in the state transition probability matrix to generate an enhanced feature map.

[0050] The classification module is used to input the enhanced feature map into a pre-trained convolutional neural network model for feature extraction and classification, and the model outputs the family classification result of the malware to be classified.

[0051] The present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned malware classification method based on feature space transformation.

[0052] Compared with the prior art, the beneficial effects of the present invention are:

[0053] This invention introduces The feature space transformation mechanism of the mapping overcomes the visual defects of traditional Markov images, such as pixel sparsity and insufficient brightness. While preserving the state transition probability matrix, this transformation uses a power-law function to nonlinearly optimize the feature distribution, enhancing the visual discriminativeness and representational ability of the feature map, and providing more discriminative input features for subsequent deep learning models. Secondly, the feature space transformation unit proposed in this invention adopts a plug-and-play modular design, independent of the calculation process of the state transition probability matrix, and can seamlessly integrate various Markov graph-based frameworks and mainstream convolutional neural network architectures. This design gives the solution excellent architectural flexibility and model compatibility, enabling it to quickly adapt to and fully utilize advanced lightweight networks such as MobileNetV2, ensuring high classification accuracy while taking into account computational efficiency and deployment convenience. Attached Figure Description

[0054] Figure 1 This is a schematic diagram of the overall method flow of the present invention;

[0055] Figure 2 for A schematic diagram illustrating the influence of the value on the state transition probability matrix;

[0056] Figure 3 for A diagram illustrating the impact of values ​​on evaluation indicators;

[0057] Figure 4 This is a schematic diagram of the overall system modules of the present invention. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments.

[0059] It should be noted that, unless otherwise defined, the technical or scientific terms used in this invention should have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0060] Example:

[0061] Please see Figures 1-3 The present invention provides a technical solution:

[0062] A malware classification method based on feature space transformation, comprising the following steps:

[0063] Step 1: Obtain the binary byte sequence of the malware to be classified, and model the binary byte sequence as a Markov chain, where the state of the Markov chain corresponds to the value of the binary byte.

[0064] In this embodiment, the specific execution process of step 1 is as follows:

[0065] First, the executable file of the malware to be classified is read, and the binary byte sequence in the file is extracted. Specifically, the executable file of the malware to be classified is opened in binary read-only mode, and all contents are read from the beginning of the file to the end of the file as a continuous byte stream to form the original binary byte sequence.

[0066] Representing the binary byte sequence as a random process ,in: Represents the first byte in the binary byte sequence. bytes, The index is a byte, and , Its value is obtained by directly reading the byte data at the corresponding position in the binary byte sequence. This indicates the total number of bytes contained in the binary byte sequence;

[0067] Based on this random process Construct a Markov chain whose state space is represented as follows: ,in: Represents the first in the Markov chain A state, This represents the total number of states contained in the Markov chain. ;

[0068] The Markov chain satisfies the following state transition properties:

[0069] ;

[0070] in, Indicates before byte In the case of the first byte The conditional probability; Indicates that in the known number of... byte In the case of the first byte The conditional probability.

[0071] Equation The existence of this condition means that the probability distribution of the next state depends only on the current state and is independent of earlier historical states. This characteristic is the theoretical basis for the subsequent construction of the state transition probability matrix. It assumes that the dependency between adjacent bytes in malware code is the most important factor.

[0072] Step 1 involves parsing the executable file of malware into a binary byte sequence and modeling it as a random process with Markov properties. This transforms the static binary content of malware into a mathematical model capable of capturing the transition patterns between its internal bytes. Malware families typically share similar code structures and execution logic, and their binary byte transition patterns often exhibit family specificity. This modeling process is based on this characteristic. By establishing a Markov chain, this invention can extract discriminative state transition features from the original, seemingly disordered binary data, providing a mathematical foundation for the subsequent construction of the state transition probability matrix. This achieves an effective conversion from the original byte sequence to a structured feature representation.

