An Optimization Method for ELF Malware Detection Features Based on Potential Energy Rewards

Abstract

This invention relates to an ELF malware detection feature optimization method based on fusion potential energy reward shaping, comprising: S100: collecting ELF samples and extracting multi-dimensional static features, and preprocessing the dataset; S200: constructing a reinforcement learning module based on the dataset using fusion potential energy reward shaping. The reinforcement learning module includes a state space, an action space, state transition rules, a reward function, and an agent. The agent perceives the current environment through the state space, selects an action from the action space based on the current environment, executes the action, updates the environment according to the state transition rules, thereby obtaining a new state. The reward function calculates the reward based on the change from the current environment to the new state. The agent updates the Q-table with the reward, ultimately forming an optimal subset of features that can be output. The purpose of this invention is to achieve multi-objective collaborative optimization of feature selection and alleviate the performance imbalance problem of traditional feature selection methods in malware detection.

Description

Technical Field

[0001] This invention relates to a malware detection method, specifically to an ELF malware detection feature optimization method that incorporates potential energy reward shaping. Background Technology

[0002] Currently, static detection methods for ELF format malware mainly rely on high-dimensional feature extraction and machine learning models, but traditional feature selection techniques have significant limitations. Filtering methods (such as mutual information, chi-square test, and information gain), for example, Farrukh Shahzad uses information gain-based feature ranking to sort 300+ dimensions of features. While computationally efficient, filtering methods do not consider model performance, resulting in insufficient generalization ability of feature subsets. Wrapping methods, such as the introduction of genetic algorithm evolution mechanisms in Android malware detection, aim for classification accuracy but have huge computational overhead and low iterative efficiency, making it difficult to adapt to the dynamic correlation of ELF file features. Genetic algorithms, for instance, while aiming for classification accuracy, have huge computational overhead and are prone to getting trapped in local optima.

[0003] In recent years, reinforcement learning has shown potential in feature selection. For example, the DroidRL framework uses the DDQN algorithm to optimize feature selection for Android malware. However, its RNN decision network design relies on feature ranking and word embedding, which cannot be directly transferred to ELF file analysis. Structured features in ELF format, such as segments and dynamic links, have strong domain specificity, and existing methods have not addressed the issues of nonlinear dependencies between features and sensitivity to false positive rates. Furthermore, traditional reward functions only consider accuracy and the number of features, neglecting the crucial performance balance in malware detection (such as recall and false positive rate).

[0004] Therefore, there is an urgent need for a lightweight feature selection method for ELF malware detection that can dynamically balance detection performance and feature complexity, while overcoming the shortcomings of existing technologies such as low computational efficiency, poor adaptability, and neglect of key indicators such as recall and false positive rate. Summary of the Invention

[0005] The main objective of this invention is to provide an ELF malware detection feature optimization method that integrates potential energy reward shaping. The core of this method is to extract multi-dimensional features from ELF files from different dimensions (such as header information and segment information), model the multi-dimensional feature selection process as a Markov decision process (MDP), and dynamically optimize the feature subset using a reinforcement learning Q-learning algorithm. The optimal feature subset is determined by continuously adding and deleting features from different groups. In the reinforcement learning module, a potential energy reward shaping mechanism (PBRS) that integrates domain knowledge is designed. This mechanism comprehensively considers multiple objectives such as accuracy, feature data, detection rate, and false positive rate, achieving multi-objective collaborative optimization of feature selection and alleviating the performance imbalance problem of traditional feature selection methods in malware detection.

[0006] To achieve the above objectives, this invention provides an ELF malware detection feature optimization method that incorporates potential energy reward shaping, comprising the following steps:

[0007] S100: Data Processing

[0008] Collect ELF samples and extract multidimensional static features to form a dataset. Preprocess the dataset to obtain training set, validation set and test set;

[0009] S200: Constructing a reinforcement learning module:

[0010] Based on the dataset obtained from S100, a reinforcement learning module that integrates potential energy and reward shaping is constructed. The reinforcement learning module includes a state space, an action space, state transition rules, a reward function, and an agent. The agent perceives the current environment through the state space, selects an action from the action space based on the current environment, updates the environment according to the state transition rules after the agent executes the action, and obtains a new state. The reward function calculates the reward based on the change from the current environment to the new state, and the agent updates the Q-table with the reward to optimize the "state-action" mapping and finally form the optimal feature subset that can be output.

