Dynamic malicious software identification method and device based on deep learning model

Abstract

The invention provides a dynamic malicious software identification method and device based on a deep learning model. The method comprises the following steps: acquiring behavior data of a to-be-detected system; performing preprocessing and feature extraction on the behavior data of the to-be-detected system to obtain behavior features; and inputting the behavior characteristics into a trained online recognition depth model to obtain a malicious software recognition result. According to the method and the device, the malicious software is identified through the deep learning model, and the deep learning model is obtained through malicious software sample training, so that the identification accuracy is improved, and the problems of confusion and avoidance are avoided.

Description

Technical Field

[0001] This application relates to the field of deep model processing technology, and more specifically, to a method and apparatus for identifying dynamic malware based on a deep learning model. Background Technology

[0002] With the rapid development of computer networks and information systems, malware is exhibiting characteristics such as diversification, stealth, and frequent mutations. Traditional malware detection methods based on static features (such as file hashes and signature matching) are easily obfuscated and evaded, and thus have significant limitations in detecting unknown or obfuscated malware. Summary of the Invention

[0003] To address the aforementioned problems, the first aspect of this application provides a method for identifying dynamic malware based on a deep learning model, comprising:

[0004] Acquire behavioral data of the system under test;

[0005] The behavioral data of the detection system is preprocessed and feature extracted to obtain behavioral features;

[0006] By inputting behavioral features into a trained online deep learning model, malware identification results are obtained.

[0007] The second aspect of this application provides a manufacturing system for a dynamic malware identification method based on a deep learning model, comprising:

[0008] The data acquisition module is used to acquire behavioral data of the system under test.

[0009] The data preprocessing module is used to preprocess and extract features from the behavioral data of the system to be detected, so as to obtain behavioral features.

[0010] The model recognition module is used to input behavioral features into a trained online deep recognition model to obtain malware recognition results.

[0011] A third aspect of this application provides an electronic device, including: a memory and a processor; the memory being configurable to store a program, and the processor being coupled to the memory for executing the program in the memory for:

[0012] Acquire behavioral data of the system under test;

[0013] The behavioral data of the detection system is preprocessed and feature extracted to obtain behavioral features;

[0014] By inputting behavioral features into a trained online deep learning model, malware identification results are obtained.

[0015] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the aforementioned method for identifying dynamic malware based on a deep learning model.

[0016] In this application, malware identification is achieved through a deep learning model trained on malware samples, thereby improving the accuracy of identification and avoiding problems of confusion and evasion. Attached Figure Description

[0017] Figure 1 This is a flowchart of a dynamic malware identification method based on a deep learning model according to an embodiment of this application;

[0018] Figure 2 An architecture diagram of the online deep model recognition method for dynamic malware recognition based on a deep learning model according to embodiments of this application;

[0019] Figure 3 This is an architecture diagram of a dynamic malware identification method based on a deep learning model for security attention extraction according to an embodiment of this application;

[0020] Figure 4 This is an architectural diagram of a dynamic malware identification device based on a deep learning model according to an embodiment of this application;

[0021] Figure 5 This is an architectural diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0022] To make the above-mentioned objects, features, and advantages of this application more apparent and understandable, specific embodiments of this application will be described in detail below with reference to the accompanying drawings. Although exemplary embodiments of this application are shown in the drawings, it should be understood that this application can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of this application and to fully convey the scope of this application to those skilled in the art.

[0023] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application shall have the ordinary meaning as understood by one of ordinary skill in the art.

[0024] This application provides an embodiment of the dynamic malware identification method based on a deep learning model, as described above. The specific scheme of this method is as follows: Figures 1-3 As shown, this method can be executed by a dynamic malware identification device based on a deep learning model, which can be integrated into electronic devices such as computers, servers, computer clusters, and data centers. Figure 1 As shown, the dynamic malware identification method based on a deep learning model includes:

[0025] S101, Obtain behavioral data of the system under test;

[0026] In one implementation, the behavioral data includes at least: process call data, API call data, file read / write data, and network connection data.

[0027] Among them, various behavioral data in the system under test are monitored, including process calls, API calls, file read and write, network connections, etc., and behavioral sequences are recorded at a high frequency.

[0028] S102, preprocess and extract features from the behavioral data of the system to be detected to obtain behavioral features;

[0029] This step is crucial in transforming raw, low-level behavioral data into high-level feature vectors that machine learning models can understand.

[0030] S103 inputs behavioral features into a trained online deep learning model to obtain malware identification results.