[0073] Step 2: Construct a state transition probability matrix based on the transition relationships of each state in the Markov chain, where the elements in the state transition probability matrix are used to characterize the transition probability between bytes;

[0074] In this embodiment, since each element in the binary byte is one byte, and the range it represents is... The Markov chain has 256 possible states. A state transition probability matrix is ​​generated based on the transition probability of each state. That is, each state of the Markov chain directly corresponds to a byte value, therefore its state space... Size Fixed at 256, correspondingly, the state transition probability matrix... Defined as a Array;

[0075] The state transition probability matrix The expression is as follows:

[0076] ;

[0077] in, The Line number Column elements Indicates from state Transition to state The probability of;

[0078] The calculation formula is as follows:

[0079] ;

[0080] In the formula, Representing state Following closely The probability of occurrence, i.e., from state Transition to state The actual number of occurrences, , ; Indicates from state The sum of all transition frequencies from the starting point, i.e., all frequencies of the form... The sum of the number of occurrences of each byte pair; The summation index is used to iterate through all possible byte values. ;

[0081] The specific statistical method is: traversing the random process. The first byte to the second byte 1 byte, for each position Check byte pairs ,if and Then count Increasing by 1, this process is for constructing the state transition probability matrix. The raw statistics are provided.

[0082] The physical meaning of this formula is that, in all states... In the transition from departure, the transition to state The proportion, denominator Indicates from state The total number of times the data was transferred out, i.e., all bytes in the sequence. The number of consecutive byte pairs at the beginning; for a matrix any line The sum of all its elements satisfies This ensures that from each state The sum of the probabilities of transitioning to all possible states is 1, which conforms to the axioms of probability distribution.

[0083] Step 2 transforms the Markov chain state transition relationship established in the previous step into a specific numerical probability representation. This is achieved by statistically analyzing the frequency of each byte's state transition to another state and normalizing it into a probability value, thus forming... State transition probability matrix This process essentially encodes the dynamic execution characteristics of malware into a fixed-dimensional mathematical representation; matrix. elements Quantization from byte value Transfer to byte value The statistical regularity can effectively capture the differences in code structure, instruction sequence and other features of different malware families, providing accurate mathematical input for subsequent feature space transformation, while avoiding the information loss problem in traditional grayscale image methods.

[0084] Step 3: Apply the state transition probability matrix The feature space transformation of the mapping is used to generate an enhanced feature map, wherein the feature space transformation employs a power-law function to perform a nonlinear mapping on each element in the state transition probability matrix;

[0085] In this embodiment, the state transition probability matrix is ​​applied... The feature space transformation of the mapping employs a power-law function to perform a nonlinear mapping on each element in the matrix to generate an enhanced feature map;

[0086] The expression for the power-law function is as follows:

[0087] ;

[0088] In the formula, Represents the state transition probability matrix elements in go through The pixel values ​​obtained after the mapping transformation are used to construct the enhanced feature map; These are adjustment parameters for the power-law transform, used to control the intensity of the characteristic space transformation, and 255 is the pixel value normalization coefficient, used to normalize the pixel value. The calculation results are mapped to The integer interval;

[0089] This invention applies the state transition probability matrix Mapping is used to optimize feature distribution, avoiding truncation of pixel values ​​to 0 in the feature map while ensuring that large gray values ​​do not overflow. The core idea of ​​the mapping function is to apply a power-law transformation to the state transition probability matrix, that is... ,in It is a positive real number parameter; It is an adjustable hyperparameter used to alleviate the paradox between the mathematical semantics of the state transition probability matrix and the recognition paradigm of visual perception. Visually, when At this time, the lower the gray value of a pixel, the more obvious the enhancement effect. This stems from the preservation of low-frequency state transitions and the relative suppression of high-frequency noise by feature space transformation. Unlike traditional image enhancement techniques that distort the semantics of the state transition probability matrix based on texture adjustment, The mapping strictly preserves mathematical semantics while optimizing the image feature space. As a fundamental methodological contribution, it links mathematical semantics with the visual recognition requirements in malware classification.

