Malicious code detection method oriented to API (Application Program Interface) calling characteristics
By constructing an adversarial training-driven malware detection model and introducing dilated convolution and attention mechanisms, combined with the Stacking algorithm, the problem of insufficient accuracy in adversarial sample identification and classification in malware detection methods is solved, achieving more efficient malware detection.
Patent Information
- Application Number
- CN202411814946.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-11
- Publication Date
- 2026-02-03
AI Technical Summary
Existing malware detection methods struggle to effectively identify adversarial malware samples and lack accuracy when dealing with malware family classifications.
We construct an adversarial training-driven malware detection model using API call features, combine it with the TextCNN model and introduce dilated convolution and attention mechanisms, and use the Stacking algorithm to integrate the prediction results of multiple models to enhance the adversarial example recognition capability and model robustness.
It improves the ability to identify adversarial examples of malicious code and the accuracy of malicious code family classification, and enhances the robustness of the model in distinguishing between normal and malicious samples.
Smart Images
Figure CN121456873A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of network security, and particularly relates to a malicious code detection method for API calling features. BACKGROUND
[0002] With the rapid development of computers and the Internet, user information and property information on the network have increased dramatically. Meanwhile, the emergence of large-scale malicious code attacks has caused serious threats to user information and property safety. The number of malicious codes is very large and grows at a very fast speed. In the process of combating security researchers, attackers continuously improve existing malicious codes by using various obfuscation techniques, such as shell, deformation technology and polymorphic technology, to generate a series of malicious code variants to evade malicious code detection. In the face of the increasing number of malicious code attacks and the increasing anti-detection ability of malicious codes, the process of malicious code detection has become more complex. SUMMARY
[0003] Therefore, the present application aims to provide a malicious code detection method for API calling features, which can enhance the recognition ability of malicious code adversarial samples, realize the classification of malicious codes, enhance the robustness of the model in distinguishing normal samples and malicious samples, and improve the accuracy of malicious code family classification.
[0004] To achieve the above-mentioned purpose, the present application adopts the following technical solution: a malicious code detection method for API calling features, comprising the following steps:
[0005] Step S1, data preprocessing is performed to construct malicious code API calling binary features and API sequence features;
[0006] Step S2, an adversarial training-driven malicious code detection enhancement model is constructed for API binary feature vectors to realize the judgment of normal samples and malicious samples;
[0007] Step S3, a TextCNN-based malicious code detection model is constructed for API sequence features, and a hollow convolution and an attention mechanism are added to realize the classification of malicious codes;
[0008] Step S4, the prediction results of the adversarial training-driven malicious code detection model and the TextCNN-based malicious code detection model are combined by using a Stacking algorithm to obtain a final prediction result.
[0009] In a preferred embodiment, in step S1, the data preprocessing process of obtaining malicious code API calling binary features specifically comprises the following steps:
[0010] Step S1A1, map the API call features of the sample file into a one-dimensional feature vector composed of 0 and 1; define an API set S with a size of n, and the API features of each sample data are represented as a binary feature vector, corresponding to API0, API1, …, API n In the call case in the sample, the i-th position of the binary feature vector of the sample is 1, which represents that the sample calls the API i , and 0 represents that the sample does not call the API i .
[0011] In a preferred embodiment, in step S1, the data preprocessing process for obtaining the API sequence features of the malicious code includes the following steps:
[0012] Step S1B1, use the API call sub-sequence deduplication algorithm, define left and right to represent the first position of the repeated sequence segment, left from the first element of the API call sequence, and right from the next position of left;
[0013] Step S1B2, when the element at the left position is equal to the element at the right position, determine whether the API sequence segment with the left as the first element and the length of right-left+1 is equal to the API sequence segment with the right as the first element and the equal length;
[0014] Step S1B3, if the two API sequence segments in step S1B2 are equal, only one API sequence segment is retained, and if they are not equal, continue to traverse the API sequence until the traversal ends, and finally obtain the API call sequence after deduplication processing.