[0011] In step S200, the state space is defined as follows:

[0012] ,in,

[0013] , This represents the proportion of currently selected features out of the total number of features, and is used to measure model complexity. K represents the number of features currently selected, and K represents the total number of features.

[0014] This represents the accuracy of the model trained on the validation set under the current feature subset, used to reflect detection performance.

[0015] Preferably, the data processing step S100 specifically includes:

[0016] S110: Data Acquisition Unit

[0017] Malicious ELF samples were collected from publicly available malicious sample libraries, and benign ELF samples were collected from the official Linux source. The ratio of benign to malicious samples was 1:1.

[0018] S120: Feature extraction unit:

[0019] The pyelftools library is used to parse each ELF file and extract six categories of static features: header information, section information, dynamic information, entropy information, string information, and disassembly information.

[0020] S130: Preprocessing unit:

[0021] Missing values ​​in the dataset were filled using the median, and the dataset was divided into training, validation, and test sets proportionally.

[0022] More preferably, in step S200,

[0023] The motion space includes the following five categories of motion, with a total of 2M+2K+1 motions.

[0024] In the formula, M is the number of feature groups, and K is the total number of features;

[0025] The five main categories of operation actions are as follows:

[0026] Add Feature Group: Adds all features of a given group to the current feature subset;

[0027] Remove Feature Group: Removes all features of a given group from the current feature subset;

[0028] Add a single feature: Adds the specified single feature to the current feature subset;

[0029] Remove a single feature: Removes the specified single feature from the current feature subset;

[0030] Maintain the current state: that is, do not perform any operation.

[0031] More preferably, in step S200,

[0032] The state transition rule is as follows: after the agent performs an action, it updates the feature subset. If the feature subset changes, the machine learning model is trained, and the accuracy, recall, and false positive rate are evaluated on the validation set before entering the next state.

[0033] More preferably, in step S200,

[0034] The reward function includes a basic reward, a potential reward, and a total reward, where,

[0035] Total reward = base reward + potential energy reward.

[0036] A further optimized formula for calculating the basic reward is:

[0037] ,

[0038] in, As a reward for performance changes, ， in Weighting for performance changes;

[0039] Penalty for the number of features, ,in This represents the change in the number of features; increasing a feature incurs a penalty, while decreasing a feature incurs a reward. The feature complexity weights are denoted by t, and the subscripts t and t+1 represent the periods before and after the agent performs the action, respectively.

[0040] A further optimized formula for calculating potential energy reward is:

[0041] ,

[0042] in, As a potential energy reward, The discount factor is applied if the next state does not change, and the subscripts t and t+1 represent the period before and after the agent performs the action, respectively.

[0043] and Let be the potential energy function.

[0044] Furthermore, the formula for calculating the potential energy function before the agent performs an action is as follows:

[0045] ,

[0046] in,

[0047] The characteristic economic potential energy is calculated using the following formula:

[0048] ,

[0049] In the formula, The proportion of selected features. This represents the range of proportions of gold-specific characteristics. and These are the critical thresholds for too few and too many features, respectively. The range is [0,1]. The characteristic economic potential energy reward is greater than 0;

[0050] To detect the performance potential energy, its calculation formula is as follows:

[0051] ,

[0052] In the formula, The detection accuracy of the current feature subset. and These represent the high-performance and low-performance thresholds, ranging from [0,1]. To detect potential energy rewards, all values ​​are greater than 0;

[0053] The formula for calculating the potential energy of false alarm risk is as follows:

[0054] ,

[0055] In the formula, The current false alarm rate, A linear penalty mechanism is used as the tolerance threshold for false alarm rate. The false alarm risk adjustment coefficient is greater than 0.

[0056] To calculate the cost potential energy, the formula is as follows:

[0057] ,

[0058] In the formula, This is a set of features with high computational overhead. The current feature subset before the agent performs an action. For indicator functions, The cost potential energy adjustment coefficient is greater than 0.