[0031] The model is pre-trained using massive amounts of malware and benign software samples and their behavioral data.

[0032] In this application, malware identification is achieved through a deep learning model trained on malware samples, thereby improving the accuracy of identification and avoiding problems of confusion and evasion.

[0033] In this application, the detection method based on dynamic behavior analyzes behavioral data such as system resources, network, and file operations during the operation of monitoring software, which can more comprehensively identify malicious behavior and has high robustness.

[0034] In this application, the robustness of dynamic behavior analysis is combined with the powerful pattern recognition and automatic feature learning capabilities of deep learning to form a system that can adaptively evolve and has a strong detection capability for new and unknown threats.

[0035] In one embodiment, the preprocessing and feature extraction of the behavioral data of the system to be detected to obtain behavioral features includes:

[0036] Noise filtering is performed on the behavioral data of the system to be detected to obtain filtering information;

[0037] The filtering information is broken down into categorical features, numerical features, and text features, and the correlation between the breakdown results of the same filtering information is constructed.

[0038] Normalize and fuse categorical features, numerical features, and text features;

[0039] The fused features are subjected to feature extraction based on the Mamba structure to obtain the extracted behavioral features.

[0040] In this application, the collected data is subjected to noise filtering, format conversion and normalization, key behavioral features are extracted using an automatic feature learning algorithm, and a structured behavioral sequence is formed.

[0041] In the classification feature processing, an nn.Embedding layer is created for each discrete field to map the index into a low-dimensional dense vector.

[0042] Numerical feature processing: BatchNorm1d is used to normalize all numerical dimensions, suppressing scale differences and accelerating convergence.

[0043] Text feature processing: If a text vector (which can be generated by a pre-trained model) is provided, it is projected and aligned to the same representation space through a linear layer and ReLU activation.

[0044] Feature fusion: The above three outputs are spliced ​​along the channel to obtain a unified high-dimensional fused feature.

[0045] In one implementation, the step of performing Mamba-based feature extraction on the fused features to obtain the extracted behavioral features includes:

[0046] Channel attention is extracted from the fused features to obtain the weight coefficients for each channel;

[0047] The fused features are subjected to multi-scale transformation to obtain the transformed features.

[0048] The fused features are weighted based on weighting coefficients and then superimposed with the transformed features to obtain the behavioral features.

[0049] Channel attention involves calculating the global mean of the fused features by channel, then generating the weight coefficients for each channel by passing through two fully connected layers (dimensionality reduction → ReLU → dimensionality increase) and applying a sigmoid function.

[0050] Multi-scale transformation: The input features are then processed through two fully connected layers plus ReLU to generate new feature representations.

[0051] Weighted fusion: The original input is multiplied by attention weights and then added to the transformation result to achieve adaptive enhancement of important information.

[0052] In one implementation, the malware identification result includes a malicious behavior probability score and a behavior risk identifier.

[0053] Malicious Behavior Probability Score: A continuous numerical value (usually between 0 and 1) that represents the probability calculated by the model that the sample belongs to malware.

[0054] Preferably, security analysts can set different thresholds to balance false positives and false negatives. For example, in strict mode, the threshold is set to 0.9; in sensitive mode, the threshold can be set to 0.7.

[0055] Behavioral risk identifiers: Descriptive labels indicating the specific types of malicious behavior performed by the program. For example, Figure 2 As shown, behavioral risk indicators include at least three types of behavior: process and memory operations, file system and registry modifications, and network communication and data theft.

[0056] In this way, different risk indicators guide different response measures.

[0057] In one implementation, combined with Figure 2 As shown, the step of inputting behavioral features into a trained online deep learning model to obtain malware identification results includes:

[0058] The behavioral features are embedded to obtain the embedded features;

[0059] Multi-head attention and secure attention processing are applied to the embedded features to obtain attention features;

[0060] Attention features are processed to obtain malware identification results.

[0061] In this application, multi-head attention processing allows the model to simultaneously focus on the relationships between behaviors at different positions in a sequence, thereby capturing long-distance, complex dependency patterns.

[0062] In this application, security attention processing is a customized innovation for the security field. It guides or constrains attention weights, making the model pay more attention to known key event sequences that are highly correlated with malicious behavior.

[0063] In this application, the feature sequence enhanced by the attention mechanism is usually aggregated into a global feature vector by a pooling layer (such as global average pooling), and then input into the feedforward neural network for final calculation.

[0064] In this application, the output layer of this feedforward network typically uses:

[0065] The Sigmoid activation function outputs a neuron that generates a probability score of malicious behavior between 0 and 1.