[0015] In a preferred embodiment, in step S2, an adversarial training driven malicious code detection enhancement model is constructed for the API binary feature vector, which includes the following steps:
[0016] Step S21, use the WGAN model to simulate the data distribution of normal samples, and provide rich disturbance combinations for the generation of malicious code adversarial samples; wherein the objective function of the WGAN model is
[0017]
[0018] Step S22, add normal sample disturbances to the existing malicious code samples to construct malicious code adversarial samples;
[0019] Step S23, add the generated malicious code adversarial samples to the training data set of the target detector, and perform adversarial training on the detector to enhance the robustness and anti-interference of the target detector.
[0020] In a preferred embodiment, in step S21, the model training process of the WGAN specifically includes the following steps:
[0021] Step S211, the generator in the WGAN model inputs random noise subject to uniform distribution, generates virtual data with the same dimension as the real samples, and merges the real sample API call binary vector, which is marked as 0 and 1 respectively, to train the discriminator. During the training process, the parameters of the discriminator are updated;
[0022] Step S212, use the generator to generate data and mark it as 1 to deceive the discriminator. Through the training result of the discriminator, the parameters of the generator are updated;
[0023] Step S213, the generated samples generated by the generator are binarized to obtain binary generated sample data.
[0024] In a preferred embodiment, in step S22, the malicious code adversarial sample is constructed, specifically including the following steps:
[0025] Step S221, add the normal sample and the generated sample based on the WGAN model simulating the distribution of the real normal sample to the malicious sample in the form of disturbance;
[0026] Step S222, perform logarithmic backtracking disturbance pruning on the disturbance sample that successfully deceives the target malicious code detection model. In the process of disturbance pruning, half of the number of disturbance APIs is randomly reduced, and the input is queried to the target detector;
[0027] Step S223, if the malicious code detector is successfully deceived, repeat the iteration and pruning process until the disturbance sample cannot escape the detection of the target detector, then restore the disturbance of the last iteration, end the disturbance pruning process; or when the number of disturbances is 1, end the disturbance pruning process.
[0028] In a preferred embodiment, in step S3, a malicious code detection model based on TextCNN is constructed for API sequence features, specifically including the following steps:
[0029] Step S31, for API sequence features, use the CBOW model of Word2vec to generate API word vectors to better extract the context information of API call sequences;
[0030] Step S32, by introducing API call sequence pre-trained word vector data, a TextCNN malicious code detection model based on empty convolution and attention mechanism is constructed to realize the classification of malicious code.
[0031] In a preferred embodiment, in step S31, the basic training process of the CBOW model is as follows:
[0032] The CBOW model is a feedforward neural network language model composed of an input layer, a projection layer, and an output layer; a processing window size k of the model is defined, and contexts of a target word ct are read in sequence, i.e., k consecutive words {ct -k ,ct- k-1 ,…,ct -2 ,ct -1} and k consecutive words {ct+1,ct+2,…,ct+k-1,ct+k} before and after the target word ct.
[0033] The calculation formula of the projection layer vector h is as follows:
[0034]
[0035] where W V×N is a shared weight matrix, V is a word vector dimension, N is the number of projection layer neurons, w ij represents the jth data of the word vector of the ith word in the context;
[0036] The calculation formula of the output layer is as follows:
[0037] y=Softmax(W′ N×V ·h)
[0038] where W′ N×V is a transpose matrix of the shared weight matrix.