[0059] After the agent performs an action, the potential energy function The calculation formula and The calculation formula is the same.

[0060] More preferably, the termination condition of the agent in step S200 includes any of the following:

[0061] The agent reaches the set maximum number of steps;

[0062] The current feature subset is empty;

[0063] The detection rate exceeds the set threshold, the false alarm rate is lower than the set threshold, and the number of features is lower than the set threshold.

[0064] The beneficial effects of this invention are as follows:

[0065] 1. By modeling the feature selection process as a Markov decision process and using reinforcement learning for dynamic optimization, it can adaptively capture the complex correlations and nonlinear dependencies between features of ELF files, effectively overcoming the limitations of traditional filtering and wrapping methods in feature interaction modeling, and improving the discriminative ability and generalization performance of feature subsets.

[0066] 2. The potential reward shaping mechanism (PBRS) that integrates domain knowledge is introduced, which incorporates the multi-objective collaborative optimization problem of accuracy, recall, false positive rate, and feature quantity into the reward function design. This significantly improves the problem of traditional methods that only focus on classification accuracy while ignoring false positive risk and model lightweighting, and achieves a balance between detection efficiency and practicality.

[0067] 3. The action space supports high-dimensional operations such as adding and deleting "group features", which greatly improves search efficiency, reduces computational overhead, and avoids getting trapped in local optima. It is especially suitable for feature types with obvious structural grouping characteristics in ELF format, so that the method has good scalability and engineering feasibility while maintaining a high degree of search freedom.

[0068] 4. This invention has strong portability and adaptability. It is not only applicable to ELF malware detection scenarios, but its potential energy reward-based multi-objective optimization mechanism and group feature operation design can also provide technical reference for other binary file formats or high-dimensional feature selection problems, and has broad application prospects. Detailed Implementation

[0069] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Many specific details are set forth in the following description to provide a thorough understanding of the present invention; however, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0070] This embodiment provides an ELF malware detection feature optimization method that integrates potential energy reward shaping, including the following steps:

[0071] S100: Data Processing

[0072] ELF samples are collected and multidimensional static features are extracted to form a dataset. The dataset is then preprocessed to obtain a training set, a validation set, and a test set.

[0073] Specifically, step S100 includes the following steps:

[0074] S110: Data Acquisition Unit

[0075] Malicious ELF samples were collected from publicly available malware databases (such as VirusShare), while benign ELF samples were collected from official Linux repositories. The total number of samples was 12,000, with a benign / malicious sample ratio of 1:1.

[0076] S120: Feature extraction unit:

[0077] For each ELF file, the pyelftools library was used for deep analysis to extract highly structured feature data in six categories. These six key feature categories specifically cover: header information (ELFHeaderInformation), section information (SectionInformation), dynamic information (DynamicInformation), entropy information (EntropyInformation), string information (StringInformation), and disassembly information (DisassemblyInformation), totaling 100 dimensions. Details are shown below:

[0078] Header feature groups:

[0079] entry_point is the virtual memory address of the program entry point;

[0080] pht_offset is the offset of the program header table in the file;

[0081] sht_offset is the offset of the section header table in the file;

[0082] flags are processor-specific flags;

[0083] The size of the eh_sizeELF header itself;

[0084] ph_ent_size is the size of each entry in the program header table;

[0085] The number of entries in the ph_num program header table;

[0086] sh_ent_size is the size of each entry in the section header table;

[0087] The number of entries in the sh_num section header table;

[0088] shstrndx is the index number of the section name string table in the section header table.

[0089] Section feature groups:

[0090] Check if the shstrtab_valid section name table index is valid;

[0091] The standard deviation of the size of all sections in size_stddev;

[0092] text_size. The size of the text section;

[0093] Shannon entropy of text_entropy.text section data;

[0094] Does the text_exec.text section allow execution?

[0095] Is the text_write.text section writable?

[0096] data_size. Size of the data section;

[0097] Shannon entropy of the data_entropy.data section data;

[0098] Is the data_exec.data section executable?

[0099] Is the data_write.data section writable?

[0100] The size of the rodata_size.rodata section;

[0101] Shannon entropy of rodata_entropy.rodata section data;

[0102] Is the rodata_exec.rodata section executable?

