Feature refining method and device based on dynamic security context
By acquiring the features from the previous iteration and generating a retention mask from the current security context, the features most relevant to the current security environment are selected, and the malware detection model is updated and trained. This solves the problem of insufficient malware detection accuracy in existing technologies and improves the detection capability for new threats and the model's ability to cope with complex threats.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-31
- Publication Date
- 2026-04-03
AI Technical Summary
Existing malware detection technologies lack adaptability in the face of constantly evolving new malware and attack strategies, resulting in insufficient detection accuracy. Static detection methods are poor at identifying new and variant malware, multi-round historical intelligence utilization is incomplete, and feature refinement and contextual correlation are insufficient, making it impossible to efficiently deal with complex security threats.
By acquiring the features from the previous iteration and the security context of the current iteration, a retention mask is generated, thereby selecting the retention features most relevant to the current security environment. The malware detection model is then updated and trained, and the dynamic security context is used to refine the features, thereby improving the detection capability of new threats.
This enables the malware detection model to focus on the most relevant features of the current security environment during training updates, improving the ability to detect new threats and enhancing the model's robustness and flexibility in dealing with complex security threats.
Smart Images
Figure CN121786437A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a feature refinement method and apparatus based on dynamic security context. Background Technology
[0002] Traditional malware detection techniques, especially those based on static and dynamic analysis, primarily rely on detecting file characteristics or execution behaviors. However, existing malware detection methods lack adaptability when faced with constantly evolving new malware or attack strategies, resulting in insufficient detection accuracy. Summary of the Invention
[0003] This invention provides a feature refinement method and apparatus based on dynamic security context. The technical solution is as follows: On the one hand, a feature refinement method based on dynamic security context is provided, the method comprising: Obtain the features from the previous iteration and the security context for the current iteration; the features from the previous iteration are those used by the malware detection model during the previous training process. Use the current security context to generate a preserved mask from the features of the previous iteration; Use a retention mask to filter out retained features from the features of the previous iteration; The malware detection model is trained in this round using the preserved features, and the malware detection model obtained in this round of training is used for malware detection.
[0004] On the other hand, a feature refining apparatus based on a dynamic security context is provided, the apparatus comprising: The acquisition unit is used to acquire the features from the previous iteration and the security context for the current iteration; the features from the previous iteration are the features used by the malware detection model during the previous training process. The generation unit is used to generate a preserved mask based on the features from the previous iteration using the current round's security context; The filtering unit is used to filter out retained features from the features of the previous iteration using a retention mask; The training unit is used to train the malware detection model in this round using the preserved features, so as to use the malware detection model obtained in this round of training to detect malware.
[0005] On the other hand, a computer device is provided, the computer device including a memory and a processor, the memory for storing a computer program, and the processor for executing the computer program stored in the memory to implement the steps of the feature refinement method based on dynamic security context described above.
[0006] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements the steps of the feature refinement method based on dynamic security context described above.
[0007] On the other hand, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the feature refinement method based on dynamic security context described above.
[0008] The technical solution provided by this invention can bring at least the following beneficial effects: After training, malware detection models need to be updated periodically and irregularly. During each training round, the features used in the previous training round need to be obtained, and then the security context of the current round needs to be obtained. Since the security context is also updated between the previous training round and the current training round, the current security context is used to dynamically activate the features of the previous iteration. This allows the malware detection model to focus on retaining the features most relevant to the current security environment during the updated training, thereby improving the detection capability of new threats. Attached Figure Description
[0009] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0010] Figure 1 This is a flowchart of a feature refinement method based on dynamic security context provided in an embodiment of the present invention; Figure 2 This is a structural diagram of a feature refining device based on a dynamic security context provided in an embodiment of the present invention; Figure 3 This is a hardware architecture diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation
[0011] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.