[0066] The Sigmoid / Softmax activation function outputs multiple neurons, generating probabilities of multiple behavioral risk labels (e.g., each neuron corresponds to a technique in ATT&CK). After thresholding, a specific set of labels can be obtained.

[0067] The "safe attention processing" mechanism proposed in this application is a highlight. It represents a research direction that deeply integrates domain knowledge with deep learning, and can effectively improve model performance and interpretability.

[0068] In one implementation, combined with Figure 2 As shown, the multi-head attention processing and secure attention processing of the embedded features to obtain attention features include:

[0069] Multi-head attention processing is applied to the embedded features to obtain attention-processed features;

[0070] The attention-processed features and embedded features are subjected to residuals and normalization to obtain multi-head extraction features;

[0071] Safety attention features are obtained by performing safe attention extraction on multi-head extracted features.

[0072] Feedforward processing is applied to the safety attention features to obtain feedforward features;

[0073] The attention features are obtained by performing residual and normalization on the feedforward features and multi-head extracted features.

[0074] This application presents a deep learning model architecture based on the Transformer encoder layer structure with customized improvements for the security domain.

[0075] In this application, the multi-head self-attention mechanism allows the model to examine the entire sequence of actions in parallel from multiple different "representation subspaces" (i.e., "heads"). Each "head" may focus on different aspects or different types of dependencies in the sequence.

[0076] In this application, during malware detection, one "head" may focus on file operation sequences, another "head" may focus on the correlation between network connection behaviors, and a third "head" may attempt to discover the relationship between process creation and registry modification. Through parallel processing, the model can comprehensively and from multiple perspectives understand the complex correlations between various events in the behavioral sequence.

[0077] In this application, security attention extraction is the most innovative and domain-specific part tailored for malware detection tasks.

[0078] In this application, the feedforward neural network (FFN) typically consists of two linear transformation layers and a nonlinear activation function (such as ReLU or GELU). The feature vector at each position in the sequence undergoes independent and identical processing.

[0079] In this way, the features extracted by the attention mechanism are subjected to nonlinear transformation and spatial mapping, giving the model a stronger representational capability.

[0080] In this application, the security attention extraction module successfully transforms human expert knowledge into guiding signals that the model can understand and utilize, significantly improving detection accuracy and generalization ability to unknown variants.

[0081] In one implementation, combined with Figure 3 As shown, the step of performing security attention extraction on the multi-head extraction features to obtain security attention features includes:

[0082] The features extracted from multiple heads are linearly processed to obtain linear features;

[0083] The linear features are subjected to the first multi-head attention process to obtain the first multi-head features.

[0084] The first multi-head feature is subjected to a second multi-head attention process to obtain the second multi-head feature;

[0085] The second multi-head feature is linearly processed to obtain the safety attention feature.

[0086] Here, "performing linear processing" refers to processing the data through a linear projection layer. This projects the dimensions of the input features onto hidden dimensions that are easier for the sub-network to process.

[0087] The first layer of the attention mechanism begins processing the features after initial linear transformation. It establishes connections within the sequence, learning the initial interactions and dependencies between behavioral features.

[0088] The second layer of attention takes the output of the first layer as input and performs further contextual integration on top of the already integrated contextual features. Based on these established relationships, the second layer can learn higher-level and more abstract combinations of behavioral patterns.

[0089] The two-layer structure makes the "Security Attention" module itself a powerful feature extractor, specifically designed to uncover deeply hidden and complex malicious behavior characteristics.

[0090] In this application, linear processing is performed separately, and the features refined by the two layers of attention are projected back to the desired dimension of the main network so as to seamlessly connect with other parts of the main network.

[0091] In this application, the security attention extraction adopts a hierarchical structure to understand behavior. By stacking two layers of attention, the module has a powerful non-linear representation capability, which can fit very complex functions, thereby identifying extremely stealthy and cunning malware behavior strategies.

[0092] In one implementation, the training process of the online recognition deep model includes:

[0093] Acquire known malicious behavior data and normal behavior data;

[0094] Using malicious behavior data and normal behavior data as samples, the online recognition deep model is trained to obtain the trained online recognition deep model;

[0095] Obtain real-time behavioral data and malware identification results of the system under test;

[0096] Using the behavioral data of the system to be detected and the results of malware identification as samples, the online identification depth model is dynamically adjusted to obtain the dynamically adjusted online identification depth model.