[0103] Whether the rodata_write.rodata section is writable;

[0104] bss_size. Size of the bss section;

[0105] Shannon entropy of the bss_entropy.bss section data;

[0106] Is the bss_exec.bss section executable?

[0107] Whether the bss_write.bss section is writable;

[0108] plt_size. The size of the plt section;

[0109] Shannon entropy of the plt_entropy.plt section data;

[0110] Is the plt_exec.plt section executable?

[0111] plt_write.plt checks if the section is writable;

[0112] abnormal_sections: The number of non-standard named sections;

[0113] zero_size_sections is the number of sections with a size of 0;

[0114] `exec_write_sections` is the number of sections that can be executed and written simultaneously.

[0115] Overlaps: The number of times the virtual address ranges of a section overlap.

[0116] name_entropy is the average Shannon entropy of all node names;

[0117] unloaded_exec_sections is the number of sections that are not marked as loaded but executable;

[0118] The number of symbols in the dynsym_entries dynamic symbol table;

[0119] The gzip compression ratio of the string table strtab_compress_ratio;

[0120] `relocation_entries` is the total number of relocation entries in all relocation sections.

[0121] Dynamic feature set:

[0122] num_imports is the number of imported functions;

[0123] num_exports is the number of exported functions;

[0124] risk_api_count is the number of high-risk API calls;

[0125] import_name_entropy imports the Shannon entropy of the function name;

[0126] undef_symbol_ratio is the proportion of undefined symbols to all symbols;

[0127] weak_symbols is the number of weak symbols;

[0128] The number of dependency libraries in dt_needed;

[0129] Address of the dt_init initialization function;

[0130] dt_fini terminates the function address;

[0131] The dt_bind_now flag indicates immediate binding.

[0132] dt_textrel code segment relocation flag;

[0133] The number of entries in plt_entriesPLT;

[0134] The size of got_sizeGOT;

[0135] plt_got_ratio is the ratio of the PLT size to the GOT size;

[0136] Is the PLT / GOT ratio in plt_got_anomaly abnormal?

[0137] Whether lazy_binding is enabled;

[0138] reloc_entries: Total number of relocation entries;

[0139] Number of relocations of type reloc_jmp_slotJUMP_SLOT;

[0140] Number of relocations of type reloc_globalGLOB_DAT;

[0141] Number of relocations of type reloc_copyCOPY;

[0142] Does has_symbol_versions contain symbol version information?

[0143] entropyglobal_entropy is the Shannon entropy value of the entire file;

[0144] byte_variance is the variance of the byte value distribution.

[0145] high_byte_ratio (high entropy byte ratio);

[0146] zero_byte_ratio is the proportion of zero bytes to all bytes;

[0147] min_window_entropy represents the minimum value of the entropy of the sliding window.

[0148] The maximum value of the max_window_entropy sliding window entropy;

[0149] avg_window_entropy is the average value of the entropy of the sliding window.

[0150] median_window_entropy: the median of the entropy value of the sliding window;

[0151] window_variance is the variance of the sliding window entropy.

[0152] high_window_ratio is the ratio of high-entropy windows;

[0153] The entropy value of the text_entropy.text section;

[0154] The entropy value of the data_entropy.data section;

[0155] The absolute difference between the entropy values ​​of text_data_diff.text and the .data section;

[0156] The overall compression ratio of the gzip_ratio file after gzip compression;

[0157] The entropy value of the XOR result of the xor_entropy file;

[0158] byte_change_entropy is the entropy value of the change in adjacent bytes;

[0159] The total number of printable strings in the stringnum_strings file;

[0160] The average length of the string avg_str_length;

[0161] max_str_length is the length of the longest string;

[0162] min_str_length is the length of the shortest string;

[0163] suspicious_ips contains the number of strings containing IP addresses;

[0164] suspicious_urls contains the number of strings in the URL;

[0165] suspicious_domains contains the number of domain names in the string;

[0166] high_risk_keywords is the number of strings containing high-risk keywords;

[0167] executable_paths contains the number of strings representing executable paths;

[0168] high_strs is the number of high-entropy strings;

[0169] non_ascii_strs contains the number of strings containing non-ASCII characters;

[0170] hex_encoded_strs contains the number of strings in a long hexadecimal sequence;

[0171] The proportion of disasmsyscall_density system call instructions to the total number of instructions;

[0172] jump_instructions_ratio is the ratio of jump instructions to the total number of instructions;

[0173] The absolute number of privileged instructions;

[0174] suspicious_sequences: The number of suspicious instruction sequences;

[0175] Shannon entropy value of instruction_entropy opcode;

[0176] avg_basic_block_size is the average number of instructions per basic block.