[0039] In a preferred embodiment, in step S32, the specific implementation of improvement of the TextCNN model from two aspects of the hollow convolution and the attention mechanism is as follows:
[0040] Step S32A1, introduce the hollow convolution in the TextCNN model, let the convolution kernel feel a longer distance, expand the receptive field of the model, and better adapt to the long text sequence task;
[0041] Step S32A2, introduce the attention mechanism in the TextCNN model, to give the network more degrees of freedom to allocate scores for different convolution layers of the model;
[0042] Introducing the attention mechanism in the TextCNN model specifically includes the following steps:
[0043] Step S32B1, according to the input vector a 1 find other vectors related to a 1 in the sequence; calculate the correlation degree of each input vector a i and a 1 , and the value is represented as α, the value of α is calculated in the Dot-product manner, and the calculation method is: α1，i = q 1 · k i . Wherein, a 1，i represents the relevance value of a 1 and a i , q i = W q · a i , k i = W k a i ; wherein q i , k i are the query (q, query) vector and the key (k, key) vector generated by the input vector a i , W q , W k are the training weight matrices of the query vector and the key vector respectively, which are updated in the training process.
[0044] Step S32B2, Softmax calculation is performed on the generated a
[0045]
[0046] Wherein a' 1,i represents the attention score of the relevance value of a 1 and a i in the global sequence.
[0047] Step S32B3, important consultations in the sequence are extracted by the calculation result of the attention score a', and the output of the self-attention mechanism is obtained, and the calculation formula is: Wherein b i is the i-th output of the self-attention mechanism, v i = W v · a i ; wherein v i is the value (v, value) vector generated by the input vector a i , W v is the training weight matrix of the value vector, which is updated in the training process.
[0048] Step S32B4, the output process of b 1 in step S32B3 is extended to the calculation process of each output, that is, the calculation formula of the output matrix is as follows: Q = W q · I, K = W k · I, Q = W q · I,
[0049] A' = softmax(A) = soft max(K T Q), O = V·A'
[0050] Where I is the input matrix, O is the output matrix, and A′ is the attention matrix; in this process, W q W k and W v It is obtained by updating the training data during the training process.
[0051] In a preferred embodiment, step S4, using the Stacking algorithm to obtain the final prediction result, specifically includes the following steps:
[0052] Step S41: Divide the dataset into training set T1 and test set T2;
[0053] Step S42: Train the base learner using the training set to obtain the prediction results;
[0054] Step S43: Merge the prediction results of several base learners in the training set into a new training set T1′, and merge the prediction results in the test set into a new test set T2′.
[0055] Step S44: Use LightGBM as a secondary classifier to train the new dataset and obtain the final prediction results.
[0056] Compared with the prior art, the present invention has the following beneficial effects: The present invention provides a malicious code detection method based on API call characteristics, which can enhance the ability to identify adversarial samples of malicious code and realize the classification of malicious code; enhance the robustness of the model in distinguishing between normal samples and malicious samples, and improve the accuracy of malicious code family classification. Attached Figure Description
[0057] Figure 1 This is a schematic diagram illustrating a preferred embodiment of the method of the present invention. Detailed Implementation
[0058] The present invention will be further described below with reference to the accompanying drawings and embodiments.
[0059] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.
[0060] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations according to this application; as used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise; furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.
[0061] like Figure 1 As shown, this embodiment provides a malicious code detection method based on API call characteristics, specifically including the following steps:
[0062] Step S1: Perform data preprocessing to construct binary features of malicious code API calls and API sequence features;
[0063] Step S2: Construct an adversarial training-driven malicious code detection enhancement model based on API binary feature vectors to distinguish between normal and malicious samples;
[0064] Step S3: Construct a malicious code detection model based on TextCNN based on API sequence features, and add dilated convolution and attention mechanisms to achieve malicious code classification;
[0065] Step S4: Using the Stacking algorithm, combine the prediction results of the adversarial training-driven malware detection model and the TextCNN-based malware detection model to obtain the final prediction result;
[0066] In this embodiment, step S1, the data preprocessing process for obtaining the binary features of malicious code API calls, specifically includes the following steps:
[0067] Step S1A1: Map the API call features of the sample files into a one-dimensional feature vector consisting of 0s and 1s; Define an API set S of size n. The API feature of each sample data can be represented as a binary feature vector, corresponding to the call status of API0, API1, ..., APIn in the sample. If the i-th position of the sample's binary feature vector is 1, it means that the sample has called APIi, and if it is 0, it means that the sample has not called APIi.