[0097] In this application, a pre-labeled dataset containing known malicious and normal behavior data is used to train the model in a supervised learning manner. The training process minimizes the difference (loss function) between the model's prediction (malware identification result) and the true label (whether it is malicious or benign).

[0098] In this application, a pre-trained model is deployed to a real environment. The model performs real-time analysis on incoming unknown programs and outputs malware identification results. Behavioral data and malware identification results are continuously collected. After annotation or confirmation, the online deep identification model is dynamically adjusted.

[0099] Dynamic adjustment can be:

[0100] Incremental learning (Online Learning / Incremental Learning): The model continuously updates its parameters using newly incoming labeled data in small batches without forgetting old knowledge.

[0101] Fine-tuning: The system periodically (e.g., daily, weekly) collects new, validated samples over a period of time to form a new dataset, and then uses this new dataset to perform an additional round of training on the existing model.

[0102] This allows the model to adapt to new threat trends, correct its own errors, and learn software behavior patterns for specific environments.

[0103] In this application, dynamic adjustments enable the model to keep pace with changes in the threat landscape and detect new types of malware. This connects the traditionally isolated "detection" and "analysis" processes into a self-optimizing, automated closed-loop system, significantly improving the efficiency of security operations and the overall resilience of the security architecture.

[0104] In this application, network models such as LSTM or Transformer are used to perform temporal modeling on the preprocessed behavior sequence. During the model training process, a large amount of known malicious behavior data and normal behavior data are used for supervised learning to build an accurate discrimination model. During online recognition, the real-time collected behavior data is input into the model, and the model outputs a malicious behavior probability score and a specific behavior risk label.

[0105] In this application, fine-grained features related to malicious behavior are automatically and comprehensively extracted from massive system monitoring data.

[0106] In this application, an effective deep learning model is built to accurately model and identify long-term, multi-dimensional dynamic behavioral data in real time; online identification and feedback of the system are realized to quickly respond to threats to system security from new types of malware; at the same time, the false positive rate and false negative rate are reduced, and the robustness and generalization ability of the overall detection system are improved.

[0107] In this application, dynamic data monitoring and behavioral feature acquisition technologies are used to preprocess information such as operating system, file system, network and process behavior; deep neural networks (such as Long Short-Term Memory Network LSTM, Transformer, etc.) are used to model behavioral sequences, and through training and optimization, accurate identification of the dynamic behavior of malware is achieved, and finally the detection results are output, and online model updates are supported to deal with new threats.

[0108] This application provides a dynamic malware identification device based on a deep learning model, used to execute the dynamic malware identification method based on a deep learning model described above. The following is a detailed description of the dynamic malware identification device based on a deep learning model.

[0109] like Figure 4 As shown, the dynamic malware identification device based on a deep learning model includes:

[0110] Data acquisition module 101 is used to acquire behavioral data of the system to be tested;

[0111] Data preprocessing module 102 is used to preprocess and extract features from the behavioral data of the system to be detected, so as to obtain behavioral features;

[0112] The model recognition module 103 is used to input behavioral features into a trained online deep recognition model to obtain malware recognition results.

[0113] In one implementation, the behavioral data includes at least: process call data, API call data, file read / write data, and network connection data.

[0114] In one embodiment, the data preprocessing module 102 is further configured to:

[0115] The behavior data of the detection system is subjected to noise filtering to obtain filtering information; the filtering information is decomposed into classification features, numerical features and text features, and the correlation between the decomposition results of the same filtering information is constructed; the classification features, numerical features and text features are normalized and feature fusion is performed to fuse the features; the fused features are then subjected to feature extraction based on the Mamba structure to obtain the extracted behavior features.

[0116] In one embodiment, the data preprocessing module 102 is further configured to:

[0117] Channel attention is extracted from the fused features to obtain the weight coefficients of each channel; multi-scale transformation is performed on the fused features to obtain the transformed features; the fused features are weighted based on the weight coefficients and superimposed with the transformed features to obtain the behavioral features.

[0118] In one implementation, the malware identification result includes a malicious behavior probability score and a behavior risk identifier.

[0119] In one implementation, the model recognition module 103 is further configured to:

[0120] The behavioral features are embedded to obtain embedded features; the embedded features are then subjected to multi-head attention and security attention processing to obtain attention features; and the attention features are further processed to obtain malware identification results.