[0177] function_count is the number of functions identified by the call instruction;

[0178] indirect_jumps_ratio is the proportion of indirect jumps to all jump instructions;

[0179] The proportion of unaligned_instructions that are not aligned to 4 bytes;

[0180] The percentage of bytes that failed to be disassembled (invalid_instructions).

[0181] S130: Preprocessing unit:

[0182] Missing values ​​were imputed in the dataset using the median, and the dataset was divided into a training set (7000 samples), a validation set (3000 samples), and a test set (2000 samples).

[0183] Step S200: Constructing the reinforcement learning module:

[0184] Based on the dataset obtained from S100, a reinforcement learning module that integrates potential energy and reward shaping is constructed. The reinforcement learning module includes a state space, an action space, state transition rules, a reward function, and an agent. The agent perceives the current environment through the state space, selects an action from the action space based on the current environment, and updates the environment according to the state transition rules after the agent executes the action to obtain a new state. The reward function calculates the reward based on the change from the current environment to the new state. The agent updates the Q-table with the reward to optimize the "state-action" mapping and finally forms the optimal feature subset that can be output.

[0185] Specifically, in step S200,

[0186] The state space is defined as follows:

[0187] ,in,

[0188] , This represents the proportion of currently selected features out of the total number of features, and is used to measure model complexity. K represents the number of features currently selected, and K represents the total number of features.

[0189] This represents the accuracy of the model trained on the validation set under the current feature subset, used to reflect detection performance.

[0190] More preferably, in step S200,

[0191] The motion space includes the following five categories of motion, with a total of 2M+2K+1 motions.

[0192] In the formula, M is the number of feature groups and K is the total number of features.

[0193] Specifically, it means that 2M features can be added or removed from M feature groups, 2K features can be added or removed from K single features, plus 1 "maintain state" option, so there are a total of 2M+2K+1 possible actions.

[0194] The five main categories of operation actions are as follows:

[0195] Add Feature Group: Adds all features of a given group to the current feature subset;

[0196] Remove Feature Group: Removes all features of a given group from the current feature subset;

[0197] Add a single feature: Adds the specified single feature to the current feature subset;

[0198] Remove a single feature: Removes the specified single feature from the current feature subset;

[0199] Maintain the current state: that is, do not perform any operation.

[0200] The state transition rule is as follows: After the agent performs an action, it updates the feature subset. If the feature subset changes, it trains a machine learning model and evaluates accuracy, recall, and false positive rate on the validation set before moving to the next state. For example, the current state... The intelligent agent performs actions Afterwards (e.g., adding a feature), the environment updates the current feature subset based on the action. If the feature subset changes, the new feature subset is used to train a machine learning model classifier on the training set. In this scheme, the decision tree algorithm (DT) is used, and the accuracy, recall, and false positive rate are evaluated on the validation set. Simultaneously, the agent proceeds to the next state s. t+1 And calculate the relevant rewards or punishments.

[0201] The reward function includes a basic reward, a potential reward, and a total reward, where,

[0202] Total reward = base reward + potential energy reward.

[0203] The base reward is the sum of a performance change reward and a feature quantity penalty, aiming to construct a core signal guiding the agent to perform multi-objective optimization. The potential energy reward directly drives the improvement of the model's classification accuracy, ensuring the effectiveness of feature selection.

[0204] The formula for calculating the basic reward is:

[0205] ,

[0206] in, As a reward for performance changes, ,in For performance change weighting, this scheme uses 1.0, and the subscripts t and t+1 represent the period before and after the action, respectively, and the same applies below;

[0207] Penalty for the number of features, ,in This refers to the change in the number of features (i.e., the number of features after the action is performed minus the number of features before the action is performed). Increasing a feature incurs a penalty, while decreasing a feature incurs a reward. The feature complexity weight is 0.01 in this scheme.