[0012] An analysis of current malware detection technologies reveals that their detection accuracy is insufficient primarily due to the following reasons: First, there is insufficient utilization of security context information: most existing malware detection technologies focus on extracting single features, such as binary file header information, API calls, or system behavior. This shows that they neglect the importance of security context (such as previous detection results and attack pattern evolution) in malware detection. Consequently, existing systems lack the ability to adapt to constantly evolving new malware or attack strategies, resulting in high false positive and false negative rates.
[0013] Second, the limitations of static detection methods: While static analysis can efficiently detect known malware, it is less effective at identifying new and variant malware. Furthermore, existing static analysis methods lack the ability to effectively utilize dynamically changing threat intelligence, preventing detection systems from updating and optimizing their detection rules and models in a timely manner.
[0014] Third, the system cannot effectively utilize multiple rounds of historical intelligence: In traditional malware detection systems, the mechanisms for transmitting and responding to multiple rounds of historical intelligence are not perfect. Especially when facing constantly evolving malware, the system often cannot use recent threat intelligence (such as new attack families, IOC indicators, etc.) to adjust detection strategies and optimize models.
[0015] Fourth, insufficient feature refinement and contextual awareness: Existing feature refinement technologies are mostly static processes, lacking context awareness and dynamic refinement capabilities. Models typically rely on fixed features and rules, failing to adjust flexibly and effectively capture new threats.
[0016] Therefore, existing malware detection technologies are not robust and flexible enough in changing network environments and cannot effectively deal with complex security threats, especially in dynamic security situations and in the face of unseen malware types, where their identification ability is poor.
[0017] Based on the above analysis results, the inventive concept of this invention is to provide a feature refinement method based on dynamic security context. When updating and training a malware detection model, the recently dynamically changed security context is injected into the model, so that the model can adaptively adjust the feature focus according to the current security context, thereby improving the detection capability of new malware.
[0018] The following describes the specific implementation of the above concept.
[0019] Please refer to Figure 1 This invention provides a feature refinement method based on dynamic security context, the method comprising: Step 100: Obtain the features from the previous iteration and the security context for the current iteration; the features from the previous iteration are the features used by the malware detection model during the previous training process. Step 102: Generate a preserved mask for the features from the previous iteration using the current round's security context; Step 104: Use the retention mask to filter out the retained features from the features of the previous iteration; Step 106: Use the preserved features to train the malware detection model in this round, so as to use the malware detection model obtained in this round of training to detect malware.
[0020] In this embodiment of the invention, after the malware detection model is trained, it needs to be updated periodically and irregularly. During each round of training, the features used in the previous round of training need to be obtained, and then the security context of the current round needs to be obtained. Since the security context has also been updated between the previous round of training and the current round of training, the current round of security context is used to dynamically activate the features of the previous round of iteration. This allows the malware detection model to focus on the retained features most relevant to the current security environment during the update training, thereby improving the detection capability of new threats.
[0021] The following description Figure 1 The execution method of each step is shown.
[0022] First, for step 100, obtain the features of the previous iteration and the security context of the current iteration.
[0023] In this embodiment of the invention, after the malware detection model is trained, in order to improve its ability to detect new threats, the trained malware detection model needs to be updated periodically and irregularly. During the update training, not only new samples can be added, but also new security contexts can be added, so as to use the dynamically updated security context of the current round as security intelligence to adjust the detection strategy of the malware detection model and optimize the model.
[0024] In one embodiment of the present invention, the security context includes at least one or more of the following: threat intelligence summary, recent detection results, family characteristics associated with malware, and historical information associated with malware; wherein, the threat intelligence summary may include known characteristics, attack organizations, industry trends, etc.; recent detection results may include alerts, correlation data, sandbox analysis, etc.; family characteristics may include behavior, code, structure, etc.; and historical information may include infection, handling, and propagation information, etc.
[0025] The security context of this invention is used to guide the detection decisions of the model, enabling it to better adapt to different malware samples and new attack methods.