[0090] Please see Figure 2 It showcases different The value pair state transition probability matrix is ​​processed The visual impact of the enhanced feature maps generated after mapping; where sub-images (a) to (f) respectively correspond to The enhancement effect of the feature map is shown when the values ​​are 1.0, 0.9, 0.7, 0.5, 0.3, and 0.1. From sub-images (a) to (f), it can be seen that as... As the value decreases, the darker or sparser areas in the feature map gradually reveal more details, the pixel distribution becomes more uniform, and the visual contrast is significantly improved. This effectively alleviates the pixel sparsity and insufficient brightness problems existing in traditional Markov images, and provides more discriminative input features for subsequent convolutional neural networks.

[0091] Iterate through all elements in the state transition probability matrix, and substitute each element into the power law function to calculate the corresponding pixel value.

[0092] Finally, using the state transition probability matrix row index Column index To establish the correspondence, all calculated pixel values Arranged in the same index order, the structure forms a size of The enhanced feature map; where, in the enhanced feature map, the first Line number The pixel values ​​corresponding to each column are the state transition probability matrix. The Middle Line number Column elements go through The result after mapping transformation .

[0093] Step 3 using the power-law function By performing a nonlinear transformation on each element of the state transition probability matrix, the pixel sparsity and insufficient brightness problems of traditional Markov images are effectively solved; specifically, when At the same time, this transformation amplifies the probability values ​​of smaller values, significantly improving the visibility of these features, while relatively suppressing high-frequency noise. This nonlinear mapping, while strictly preserving the semantic integrity of the state transition, readjusts the originally unevenly distributed probability values ​​to a range more suitable for visual perception, generating enhanced feature maps with higher contrast and discriminativeness. This provides higher-quality, more feature-clear input images for subsequent convolutional neural networks, thereby significantly improving the recognition ability of classification models.

[0094] Step 4: Input the enhanced feature map into a pre-trained convolutional neural network model for feature extraction and classification to obtain the family classification result of the malware to be classified;

[0095] In this embodiment, the specific execution process of step 4 is as follows:

[0096] First, the pre-trained convolutional neural network model is determined to be MobileNetV2, and the initial parameters of the model are the parameters obtained by pre-training on the ImageNet large-scale visual recognition dataset.

[0097] The enhanced feature map is subjected to format adaptation processing, specifically: the single-channel pixel data of the enhanced feature map is adjusted to the input dimension arrangement format required by MobileNetV2, without changing the pixel value size and the index correspondence of the enhanced feature map during the adaptation process;

[0098] The enhanced feature maps after adaptation are divided into training and test sets using 10-fold cross-validation combined with stratified sampling.

[0099] The pre-trained MobileNetV2 model was fine-tuned. The specific training process was as follows: the batch size was set to 64, the training epochs to 20, and the training loss was calculated using the cross-entropy loss function. Simultaneously, the stochastic gradient descent (SGD) algorithm was used to optimize the model parameters. The initial learning rate of SGD was set to 0.01, the weight decay parameter to 0.0005, and the momentum parameter to 0.9. During training, an exponential decay learning rate scheduling strategy with a decay rate of 0.9 was adopted. At the end of each training epoch, the order of samples in the training set was shuffled to avoid overfitting due to repeated learning of a fixed sample order. After training, the adapted enhanced feature maps from the test set were input into the fine-tuned MobileNetV2 model. The model first extracted malware features from the enhanced feature maps using depthwise separable convolutions and inverse residual structures, then integrated the extracted features through fully connected layers, and finally output the probability distribution of the samples to be classified belonging to each malware family using a softmax activation function. The malware family corresponding to the maximum value in the probability distribution was selected as the family classification result of the malware to be classified.