[0208] The formula for calculating potential energy reward is:

[0209] ,

[0210] in, As a potential energy reward, The discount factor is 0.9 in this scheme. If the next state does not change, a penalty will be imposed.

[0211] Let be the potential energy function. This scheme selects four potential energy functions: feature economy, detection performance, false positive risk, and computational cost, because they comprehensively cover the core requirements of malware detection: achieving high accuracy while pursuing feature simplicity, low false positives, and high efficiency. These four dimensions are mutually restrictive, jointly guiding the agent to achieve multi-objective collaborative optimization.

[0212] The formula for calculating the potential energy function is:

[0213] ,

[0214] For example, taking period t:

[0215] The characteristic economic potential energy is calculated using the following formula:

[0216] ,

[0217] In the formula, The proportion of selected features. The range for the proportion of gold characteristic quantities is [0.15, 0.25], which is adopted in this scheme. and These are the critical thresholds for too few and too many features, respectively. The range is [0,1], and in this scheme, 0.04 and 0.6 are used respectively. The characteristic economic potential energy reward is greater than 0.

[0218] To detect the performance potential energy, its calculation formula is as follows:

[0219] ,

[0220] In the formula, The detection accuracy of the current feature subset. and These are the high-performance and low-performance thresholds, ranging from [0,1]. In this scheme, 0.99 and 0.6 are used. To detect potential energy rewards, all values ​​are greater than 0;

[0221] The formula for calculating the potential energy of false alarm risk is as follows:

[0222] ,

[0223] In the formula, The current false alarm rate, The false alarm rate tolerance threshold is set at 0.05 in this scheme, employing a linear penalty mechanism. The false alarm risk adjustment coefficient is greater than 0.

[0224] To calculate the cost potential energy, the formula is as follows:

[0225] ,

[0226] In the formula, This is a set of features with high computational overhead. For the current feature subset, For indicator functions, The cost potential energy adjustment coefficient is greater than 0. The formulas for calculating the potential energy functions at time t+1 are the same and will not be repeated here.

[0227] In this embodiment, the agent is trained using the Q-learning algorithm, and the specific design is as follows:

[0228] 1) State discretization: Discretizing the continuous state space Discretization maps continuous states to discrete states.

[0229] 2) Action selection: An ε-greedy strategy is adopted, and an action is randomly selected with a probability of ε (exploration). In this scheme, a probability of 0.5 is used, and the action with the largest Q value in the current state is selected with a probability of 1-ε (exploitation).

[0230] 3) Q table update:

[0231] ,

[0232] in The learning rate is 0.1 in this scheme. This is the discount factor, which is 0.9 in this scheme.

[0233] 4) Exploration rate decay: After each round, the exploration rate ε decays proportionally (0.995 in this scheme) to gradually increase the utilization rate.

[0234] 5) Termination Condition: The agent terminates the current episode if any of the following conditions are met:

[0235] a) The agent has reached the set maximum number of steps, which is 100 steps in this scheme.

[0236] b) The current feature subset is empty.

[0237] c) Simultaneously satisfying the following conditions: detection rate exceeds the set threshold (0.99 in this scheme), false alarm rate is lower than the set threshold (0.01 in this scheme), and feature number is lower than the set threshold (30 in this scheme).