[0026] In this embodiment of the invention, after each round of training of the malware detection model, the features used in this round of training need to be stored for use in the next round of training. Therefore, the features from the previous iteration are the features used by the malware detection model in the previous training process.
[0027] Then, the steps 102 "using the current security context to generate a retention mask for the features of the previous iteration" and 104 "using the retention mask to filter out the retention features from the features of the previous iteration" will be explained simultaneously.
[0028] In one embodiment of the present invention, the step of generating a preserved mask based on the features of the previous iteration using the current round of security context may specifically include: Step 1020: Determine the weight score of each feature in the previous iteration based on the degree of correlation between each feature in the previous iteration and the current security context; Step 1022: Generate a retention mask based on the weight score using a gating mechanism; this retention mask is used to determine which features are retained and which are deleted.
[0029] As malware and attack strategies constantly change during the use of malware detection models, in order for the malware detection model to cope with these changes, a new security context is introduced to guide feature selection during each training update. This ensures that features from the previous iteration are retained that are more relevant to the new security context, so that the malware detection model can focus on the features most relevant to the current security environment during training updates.
[0030] In step 1020, the degree of association can be calculated using similarity. The greater the similarity, the greater the weight score; conversely, the smaller the cosine similarity, the smaller the weight score. When calculating similarity, at least cosine similarity, Euclidean distance, and Pearson correlation coefficient can be used.
[0031] In step 1022, the retained mask is generated through a gating mechanism, which is used to selectively retain or ignore parts of the input information. When generating the retained mask, a pre-set gating threshold can be compared with the weight score of each feature. If the weight score is greater than the gating threshold, the retained mask is 1; if the weight score is not greater than the gating threshold, the retained mask is 0.
[0032] Therefore, in step 104, the step of using a retention mask to filter out retained features from the features of the previous iteration can specifically include: Features whose weight scores are not less than the gate threshold from the previous iteration are retained, and features whose weight scores are less than the gate threshold from the previous iteration are retained, thus obtaining the retained features.
[0033] For example, the feature vector of the previous iteration is: H = [H1,H2, H3, H4, H5, H6]; The feature vector of the security context in this round is: D=[D1,D2,D3]; Then, for the i-th feature in the previous iteration, its correlation with the current security context can be calculated using the following formula: C(Hi,D)=[C(Hi,D1)+ C(Hi,D2)+ C(Hi,D3)] / 3.
[0034] Assuming the weight scores of the features from the previous iteration are [0.8, 0.9, 0.95, 0.5, 0.75, 0.6], this indicates that H4 and H6 have a low correlation with the current security context, while H1, H2, H3, and H5 have a high correlation. If the gating threshold is 0.7, the generated retention mask can be [1, 1, 1, 0, 1, 0]. In other words, the retained features are [H1, H2, H3, H5].
[0035] Finally, for step 106, the malware detection model is trained in this round using the preserved features, so as to use the malware detection model obtained in this round of training to detect malware.
[0036] In this embodiment of the invention, since the retained features are the features most closely related to the current security context, when updating and training the malware detection model using the retained features, the malware detection model can focus on the features in the current security environment.
[0037] To prevent key information in the features during the training process from being lost during the gating process, in one embodiment of the present invention, before generating a retainable mask for the features of the previous iteration using the current security context, the method may further include: selecting key features from the features of the previous iteration and using the remaining features as the features of the previous iteration for subsequent processing. After selecting retained features from the features of the previous iteration using a retained mask, and before training the malware detection model using the retained features in this round, the process may further include: adding the key features to the retained features, so as to perform the training of the malware detection model in this round using the retained features with the key features added.
[0038] By pre-screening key features and then adding them to the retained features that are most relevant to the current security context, the retained features can still maintain high accuracy in identifying malware.
[0039] In order to further describe the key features, this invention first explains the training method of the malware detection model and the original features used by the malware detection model in the first round of training.