[0068] In this embodiment, step S1, the data preprocessing process for obtaining malicious code API sequence features, specifically includes the following steps:
[0069] Step S1B1: Use the API call subsequence deduplication algorithm. Define left and right to represent the first position of the repeated sequence segment. left traverses from the first element of the API call sequence, and right traverses from the next position after left.
[0070] Step S1B2: When the element at position lefet is the same as the element at position right, determine whether the API sequence fragment with length right-left+1 starting with element lefet is equal to the API sequence fragment with length equal to the element at position right.
[0071] Step S1B3: If the two API sequence fragments in step S1B2 are equal, only one API sequence fragment is kept; otherwise, the API sequence is traversed again until the traversal ends, and finally the API call sequence after deduplication is obtained.
[0072] In this embodiment, step S2, which involves constructing an adversarial training-driven malware detection enhancement model based on the API binary feature vector, specifically includes the following steps:
[0073] Step S21: Using the WGAN model, simulate the data distribution of normal samples to provide rich perturbation combinations for the generation of adversarial samples for malicious code; where the objective function of the WGAN model is...
[0074] Step S22: Construct adversarial samples of malicious code by adding perturbations to existing malicious code samples;
[0075] Step S23: Add the generated adversarial malicious code samples to the training dataset of the target detector to perform adversarial training on the detector and enhance the robustness and anti-interference ability of the target detector.
[0076] In this embodiment, step S21, the WGAN model training process, specifically includes the following steps:
[0077] Step S211: The generator in the WGAN model is input with uniformly distributed random noise to generate virtual data with the same dimension as the real samples. The virtual data is then merged with the real sample's binary vector via API calls and labeled as 0 and 1 respectively. The discriminator is trained, and the discriminator parameters are updated during the training process.
[0078] Step S212: Use the generator to generate data and mark it as 1 to deceive the discriminator. Update the parameters of the generator based on the training results of the discriminator.
[0079] Step S213: Binarize the generated samples generated by the generator to obtain binarized generated sample data;
[0080] In this embodiment, step S22, constructing the adversarial sample of malicious code, specifically includes the following steps:
[0081] Step S221: Add normal samples and generated samples that simulate the distribution of real normal samples based on the WGAN model to the malicious samples in the form of perturbation;
[0082] Step S222: Perform log back perturbation reduction on the perturbation samples that successfully deceive the target malicious code detection model. During the perturbation reduction process, randomly reduce the number of perturbation APIs by half and input them into the target detector for querying.
[0083] Step S223: If the malicious code detector is successfully deceived, the perturbation process is repeated iteratively until the perturbation sample can no longer escape the target detector. Then, the perturbation from the previous iteration is restored, and the perturbation reduction process ends. Alternatively, the perturbation reduction process ends when the number of perturbations is 1.
[0084] In this embodiment, step S3, which involves constructing a malicious code detection model based on TextCNN based on API sequence features, specifically includes the following steps:
[0085] Step S31: Based on API sequence features, use the CBOW model of Word2vec to generate API word vectors to better extract the contextual information of API call sequences;
[0086] Step S32: By introducing pre-trained word vector data from API call sequences, construct a TextCNN malicious code detection model based on dilated convolution and attention mechanisms to achieve malicious code classification;
[0087] In this embodiment, the basic training process of the CBOW model in step S31 is as follows:
[0088] The CBOW model is a feedforward neural network language model consisting of an input layer, a projection layer, and an output layer. The model's processing window size k is defined, and it sequentially reads the context of the target word ct, i.e., the first k consecutive words {ct-k, ct-k-1, ..., ct-2, ct-1} and the last k consecutive words {ct+1, ct+2, ..., ct+k-1, ct+k}.
[0089] The formula for calculating the projection layer vector is as follows: Among them, W V×N The weight matrix is shared, V is the word vector dimension, N is the number of neurons in the projection layer, and w ij This represents the j-th data point in the word vector of the i-th word in the context.