[0100] The classification performance of the fine-tuned MobileNetV2 model is measured by macro-average accuracy, recall, precision, and... Conduct an assessment;

[0101] The expression for the cross-entropy loss function used in training is as follows:

[0102] ;

[0103] In the formula, This represents the loss value for a single training session. This represents the total number of families of malware to be classified. An index for malware families; The true labels for the samples are obtained through manual annotation of sample family information. The annotation rule is: if a sample belongs to the family of samples... A family of malware, then ,otherwise ; This indicates that the model predicts the sample belongs to the first... The probability of each malware family is obtained from the output of the model's softmax layer.

[0104] The cross-entropy loss function measures the difference between the model's predicted probability distribution and the true label distribution. It is a commonly used loss function in classification tasks. The core idea of ​​this function is that the higher the model's predicted probability of the true class, the lower the loss value; conversely, the lower the predicted probability, the higher the loss value.

[0105] The formula used to calculate the model's accuracy is as follows:

[0106] ;

[0107] In the formula, For model accuracy, The number of true positive samples refers to the number of samples that actually belong to a certain malware family and were correctly predicted by the model. The number of true negative samples refers to the number of samples that are not actually from a particular malware family and that the model correctly predicted. The number of false positive samples refers to the number of samples that are not actually from a certain malware family but are predicted by the model to be from that family. The number of false negative samples refers to the number of samples that are actually from a certain malware family but were incorrectly predicted by the model.

[0108] Accuracy is a core metric for evaluating the overall performance of a classification model. It measures the proportion of samples in which the model makes correct predictions, i.e., the ratio of correctly classified samples to the total number of samples. In this formula, the dependent variable... It is influenced by four independent variables, including: the number of true positive samples. and the number of true negative samples For correctly predicted samples, the larger the value, the higher the accuracy; while the number of false positive samples... and the number of false negative samples As a sample that is incorrectly predicted, an increase in its value will directly lower the accuracy. Therefore, the accuracy depends on the model's overall performance in correctly classifying both positive and negative samples, and can intuitively reflect the model's overall discrimination effect.

[0109] The formula used to calculate the recall rate of the model is as follows:

[0110] ;

[0111] In the formula, For model recall;

[0112] Recall measures a model's ability to identify all positive samples; that is, the proportion of samples that are actually positive that the model can correctly predict. It focuses on the model's recall capability and avoids false negatives. The independent variable in the formula... It has a positive effect on the recall rate of the dependent variable. The higher the recall rate, the higher the recall rate; and This represents the number of false negative samples, indicating positive samples missed by the model, and has a negative impact on recall. The more samples a sample has, the lower the recall rate. Therefore, the key to improving recall lies in optimizing the model to reduce the number of positive samples misclassified as negative samples.

[0113] The formula used to calculate the accuracy of the model is as follows:

[0114] ;

[0115] In the formula, For model accuracy;

[0116] Precision measures the accuracy of a model's predictions; that is, the proportion of samples that are actually positive out of all those predicted as positive by the model. It focuses on the reliability of the model's predictions and avoids false positives. The independent variable in the formula... It has a positive effect on the accuracy of the dependent variable; while This represents the number of false positive samples, indicating negative samples that were incorrectly classified as positive by the model. It has a negative impact on accuracy. The more negative samples a model has, the lower its accuracy becomes. Therefore, the key to improving accuracy lies in optimizing the model to reduce the number of negative samples that are misclassified as positive samples (i.e., reducing false positives).

[0117] calculate The formula used is as follows:

[0118] ;

[0119] It is the harmonic mean of recall and precision, used to comprehensively evaluate model performance, especially when the positive and negative sample distributions are imbalanced. It reflects the true performance of the model better than precision, seeking a balance between recall and precision; the independent variable in the formula is... and Together they determine the dependent variable The magnitude of the value, if the value of either side is too low, will significantly reduce the overall value. Therefore, a high This usually means that the model has achieved a good balance between recall and precision, and is an important indicator for evaluating the overall performance of a classification model.