[0040] Malware detection models detect software binary files to identify whether the software is malware. However, the byte sequences in binary files are generally unsuitable for training neural networks and identifying malware. These byte sequences contain essential characteristics of the software. To train and identify these essential characteristics, this invention proposes encoding the byte sequences of binary files into images, transforming the byte sequences into visual evidence. This encoded image not only contains the byte sequence content but also serves as a training ground for neural networks and a means of malware detection. Therefore, binary files can be image-encoded for neural network training and malware detection.
[0041] As can be seen, the raw features used in the initial training of the malware detection model were extracted from the software's binary file. The extraction method for these raw features was as follows: the binary file was encoded into an image, and visual features were extracted from the image as raw features; the encoded image retained the structural information of the binary file; the structural information included segment information and / or high-entropy regions.
[0042] Visual features are representative features extracted from images to describe their content. In malware detection, visual features help malware detection models understand the structure and content of binary files, thus enabling effective classification.
[0043] In this embodiment of the invention, segment information includes segment boundaries. Segment boundaries refer to the physical separation points between different segments in a binary file, used to distinguish different parts of the binary file.
[0044] Furthermore, segment information may also include: segment type. Segment type may include: .text segment, .data segment, .bss segment, .rodata segment, .stack segment, .heap segment.
[0045] In this embodiment of the invention, a high-entropy region refers to a region in a file where byte data exhibits high randomness and complexity, such as encrypted or compressed data. These regions have a uniform byte distribution, making it difficult to infer subsequent bytes from past byte patterns; they are typically associated with specifically processed data. In this embodiment, the randomness and complexity of data within a region can be determined by calculating its entropy value. High-entropy regions have higher entropy values, while low-entropy regions (such as zero-padding or static data) have lower entropy values. High-entropy regions are generally carriers of malware, such as encrypted malicious code or compressed malicious payloads. Therefore, by identifying high-entropy regions in a binary file and preserving them as structural information in the encoded image, subsequent malware detection models can more accurately capture the core hidden features of malware during training.
[0046] In one embodiment of the present invention, a binary file can be encoded into an image in the following manner: Step 600: Determine the structure information and total number of bytes of the binary file; Step 602: Determine the appropriate line width to accommodate the binary file based on the total number of bytes in the binary file; Step 604: Use the adapted line width to perform image encoding on the binary file to obtain the encoded image of the binary file.
[0047] In this embodiment of the invention, by determining the structural information and total number of bytes of a binary file, and then determining the appropriate line width to accommodate the binary file, the binary file is image-encoded using the appropriate line width. This allows the encoded image to retain the structural information of the binary file, thereby avoiding the loss of structural information caused by fixed line width image encoding. This improves the structural fidelity of the image in representing the content of the binary file. Furthermore, since the encoded image can effectively reflect the internal structure of the binary file, it provides richer and more accurate input data for training malware detection models, thereby improving the ability to identify different file structures during malware identification.
[0048] In step 602, the adapted line width can be determined as follows (steps 6020-6028): Step 6020: Determine the mapping relationship between binary bytes and image pixels; This mapping relationship refers to mapping several bytes to several pixels in an image. For example, in grayscale image mapping, one binary byte is mapped to one pixel; in RGB image mapping, three binary bytes are mapped to different channels of one pixel.
[0049] Step 6022: Determine the encoding method for structural information; To preserve the structural information of the binary file, allowing segment information and high-entropy regions to be displayed in the encoded image, the structural information can be encoded as follows: Segment information is encoded using the following encoding method to make segment boundaries visible in the encoded image: Each segment occupies a different region in the coded image; Different segments are distinguished by pixel spacing or line spacing; and / or Different segment types are coded using different colors.
[0050] The high-entropy regions of the binary file are encoded using the following method to visualize them in the encoded image: the pixel positions in the encoded image corresponding to the byte range of the high-entropy region in the binary file are set as specific feature markers. These feature markers include specific colors and / or specific patterns. This allows the malware detection model to focus more on these high-entropy regions during training, improving the accuracy of malware detection.