[0090] The formula for calculating the output layer is as follows: y = Softmax(W′) N×V ·h). Where W′ N×V It is the transpose of the shared weight matrix.
[0091] In this embodiment, the specific implementation of the improvements to the TextCNN model in step S32, focusing on both dilated convolution and attention mechanisms, is as follows:
[0092] Step S32A1: Introduce dilated convolution into the TextCNN model to allow the convolution kernel to sense a greater distance, expand the model's receptive field, and better adapt to long text sequence tasks.
[0093] Step S32A2: Introduce an attention mechanism into the TextCNN model to give the network more freedom to assign scores to different convolutional layers of the model;
[0094] Introducing an attention mechanism into the TextCNN model involves the following steps:
[0095] Step S32B1: Based on the input vector a 1 Find the sequence that is related to a 1 Other related vectors. Calculate each input vector a. i With a 1 The degree of correlation is denoted as α. This paper uses the dot-product method to calculate the value of α. The calculation method is as follows: α 1，i =q 1 ·k i Among them, α 1，i Indicates a 1 and a i The correlation value, q i =W q ·a i k i =W k ·a i ;where q i ,k i For the input vector a i The generated query (q, query) vector and key (k, key) vector, W q W k These are the training weight matrices for the query vector and the key vector, respectively, which are updated during the training process.
[0096] Step S32B2: Perform Softmax calculation on the generated α:
[0097]
[0098] Where α' 1,i Indicates a 1 and a i The correlation value is the attention score in the global sequence.
[0099] Step S32B3: Extract important information from the sequence using the calculated attention score α′ to obtain the output of the self-attention mechanism. The calculation formula is as follows: Where b i For the i-th output of the self-attention mechanism, v i =W v ·a i ;where v i For the input vector a i The generated value (V, Value) vector, Wv The training weight matrix is the value vector, which is updated during training.
[0100] In steps S32B4 and S32B3, b 1 The output process can be generalized to the calculation process of each output, that is, the formula for calculating the output matrix is as follows:
[0101] Q = W q ·I,K=W k ·I,Q=W q ·I,
[0102] A′=softmax(A=softmax(K) T Q), O=V·A′.
[0103] Where I is the input matrix, O is the output matrix, and A′ is the attention matrix. In this process, Wq, Wk, and Wv are obtained by updating the training data during training.
[0104] In this embodiment, step S4, using the Stacking algorithm to obtain the final prediction result, specifically includes the following steps:
[0105] Step S41: Divide the dataset into training set T1 and test set T2;
[0106] Step S42: Train the base learner using the training set to obtain the prediction results;
[0107] Step S43: Merge the prediction results of several base learners in the training set into a new training set T1′, and merge the prediction results in the test set into a new test set T2′.
[0108] Step S44: Use LightGBM as a secondary classifier to train the new dataset and obtain the final prediction results;
[0109] This embodiment relates to a malware detection method based on API call features. First, addressing the adversarial example attack problem, a generative adversarial network (GAN) is employed to simulate the distribution of normal samples, generating corresponding binary feature vectors for APIs. This provides richer perturbation combinations for adversarial examples, which are then added to the training data for model retraining. Simultaneously, an API call subsequence deduplication algorithm is proposed, using the Word2vec method to generate API word vectors, better extracting contextual information from the API call sequence. Furthermore, by adding dilated convolutions and attention mechanisms to the TextCNN model, the receptive field of the API sequence is expanded, enhancing the extraction of key information. Finally, an ensemble learning algorithm is used, combining the proposed malware detection model based on API binary features and the TextCNN model based on API sequence features, to enhance the model's robustness in distinguishing between normal and malicious samples, improving the accuracy of malware family classification.
[0110] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0111] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0112] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0113] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0114] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.