[0121] In one implementation, the model recognition module 103 is further configured to:

[0122] Multi-head attention processing is applied to the embedded features to obtain attention-processed features; residuals and normalization are performed on the attention-processed features and the embedded features to obtain multi-head extracted features; safe attention extraction is performed on the multi-head extracted features to obtain safe attention features; feedforward processing is applied to the safe attention features to obtain feedforward features; residuals and normalization are performed on the feedforward features and the multi-head extracted features to obtain attention features.

[0123] In one implementation, the model recognition module 103 is further configured to:

[0124] The multi-head extracted features are linearly processed to obtain linear features; the linear features are then subjected to a first multi-head attention process to obtain the first multi-head feature; the first multi-head feature is then subjected to a second multi-head attention process to obtain the second multi-head feature; and the second multi-head feature is then linearly processed to obtain the safe attention feature.

[0125] In one implementation, the model recognition module 103 is further configured to:

[0126] Acquire known malicious behavior data and normal behavior data; use the malicious behavior data and normal behavior data as samples to train the online identification deep model, and obtain the trained online identification deep model; acquire real-time behavior data of the system to be detected and malware identification results; use the behavior data of the system to be detected and malware identification results as samples to dynamically adjust the online identification deep model, and obtain the dynamically adjusted online identification deep model.

[0127] The dynamic malware identification device based on a deep learning model provided in the above embodiments of this application corresponds to the dynamic malware identification method based on a deep learning model provided in the embodiments of this application. Therefore, the specific content in this system corresponds to the dynamic malware identification method based on a deep learning model. The specific content can be referred to the records in the dynamic malware identification method based on a deep learning model, and will not be repeated in this application.

[0128] The dynamic malware identification device based on a deep learning model provided in the above embodiments of this application and the dynamic malware identification method based on a deep learning model provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications they store.

[0129] The above describes the internal functions and structure of a dynamic malware identification device based on a deep learning model, such as... Figure 5 As shown, in practice, this dynamic malware identification device based on a deep learning model can be implemented as an electronic device, including: a memory 301 and a processor 303.

[0130] Memory 301 can be configured to store a program.

[0131] Additionally, memory 301 can also be configured to store various other data to support operation on the electronic device. Examples of this data include instructions for any application or method used to operate on the electronic device, contact data, phonebook data, messages, pictures, videos, etc.

[0132] Memory 301 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. Processor 303, coupled to memory 301, is used to execute programs in memory 301 for:

[0133] Acquire behavioral data of the system under test;

[0134] The behavioral data of the detection system is preprocessed and feature extracted to obtain behavioral features;

[0135] By inputting behavioral features into a trained online deep learning model, malware identification results are obtained.

[0136] In one implementation, the behavioral data includes at least: process call data, API call data, file read / write data, and network connection data.

[0137] In one implementation, the processor 303 is further configured to:

[0138] The behavior data of the detection system is subjected to noise filtering to obtain filtering information; the filtering information is decomposed into classification features, numerical features and text features, and the correlation between the decomposition results of the same filtering information is constructed; the classification features, numerical features and text features are normalized and feature fusion is performed to fuse the features; the fused features are then subjected to feature extraction based on the Mamba structure to obtain the extracted behavior features.

[0139] In one implementation, the processor 303 is further configured to:

[0140] Channel attention is extracted from the fused features to obtain the weight coefficients of each channel; multi-scale transformation is performed on the fused features to obtain the transformed features; the fused features are weighted based on the weight coefficients and superimposed with the transformed features to obtain the behavioral features.

[0141] In one implementation, the malware identification result includes a malicious behavior probability score and a behavior risk identifier.

[0142] In one implementation, the processor 303 is further configured to:

[0143] The behavioral features are embedded to obtain embedded features; the embedded features are then subjected to multi-head attention and security attention processing to obtain attention features; and the attention features are further processed to obtain malware identification results.

[0144] In one implementation, the processor 303 is further configured to:

[0145] Multi-head attention processing is applied to the embedded features to obtain attention-processed features; residuals and normalization are performed on the attention-processed features and the embedded features to obtain multi-head extracted features; safe attention extraction is performed on the multi-head extracted features to obtain safe attention features; feedforward processing is applied to the safe attention features to obtain feedforward features; residuals and normalization are performed on the feedforward features and the multi-head extracted features to obtain attention features.

[0146] In one implementation, the processor 303 is further configured to:

[0147] The multi-head extracted features are linearly processed to obtain linear features; the linear features are then subjected to a first multi-head attention process to obtain the first multi-head feature; the first multi-head feature is then subjected to a second multi-head attention process to obtain the second multi-head feature; and the second multi-head feature is then linearly processed to obtain the safe attention feature.