[0051] Step 6024: Determine the total number of pixels in the encoded image based on the mapping relationship, the encoding method, and the total number of bytes in the binary file; Step 6026: Determine the initial line width based on the total number of pixels and the target aspect ratio; Step 6028: Adjust the initial line width based on the preset line width range so that the adjusted adaptive line width is within the preset line width range.
[0052] Assuming the target aspect ratio is W / H and the total number of pixels is N, the initial line width can be determined by W×H≥N. To avoid extreme imbalance or excessively large blank areas, the line width can be adjusted to the preset line width range using the following formula: Fit line width = max(min(initial line width, maximum line width endpoint), minimum line width endpoint) This ensures that the line width is within the preset range and that the width and height of the image are as balanced as possible.
[0053] In this embodiment of the invention, by dynamically selecting and adapting the line width, the amount of data in each line is ensured to be appropriate, so as not to lose the relationship between segments. Using different line widths for different binary files ensures that each binary file can adapt to image generation while preserving the structural information of the binary file.
[0054] Using the above embodiments, after encoding the binary file into an image, visual features can be extracted from the image. Furthermore, after extracting the visual features from the image, feature fusion with the security context can be performed to use the fused features as the original features.
[0055] Since the original features used by the malware detection model are extracted from the binary files of the software, and the structural information in the binary files can express the internal structure of the malware, enabling the malware detection model to have high-precision identification capabilities for complex software, in one embodiment of the present invention, the key features to be retained during the update training process include at least the segment information of the binary files and / or the features of high-entropy regions.
[0056] It should be noted that, since the encoding method for key features into images and the mapping relationship between byte sequences in binary files and image pixels are known, the visual features extracted from the encoded image contain markers for the key features. In each round of feature iteration, the markers for these key features are retained in the iterative features. When selecting key features from the previous round of iterative features, these markers can be used to identify them.
[0057] In this embodiment of the invention, the malware detection model is updated and trained periodically and irregularly. During each training round, the updated context of the current round is used to dynamically activate the features of the previous iteration. This allows the malware detection model to focus on the features most relevant to the current security environment during the update training, thereby improving the detection capability of new threats.
[0058] Please refer to Figure 2 This invention provides a feature refining apparatus based on a dynamic security context, the apparatus comprising: The acquisition unit 200 is used to acquire the features of the previous iteration and the security context of the current iteration; the features of the previous iteration are the features used by the malware detection model during the previous training process; Generation unit 202 is used to generate a preserved mask for the features of the previous iteration using the current round of security context; The filtering unit 204 is used to filter out retained features from the features of the previous iteration using a retention mask; Training unit 206 is used to train the malware detection model in this round using the preserved features, so as to use the malware detection model obtained in this round of training to perform malware detection.
[0059] In one embodiment of the present invention, the generation unit is specifically used to: determine the weight score of each feature in the previous iteration based on the degree of association between each feature in the previous iteration and the current security context; generate a retention mask based on the weight score using a gating mechanism; the retention mask is used to determine the features to be retained and deleted.
[0060] In one embodiment of the present invention, when the generation unit performs the step of filtering out retained features from the features of the previous iteration using a retention mask, it specifically includes: retaining features in the features of the previous iteration whose weight score is not less than the gate threshold, and retaining features in the features of the previous iteration whose weight score is less than the gate threshold, thereby obtaining retained features.
[0061] In one embodiment of the present invention, before generating a retained mask for the previous iteration features using the current security context, the filtering unit is further configured to: filter out key features from the previous iteration features and use the remaining features as the previous iteration features for subsequent processing; The apparatus may further include an adding unit, configured to add the key features to the retained features after the retained features are selected from the features of the previous iteration using a retained mask, and before the current training of the malware detection model using the retained features, so as to perform the current training of the malware detection model using the retained features with the added key features.
[0062] In one embodiment of the present invention, the key features include at least segment information of the binary file and / or features of high-entropy regions.