Claims
1. A method for detecting malicious code based on API call characteristics, characterized in that, Includes the following steps: Step S1: Perform data preprocessing to construct binary features of malicious code API calls and API sequence features; Step S2: Construct an adversarial training-driven malicious code detection enhancement model based on API binary feature vectors to distinguish between normal and malicious samples; Step S3: Construct a malicious code detection model based on TextCNN based on API sequence features, and add dilated convolution and attention mechanisms to achieve malicious code classification; Step S4: Using the Stacking algorithm, combine the prediction results of the adversarial training-driven malware detection model and the TextCNN-based malware detection model to obtain the final prediction result.
2. The malicious code detection method based on API call characteristics according to claim 1, characterized in that, Step S1 involves a data preprocessing procedure to obtain the binary features of malicious code API calls, specifically including the following steps: Step S1A1: Map the API call features of the sample files into a one-dimensional feature vector consisting of 0s and 1s; define an API set S of size n, where the API feature of each sample data is represented as a binary feature vector, corresponding to API0, API1, ..., API2 respectively. n In the case of API calls within the sample, a 1 at the i-th position of the sample's binary feature vector indicates that the sample has called the API. i A value of 0 indicates that the sample has not been adjusted by API. i .
3. The malicious code detection method based on API call characteristics according to claim 1, characterized in that, Step S1, the data preprocessing process for obtaining malicious code API sequence features, specifically includes the following steps: Step S1B1: Use the API call subsequence deduplication algorithm. Define left and right to represent the first position of the repeated sequence segment. left starts from the first element of the API call sequence and right starts from the next position after left. Step S1B2: When the element at the left position is the same as the element at the right position, determine whether the API sequence fragment with the left as the first element and a length of right-left+1 is equal to the API sequence fragment with the right as the first element and a length of the same. Step S1B3: If the two API sequence fragments in step S1B2 are equal, only one API sequence fragment is retained; otherwise, the API sequence is traversed again until the traversal ends, and finally the API call sequence after deduplication is obtained.
4. The malicious code detection method based on API call characteristics according to claim 1, characterized in that, In step S2, an adversarial training-driven malware detection enhancement model is constructed based on the API binary feature vectors, specifically including the following steps: Step S21: Using the WGAN model, simulate the data distribution of normal samples to provide rich perturbation combinations for the generation of adversarial samples for malicious code; where the objective function of the WGAN model is... Step S22: Construct adversarial samples of malicious code by adding perturbations to existing malicious code samples; Step S23: Add the generated adversarial malicious code samples to the training dataset of the target detector to perform adversarial training on the detector and enhance the robustness and anti-interference ability of the target detector.
5. The malicious code detection method based on API call characteristics according to claim 4, characterized in that, Step S21, the WGAN model training process, specifically includes the following steps: Step S211: The generator in the WGAN model is input with uniformly distributed random noise to generate virtual data with the same dimension as the real samples. The virtual data is then merged with the real sample's binary vector via API calls and labeled as 0 and 1 respectively. The discriminator is trained, and the discriminator parameters are updated during the training process. Step S212: Use the generator to generate data and mark it as 1 to deceive the discriminator. Update the parameters of the generator based on the training results of the discriminator. Step S213: Binarize the generated samples generated by the generator to obtain binarized generated sample data.
6. The malicious code detection method based on API call characteristics according to claim 4, characterized in that, In step S22, constructing a malicious code adversarial sample specifically includes the following steps: Step S221: Add normal samples and generated samples that simulate the distribution of real normal samples based on the WGAN model to the malicious samples in the form of perturbation; Step S222: Perform log back perturbation reduction on the perturbation samples that successfully deceive the target malicious code detection model. During the perturbation reduction process, randomly reduce the number of perturbation APIs by half and input them into the target detector for querying. Step S223: If the malicious code detector is successfully deceived, the perturbation process is repeated iteratively until the perturbation sample can no longer escape the detection of the target detector. Then, the perturbation of the previous iteration is restored and the perturbation reduction process ends; or when the number of perturbations is 1, the perturbation reduction process ends.