[0120] Using the calculated precision, recall, and accuracy The evaluation of the model is based on the following logic:

[0121] First, the values ​​of the four evaluation metrics corresponding to each round of the test set in the 10-fold cross-validation were collected, resulting in 10 raw data points for each evaluation metric. These evaluation metrics include accuracy, recall, precision, and... ;

[0122] Calculate the mean and standard deviation of the 10 raw data points for each set of evaluation indicators;

[0123] Set acceptable thresholds for the model, including accuracy threshold, recall threshold, precision threshold, and so on. Thresholds, and the standard deviation thresholds for each evaluation indicator;

[0124] The calculated average and standard deviation of the four evaluation metrics are compared with the acceptable thresholds: if the average of all evaluation metrics reaches or exceeds the corresponding threshold, and the standard deviations all meet the requirements, the model's classification performance is deemed acceptable, and it can be used for actual malware family classification tasks; if the average of any metric fails to reach the threshold, or the standard deviation of any metric exceeds the limit, the model's performance is deemed unacceptable, and the model returns to the fine-tuning stage, adjusting the initial learning rate of SGD, Mapping adjustment parameters Alternatively, retrain the model for a certain number of training cycles until the model evaluation results meet the acceptable threshold requirements.

[0125] Finally, the average value and standard deviation of the four evaluation indicators of the qualified model are recorded to form a model performance evaluation report, which provides a basis for subsequent model optimization and iteration.

[0126] This embodiment uses the benchmark malware classification datasets Malimg and BIG-2015 for experimental evaluation. The Malimg dataset contains 9,339 samples belonging to 25 malware families, and the sample distribution is shown in Table 1. The Microsoft malware dataset BIG-2015 was released by Microsoft in 2015 during a malware classification competition held on Kaggle. This dataset contains 10,868 malware samples belonging to 9 families, and the sample distribution is shown in Table 2.

[0127] Table 1: Sample distribution of the Malimg dataset

[0128]

[0129] Table 2: Sample Distribution of the BIG-2015 Dataset

[0130]

[0131] Based on Tables 1 and 2, and combined with Figure 2 and Figure 3 The experimental results shown can be obtained as follows: The setting of the value has a significant impact on classification performance; Figure 2 The display shows that when As the value gradually decreases from 1.0, the proportion of effective pixels in the enhanced feature map shows a significant upward trend, indicating that... Mapping effectively alleviates the sparsity problem of traditional Markov images, especially in... Within the interval, the visual quality of the feature map is significantly improved, providing richer feature information for subsequent classification;

[0132] Figure 3 Further revealed The non-linear relationship between the value and classification performance, when Value at When left and right, the model's accuracy and All values ​​reached their peak values, indicating that moderate feature space transformation can effectively improve classification performance; however, when the γ value is too small, performance declines, suggesting that excessive transformation may destroy useful information from the original feature distribution. This finding provides... The optimized selection of parameters provides an important basis for ensuring the best balance between feature enhancement and classification performance.

[0133] Step 4 utilizes a pre-trained MobileNetV2 model to perform end-to-end feature learning and classification decisions on the enhanced feature maps. Through its depthwise separable convolutions and inverse residual structures, it efficiently extracts deep visual features of malware. Specifically, MobileNetV2 can extract deep visual features from the enhanced feature maps... The model automatically learns discriminative features of different malware families in terms of texture, structure, and spatial patterns from the enhanced feature maps obtained through mapping optimization. By combining transfer learning and fine-tuning strategies, the model adapts the general visual knowledge learned from ImageNet to the malware classification task, and finally achieves high-precision family classification through softmax output, ensuring both classification accuracy and computational efficiency.

[0134] Please see Figure 4 The present invention also provides a malware classification system based on feature space transformation, comprising:

[0135] The byte sequence modeling module is used to obtain the binary byte sequence of the malware to be classified, and model the binary byte sequence as a Markov chain, wherein the state of the Markov chain corresponds to the value of the binary byte.