[0063] In one embodiment of the present invention, the original features used by the malware detection model in the first round of training are extracted from the binary file of the software; the extraction method is: the binary file is encoded into an image, and visual features are extracted from the image as the original features; wherein, the encoded image retains the structural information of the binary file; the structural information includes segment information and / or high-entropy regions.
[0064] It should be noted that the feature refinement device based on dynamic security context provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the feature refinement device based on dynamic security context provided in the above embodiments and the feature refinement method embodiments based on dynamic security context belong to the same concept. The specific implementation process is detailed in the method embodiments and will not be repeated here.
[0065] Embodiments of this application also provide a computer device, please refer to... Figure 3 The computer device includes a processor and a memory, the memory storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by the processor to implement the feature refinement method based on dynamic security context provided in the above-described method embodiments.
[0066] Embodiments of this application also provide a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the feature refinement method based on dynamic security context provided in the above-described method embodiments.
[0067] Embodiments of this application also provide a computer program product comprising a computer program, wherein a processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, causing the computer device to perform any of the feature refinement methods based on dynamic security contexts described in the above embodiments.
[0068] For ease of description, the above systems or devices are described separately as various modules or units based on their functions. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware components.
[0069] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.
[0070] Finally, it should be noted that in this document, relational terms such as first, second, third, and fourth are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0071] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.
Claims
1. A feature refinement method based on dynamic security context, characterized in that, The method includes: Obtain the features from the previous iteration and the security context for the current iteration; the features from the previous iteration are those used by the malware detection model during the previous training process. Use the current security context to generate a preserved mask from the features of the previous iteration; Use a retention mask to filter out retained features from the features of the previous iteration; The malware detection model is trained in this round using the preserved features, and the malware detection model obtained in this round of training is used for malware detection.
2. The method according to claim 1, characterized in that, The step of generating a preserved mask based on the features from the previous iteration using the current round's security context includes: The weight score of each feature in the previous iteration is determined based on the degree of correlation between each feature in the previous iteration and the security context in the current iteration. A retention mask is generated based on weight scores using a gating mechanism; this retention mask is used to determine which features are retained and which are deleted.
3. The method according to claim 2, characterized in that, The step of using a retention mask to filter out retained features from the features of the previous iteration includes: Features whose weight scores are not less than the gate threshold from the previous iteration are retained, and features whose weight scores are less than the gate threshold from the previous iteration are retained, thus obtaining the retained features.
4. The method according to any one of claims 1-3, characterized in that, Before generating a retained mask from the previous iteration features using the current security context, the method further includes: filtering out key features from the previous iteration features and using the remaining features as the previous iteration features for subsequent processing; After filtering out the retained features from the features of the previous iteration using the retained mask, and before training the malware detection model using the retained features in this round, the method further includes: adding the key features to the retained features, so as to perform the training of the malware detection model in this round using the retained features with the added key features.
5. The method according to claim 4, characterized in that, The key features include at least the segment information of the binary file and / or features of high-entropy regions.
6. The method according to claim 5, characterized in that, The original features used by the malware detection model in the first round of training are extracted from the software's binary file. The extraction method is as follows: the binary file is encoded into an image, and visual features are extracted from the image as the original features. The encoded image retains the structural information of the binary file. The structural information includes segment information and / or high-entropy regions.
7. A feature refining device based on dynamic security context, characterized in that, The device includes: The acquisition unit is used to acquire the features from the previous iteration and the security context for the current iteration; the features from the previous iteration are the features used by the malware detection model during the previous training process. The generation unit is used to generate a preserved mask based on the features from the previous iteration using the current round's security context; The filtering unit is used to filter out retained features from the features of the previous iteration using a retention mask; The training unit is used to train the malware detection model in this round using the preserved features, so as to use the malware detection model obtained in this round of training to detect malware.
8. A computer device, characterized in that, The computer device includes a memory and a processor. The memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the steps of the method according to any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in any one of claims 1-6.
10. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1-6.