[0238] Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

Claims

1. An ELF malware detection feature optimization method integrating potential energy reward shaping, characterized in that, Includes the following steps: S100: Data Processing Collect ELF samples and extract multidimensional static features to form a dataset. Preprocess the dataset to obtain training set, validation set and test set; S200: Constructing a reinforcement learning module: Based on the dataset obtained from S100, a reinforcement learning module that integrates potential energy and reward shaping is constructed. The reinforcement learning module includes a state space, an action space, state transition rules, a reward function, and an agent. The agent perceives the current environment through the state space, selects an action from the action space based on the current environment, updates the environment according to the state transition rules after the agent executes the action, and obtains a new state. The reward function calculates the reward based on the change from the current environment to the new state, and the agent updates the Q-table with the reward to optimize the "state-action" mapping and finally form the optimal feature subset that can be output. In step S200, the state space is defined as follows: ,in, , This represents the proportion of currently selected features out of the total number of features, and is used to measure model complexity. K represents the number of features currently selected, and K represents the total number of features. This represents the accuracy of the model trained on the validation set under the current feature subset, used to reflect detection performance; In step S200, The motion space includes the following five categories of motion, with a total of 2M+2K+1 motions. In the formula, M is the number of feature groups, and K is the total number of features; The five main categories of operation actions are as follows: Add Feature Group: Adds all features of a given group to the current feature subset; Remove Feature Group: Removes all features of a given group from the current feature subset; Add a single feature: Adds the specified single feature to the current feature subset; Remove a single feature: Removes the specified single feature from the current feature subset; Maintain the current state: that is, do not perform any operation; In step S200, The state transition rule is as follows: after the agent performs an action, it updates the feature subset. If the feature subset changes, the machine learning model is trained, and the accuracy, recall, and false positive rate are evaluated on the validation set before entering the next state. In step S200, The reward function includes a basic reward, a potential reward, and a total reward, where, Total reward = base reward + potential energy reward.

2. The method for optimizing ELF malware detection features based on fusion potential energy reward shaping according to claim 1, characterized in that, The data processing steps in step S100 specifically include: S110: Data Acquisition Unit Malicious ELF samples were collected from publicly available malicious sample libraries, and benign ELF samples were collected from the official Linux source. The ratio of benign to malicious samples was 1:

1. S120: Feature extraction unit: The pyelftools library is used to parse each ELF file and extract six categories of static features: header information, section information, dynamic information, entropy information, string information, and disassembly information. S130: Preprocessing unit: Missing values ​​in the dataset were filled using the median, and the dataset was divided into training, validation, and test sets proportionally.

3. The ELF malware detection feature optimization method based on fusion potential energy reward shaping according to claim 1, characterized in that, The formula for calculating the basic reward is: ， in, As a reward for performance changes, ,in Weighting for performance changes; Penalty for the number of features, ,in This represents the change in the number of features; increasing a feature incurs a penalty, while decreasing a feature incurs a reward. The feature complexity weights are denoted by t, and the subscripts t and t+1 represent the periods before and after the agent performs the action, respectively.

4. The ELF malware detection feature optimization method based on fusion potential energy reward shaping according to claim 3, characterized in that, The formula for calculating potential energy reward is: ， in, As a potential energy reward, The discount factor is applied if the next state does not change, and the subscripts t and t+1 represent the period before and after the agent performs the action, respectively. and Let be the potential energy function.

5. The method for optimizing ELF malware detection features based on fusion potential energy reward shaping according to claim 4, characterized in that, Before the agent performs an action, the formula for calculating the potential energy function is: ， in, The characteristic economic potential energy is calculated using the following formula: ， In the formula, The proportion of selected features. This represents the range of proportions of gold-specific characteristics. and These are the critical thresholds for too few and too many features, respectively. The range is [0,1]. The characteristic economic potential energy reward is greater than 0; To detect the performance potential energy, its calculation formula is as follows: ， In the formula, The detection accuracy of the current feature subset. and These represent the high-performance and low-performance thresholds, ranging from [0,1]. To detect potential energy rewards, all values ​​are greater than 0; The formula for calculating the potential energy of false alarm risk is as follows: ， In the formula, The current false alarm rate, A linear penalty mechanism is used as the tolerance threshold for false alarm rate. The false alarm risk adjustment coefficient is greater than 0. To calculate the cost potential energy, the formula is as follows: ， In the formula, This is a set of features with high computational overhead. The current feature subset before the agent performs an action. For indicator functions, The cost potential energy adjustment coefficient is greater than 0. After the agent performs an action, the potential energy function The calculation formula and The calculation formula is the same.

6. The method for optimizing ELF malware detection features based on fusion potential energy reward shaping according to claim 5, characterized in that, The termination condition for the agent in step S200 includes any of the following: The agent reaches the set maximum number of steps; The current feature subset is empty; The detection rate exceeds the set threshold, the false alarm rate is lower than the set threshold, and the number of features is lower than the set threshold.

Images