[0136] A transition matrix construction module is used to construct a state transition probability matrix based on the transition relationship of each state in the Markov chain, wherein the elements in the state transition probability matrix are used to characterize the transition probability between bytes;

[0137] The feature space transformation module is used to apply the state transition probability matrix. The feature space transformation of the mapping uses a power-law function to perform a nonlinear mapping on each element in the state transition probability matrix to generate an enhanced feature map.

[0138] The classification module is used to input the enhanced feature map into a pre-trained convolutional neural network model for feature extraction and classification, and the model outputs the family classification result of the malware to be classified.

[0139] The present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned malware classification method based on feature space transformation.

[0140] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0141] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented in software, the above embodiments can be implemented, in whole or in part, as a computer program product. Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution.

[0142] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0143] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A malware classification method based on feature space transformation, characterized in that, The specific steps include: Step 1: obtaining a binary byte sequence of a malware to be classified, modeling the binary byte sequence as a Markov chain, and the state of the Markov chain corresponding to the value of the binary byte; Step 2: constructing a state transition probability matrix based on the transition relationship of each state in the Markov chain, wherein the elements in the state transition probability matrix are used to represent the transition probability between bytes; Step 3: Apply the state transition probability matrix The feature space transformation of the mapping is used to generate an enhanced feature map, wherein the feature space transformation employs a power-law function to perform a nonlinear mapping on each element in the state transition probability matrix; Step 4: inputting the enhanced feature map into a pre-trained convolutional neural network model for feature extraction and classification to obtain the family classification result of the malware to be classified; The specific execution process of step 4 is as follows: First, determine that the pre-trained convolutional neural network model is MobileNetV2, and the initial parameters of the model are the parameters pre-trained on the ImageNet large-scale visual recognition dataset; The format adaptation process of the enhanced feature map is as follows: adjust the single-channel pixel data of the enhanced feature map to the input dimension arrangement format required by MobileNetV2, and do not change the pixel value size and index correspondence of the enhanced feature map during the adaptation process; Divide the enhanced feature map after adaptation into a training set and a test set by 10-fold cross-validation combined with stratified sampling; After training, input the enhanced feature map after adaptation of the test set into the fine-tuned MobileNetV2 model. The model first extracts malware features in the enhanced feature map through depth separable convolution and reverse residual structure, then integrates the extracted features through a fully connected layer, and finally outputs the probability distribution of the classified sample belonging to each malware family through a softmax activation function, and selects the malware family corresponding to the maximum value in the probability distribution as the family classification result of the malware to be classified.

2. The feature space transformation based malware classification method of claim 1, wherein: The specific execution process of step 1 is as follows: First, an executable file of malware to be classified is read, and a binary byte sequence in the file is extracted, and the binary byte sequence is expressed as a random process wherein represents the i-th byte in the binary byte sequence, i is an index of the byte, and , , a value of which is obtained by directly reading byte data at a corresponding position in the binary byte sequence, represents a total number of bytes included in the binary byte sequence; Based on this random process Construct a Markov chain whose state space is represented as follows: ,in: Represents the first in the Markov chain One state, This represents the total number of states contained in the Markov chain; The Markov chain satisfies the following state transition characteristics: wherein represents the conditional probability that the first byte is given that the second byte is represents the conditional probability that the first byte is given that the second byte is given that the third byte is​​​​​ 3. The feature space transformation based malware classification method of claim 2, wherein: Since each element in the binary byte is a byte, and the range represented is Therefore, the Markov chain has 256 possible states, and a state transition probability matrix is generated according to the transition probability of each state. The state transition probability matrix The expression is as follows: wherein, the first row of the column element represents the probability of transitioning from state to state ; The calculation formula is as follows: wherein indicates a state immediately following the state probability of occurrence, , ; is a summation index, 4. The feature space transformation based malware classification method of claim 3, wherein: Apply to the state transition probability matrix The feature space transformation of the mapping uses a power-law function to perform a nonlinear mapping on each element in the state transition probability matrix to generate an enhanced feature map. The expression of the power law function is as follows: In the formula, represents the state transition probability matrix element in the matrix after mapping transformation, which is used to constitute the enhanced feature map; is an adjustment parameter of the power-law transformation, which is used to control the intensity of the feature space transformation, and 255 is a pixel value normalization coefficient, which is used to map the calculation result of to the integer interval of . Iterate through all elements in the state transition probability matrix, and calculate each element in the matrix by substituting it into the power law function one by one to obtain the corresponding pixel value; Finally, using the state transition probability matrix row index Column index To establish the correspondence, all calculated pixel values Arranged in the same index order, the structure forms a size of The enhanced feature map; where, in the enhanced feature map, the first Line number The pixel values ​​corresponding to each column are the state transition probability matrix. The Middle Line number Column elements go through The result after mapping transformation .