7. The malicious code detection method based on API call characteristics according to claim 1, characterized in that, In step S3, a malicious code detection model based on TextCNN is constructed based on API sequence features, which specifically includes the following steps: Step S31: Based on API sequence features, use the CBOW model of Word2vec to generate API word vectors to better extract the contextual information of API call sequences; Step S32: By introducing pre-trained word vector data from API call sequences, construct a TextCNN malicious code detection model based on dilated convolution and attention mechanisms to classify malicious code.
8. The malicious code detection method based on API call characteristics according to claim 7, characterized in that, In step S31, the basic training process of the CBOW model is as follows: The CBOW model is a feedforward neural network language model consisting of an input layer, a projection layer, and an output layer. The model's processing window size k is defined, and it sequentially reads the context of the target word ct, i.e., the first k consecutive words {ct}. -k ct- k-1 , ..., ct -2 ct -1 } and the following k consecutive words {ct+1, ct+2, ..., ct+k-1, ct+k}; The formula for calculating the projection layer vector h is as follows: Among them, W V×N The weight matrix is shared, V is the word vector dimension, N is the number of neurons in the projection layer, and w ij This represents the j-th data point in the word vector of the i-th word in the context. The calculation formula for the output layer is as follows: y=Softmax(W′ N×V ·h) Where W′ N×V It is the transpose of the shared weight matrix.
9. A malicious code detection method based on API call characteristics according to claim 7, characterized in that, In step S32, the specific implementation of improvements to the TextCNN model in terms of dilated convolution and attention mechanism is as follows: Step S32A1: Introduce dilated convolution into the TextCNN model to allow the convolution kernel to sense a greater distance, expand the model's receptive field, and better adapt to long text sequence tasks. Step S32A2: Introduce an attention mechanism into the TextCNN model to give the network more freedom to assign scores to different convolutional layers of the model; Introducing an attention mechanism into the TextCNN model involves the following steps: Step S32B1: Based on the input vector a 1 Find the sequence that is related to a 1 Other related vectors; compute each input vector a i With a 1 The degree of correlation is denoted as α. The value of α is calculated using the dot-product method. The calculation method is as follows: α 1，i =q 1 ·k i Among them, α 1，i Indicates a 1 and a i The correlation value, q i =W q ·a i k i =W k ·a i ; where q i k i For the input vector a i The generated query (q, query) vector and key (k, key) vector, W q W k These are the training weight matrices for the query vector and the key vector, respectively, which are updated during the training process. Step S32B2: Perform Softmax calculation on the generated α: Where α′ 1，i Indicates a 1 and a i The correlation value is the attention score in the global sequence. Step S32B3: Extract important information from the sequence using the calculated attention score α′ to obtain the output of the self-attention mechanism. The calculation formula is as follows: Where b i For the i-th output of the self-attention mechanism, v i =W v ·a i ;where v i For the input vector a i The generated value (V, Value) vector, W v The training weight matrix is the value vector, which is updated during training. In steps S32B4 and S32B3, b 1 The output process is generalized to the calculation process of each output, that is, the formula for calculating the output matrix is as follows: Q = W q ·I, K = W k ·I, Q=W q ·I, A′=Soft max(A)=soft max(K T Q)0=V·A′ Where I is the input matrix, O is the output matrix, and A′ is the attention matrix; in this process, W q W k and W v It is obtained by updating the training data during the training process.
10. A malicious code detection method based on API call characteristics according to claim 1, characterized in that, In step S4, the final prediction result is obtained using the Stacking algorithm, which specifically includes the following steps: Step S41: Divide the dataset into training set T1 and test set T2; Step S42: Train the base learner using the training set to obtain the prediction results; Step S43: Merge the prediction results of several base learners in the training set into a new training set T1′, and merge the prediction results in the test set into a new test set T2′. Step S44: Use LightGBM as a secondary classifier to train the new dataset and obtain the final prediction results.