[0148] In one implementation, the processor 303 is further configured to:

[0149] Acquire known malicious behavior data and normal behavior data; use the malicious behavior data and normal behavior data as samples to train the online identification deep model, and obtain the trained online identification deep model; acquire real-time behavior data of the system to be detected and malware identification results; use the behavior data of the system to be detected and malware identification results as samples to dynamically adjust the online identification deep model, and obtain the dynamically adjusted online identification deep model.

[0150] In this application, Figure 5 The diagram only shows some components and does not mean that the electronic device includes only these components. Figure 5 The components shown.

[0151] The electronic device provided in this embodiment is based on the same inventive concept as the dynamic malware identification method based on deep learning model provided in this application embodiment, and has the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0152] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0153] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0154] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0155] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory. Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0156] This application also provides a computer-readable storage medium corresponding to the dynamic malware identification method based on a deep learning model provided in the foregoing embodiments, wherein a computer program (i.e., a program product) is stored thereon. When the computer program is run by a processor, it executes the interactive image analysis assistance method for 3D aerial imaging provided in any of the foregoing embodiments.

[0157] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0158] The computer-readable storage medium provided in the above embodiments of this application and the interactive image analysis assistance method for 3D aerial imaging provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0159] It should be noted that numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known structures and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0160] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0161] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for identifying dynamic malware based on a deep learning model, characterized in that, include: Acquire behavioral data of the system under test; The behavioral data of the detection system is preprocessed and feature extracted to obtain behavioral features; By inputting behavioral features into a trained online deep learning model, malware identification results are obtained.

2. The dynamic malware identification method based on a deep learning model according to claim 1, characterized in that, The behavioral data includes at least: process call data, API call data, file read / write data, and network connection data.

3. The dynamic malware identification method based on a deep learning model according to claim 1, characterized in that, The behavior data of the system to be detected is preprocessed and feature extracted to obtain behavior features, including: Noise filtering is performed on the behavioral data of the system to be detected to obtain filtering information; The filtering information is broken down into categorical features, numerical features, and text features, and the correlation between the breakdown results of the same filtering information is constructed. Normalize and fuse categorical features, numerical features, and text features; The fused features are subjected to feature extraction based on the Mamba structure to obtain the extracted behavioral features.

4. The dynamic malware identification method based on a deep learning model according to claim 3, characterized in that, The step of extracting the behavioral features from the fused features based on the Mamba structure includes: Channel attention is extracted from the fused features to obtain the weight coefficients for each channel; The fused features are subjected to multi-scale transformation to obtain the transformed features. The fused features are weighted based on weighting coefficients and then superimposed with the transformed features to obtain the behavioral features.

5. The method for identifying dynamic malware based on a deep learning model according to any one of claims 1-4, characterized in that, The malware identification results include a malicious behavior probability score and a behavior risk indicator.

6. The dynamic malware identification method based on a deep learning model according to claim 5, characterized in that, The process of inputting behavioral features into a trained online deep learning model to obtain malware identification results includes: The behavioral features are embedded to obtain the embedded features; Multi-head attention and secure attention processing are applied to the embedded features to obtain attention features; Attention features are processed to obtain malware identification results.

7. The dynamic malware identification method based on a deep learning model according to any one of claims 1-4, characterized in that, The training process of the online recognition deep model includes: Acquire known malicious behavior data and normal behavior data; Using malicious behavior data and normal behavior data as samples, the online recognition deep model is trained to obtain the trained online recognition deep model; Obtain real-time behavioral data and malware identification results of the system under test; Using the behavioral data of the system to be detected and the results of malware identification as samples, the online identification depth model is dynamically adjusted to obtain the dynamically adjusted online identification depth model.

8. A dynamic malware identification device based on a deep learning model, characterized in that, include: The data acquisition module is used to acquire behavioral data of the system under test. The data preprocessing module is used to preprocess and extract features from the behavioral data of the system to be detected, so as to obtain behavioral features. The model recognition module is used to input behavioral features into a trained online deep recognition model to obtain malware recognition results.

9. An electronic device, characterized in that, include: Memory and processor; The memory is used to store programs; The processor, coupled to the memory, is used to execute the program for: Acquire behavioral data of the system under test; The behavioral data of the detection system is preprocessed and feature extracted to obtain behavioral features; By inputting behavioral features into a trained online deep learning model, malware identification results are obtained.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by a processor to implement the dynamic malware identification method based on a deep learning model as described in any one of claims 17.

Images