5. The feature space transformation based malware classification method of claim 4, wherein: The classification performance of the fine-tuned MobileNetV2 model is evaluated by macro-averaged accuracy, recall, precision and F1-score of the 4 classes. The results are shown in Table 2. Table 2: Classification performance of the fine-tuned MobileNetV2 model on the test set The expression of the cross-entropy loss function used in training is as follows: In the formula, is the loss value of single training, is the total number of categories of the malware family to be classified, is the index of the malware family; is the true label of the sample, which is obtained by manually labeling the sample family information, and the labeling rule is: if the sample belongs to the th malware family, then , otherwise ; represents the probability that the model predicts that the sample belongs to the th malware family, which is obtained from the output of the model softmax layer.

6. The feature space transformation based malware classification method of claim 5, wherein: The accuracy, recall, precision, and F1-score obtained by calculation are used to evaluate the model, and the specific logic is as follows: First, the four evaluation index values corresponding to each test set in the 10-fold cross-validation are collected to obtain 10 original data for each set of evaluation indexes, including accuracy, recall, precision, and ; Calculate the average and standard deviation of the 10 original data of each evaluation index respectively; Set the qualified threshold of the model, including the accuracy threshold, recall threshold, precision threshold, F1-score threshold, and standard deviation threshold of each evaluation index; The average values and standard deviations of the four evaluation indexes calculated are compared with the qualified threshold values: if all the average values of the evaluation indexes reach or exceed the corresponding threshold values and the standard deviations meet the requirements, it is determined that the model classification performance is qualified, and it is used for actual malware family classification tasks; if the average value of any index does not reach the threshold value or the standard deviation of any index exceeds the limit, it is determined that the model performance is unqualified, and the model fine-tuning stage is returned, and the initial learning rate of the SGD is adjusted, adjusted parameters of mapping or the number of training cycles is retrained until the model evaluation result meets the qualified threshold value requirement; Finally, record the average and standard deviation of the four evaluation indexes of the qualified model to form a model performance evaluation report, which provides a basis for subsequent model optimization iteration.

7. A malware classification system based on feature space transformation, characterized by: The malware classification system based on feature space transformation is used to execute the malware classification method based on feature space transformation of any one of claims 1-6, comprising: a byte sequence modeling module configured to obtain a binary byte sequence of the malware to be classified, and model the binary byte sequence as a Markov chain, wherein a state of the Markov chain corresponds to a value of a binary byte; a transition matrix constructing module configured to construct a state transition probability matrix based on a transition relationship of each state in the Markov chain, wherein an element in the state transition probability matrix is used to represent a transition probability between bytes; a feature space transformation module to apply a mapped feature space transformation that non-linearly maps each element in the state transition probability matrix with a power law function to generate an enhanced feature map; a classification module configured to input the enhanced feature map into a pre-trained convolutional neural network model for feature extraction and classification, and output a family classification result of the malware to be classified by the model.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program, when executed by a processor, implements the malware classification method based on feature space transformation according to any one of claims 1-6.

Images