Feature reconstruction method and device based on Token score
By using a feature reconstruction method based on token scoring, important tokens are selected for attention calculation, and the remaining tokens are pooled and fused, the problem of high computational overhead in malware detection is solved, and efficient malware detection is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-31
- Publication Date
- 2026-04-03
AI Technical Summary
Existing malware detection technologies suffer from huge computational overhead when faced with complex and diverse malware, resulting in low identification efficiency.
The feature reconstruction method using token scoring is adopted. The binary file is decomposed into multiple tokens by word segmentation tool. The importance of the tokens is scored by using the textual and visual features of the tokens. The K tokens with the highest scores are selected for attention calculation. The remaining tokens are then pooled and fused at low cost to reduce computation and memory overhead.
While maintaining high recognition accuracy, it reduces computational complexity and improves the efficiency of malware detection, making it suitable for real-time processing of long sequences or large-scale binary files.
Smart Images
Figure CN121786458A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of computer science and artificial intelligence, and in particular to a feature reconstruction method and apparatus based on token scoring. Background Technology
[0002] Traditional malware detection techniques, especially those based on static and dynamic analysis, primarily rely on detecting file characteristics or execution behaviors. However, when faced with complex and diverse malware, existing malware detection systems incur significant computational overhead during data analysis. Summary of the Invention
[0003] This invention provides a feature reconstruction method and apparatus for token scoring. The technical solution is as follows: On the one hand, a feature reconstruction method based on token scoring is provided, the method comprising: The binary file to be analyzed is segmented using a word segmentation tool to obtain multiple tokens; The text features and visual features of each token are obtained; the text features are obtained by mapping the token to a unique ID and then performing vector transformation; the visual features are extracted based on the encoded image converted from the binary file. The importance of each token is scored using the textual and visual features of each token, resulting in a score for each token. Calculate attention weights for the K highest-scoring tokens, and then perform feature weighted fusion on the K highest-scoring tokens based on the attention weights to obtain attention features; Attention features and pooling features are reconstructed to utilize the reconstructed features for task processing; the pooling features are obtained by pooling and fusing the features of the remaining tokens.
[0004] On the other hand, a feature reconstruction apparatus based on token scoring is provided, the apparatus comprising: The acquisition unit is used to acquire the text features and visual features of each token; the text features are obtained by vector conversion after mapping the token to a unique ID; the visual features are extracted based on the encoded image converted from the binary file. The scoring unit is used to score the importance of each token by utilizing the textual and visual features of each token, and obtain a score for each token. The computation unit is used to calculate the attention weights for the K highest-scoring tokens, and to perform feature weighted fusion on the K highest-scoring tokens based on the attention weights to obtain the attention features; The reconstruction unit is used to reconstruct the features of attention features and pooling features, so as to use the reconstructed features for task processing; the pooling features are obtained by pooling and fusing the features of the remaining tokens.
[0005] On the other hand, a computer device is provided, the computer device including a memory and a processor, the memory for storing a computer program, and the processor for executing the computer program stored in the memory to implement the steps of the feature reconstruction method based on token scoring described above.
[0006] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements the steps of the feature reconstruction method based on token scoring described above.
[0007] On the other hand, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the feature reconstruction method based on token scoring described above.
[0008] The technical solution provided by this invention can bring at least the following beneficial effects: By introducing a Top-K sparse selection mechanism, the importance of tokens is scored using their textual and visual features. Attention is calculated only for the K tokens with the highest scores, reducing attention calculations for irrelevant tokens, thus lowering computational and memory overhead. Furthermore, through a dynamic reconstruction mechanism, features are weighted for the K tokens with the highest scores, while the features of the remaining tokens are fused after low-cost pooling. This not only preserves important information but also ensures the accuracy of detection results while reducing computational complexity. Attached Figure Description
[0009] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0010] Figure 1 This is a flowchart of a feature reconstruction method based on token scoring provided in an embodiment of the present invention; Figure 2 This is a structural diagram of a feature reconstruction device based on token scoring provided in an embodiment of the present invention; Figure 3This is a hardware architecture diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation
[0011] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.
[0012] The inventive concept of this invention lies in the following: When converting the byte sequence of a binary file into an encoded image for training and recognition of a malware detection model, if the binary file sequence is too long, it will lead to a huge overhead of attention computation during image processing. Based on this, considering that in natural language processing, tokens are words or sub-words in text, how to decompose a binary file containing a long byte sequence into multiple tokens, score the importance of the tokens, and use the K tokens with the highest scores for high-cost attention computation, while only performing low-cost pooling fusion processing on the remaining tokens, and then use the attention features containing important information and the pooling fusion features containing non-important information for feature reconstruction, so as to use the reconstructed features for subsequent task processing, thereby reducing the amount of computation and improving computational efficiency while maintaining high recognition accuracy.
[0013] The following describes the specific implementation of the above concept.
[0014] Please refer to Figure 1 The present invention provides a feature reconstruction method based on token scoring, the method comprising: Step 100: Use a word segmentation tool to segment the binary file to be analyzed to obtain multiple tokens; Step 102: Obtain the text features and visual features of each token; the text features are obtained by vector conversion after mapping the token to a unique ID; the visual features are extracted based on the encoded image converted from the binary file. Step 104: Use the textual and visual features of each token to score the importance of the corresponding token and obtain the score of each token. Step 106: Calculate attention for the K highest-scoring tokens, and perform feature weighting on the K highest-scoring tokens based on the attention scores to obtain attention features; Step 108: Reconstruct the attention features and pooling features to utilize the reconstructed features for task processing; the pooling features are obtained by pooling and fusing the features of the remaining tokens.
[0015] In this embodiment of the invention, by introducing a Top-K sparse selection mechanism, the importance of tokens is scored using the textual and visual features of the tokens. Attention is calculated only for the K tokens with the highest scores, reducing the attention calculation for irrelevant tokens, thus reducing computational and memory overhead. In addition, through a dynamic reconstruction mechanism, feature weighting is performed on the K tokens with the highest scores, while the remaining tokens are fused after low-cost pooling operations. This not only preserves important information but also ensures the accuracy of the detection results while reducing computational complexity.
[0016] The following description Figure 1 The execution method for each step is shown.
[0017] First, for step 100, the binary file to be analyzed is segmented using a word segmentation tool to obtain multiple tokens.
[0018] In this embodiment of the invention, before explaining why binary files are segmented with tokens as the segmentation target, and how the importance score of tokens is used to select which features to use for costly attention calculations, the training and features used by the malware detection model are explained first.
[0019] Malware refers to any harmful software designed to damage, illegally access, steal information, or interfere with computer systems. Malware typically includes viruses, Trojans, spyware, ransomware, and more. Training malware detection models can be used to automatically identify these malicious programs, thus protecting computer systems and data security. The most basic data of malware is its binary file. The byte sequence within the binary file contains the essential characteristics of the software. If these essential characteristics can be identified, it is possible to more accurately distinguish between malware and legitimate software.
[0020] However, byte sequences are generally unsuitable for training neural networks and identifying malware. In order to train and identify these essential features, this invention encodes binary files into images, thereby transforming byte sequences into visual evidence. Since encoded images contain byte sequences and can be used for training neural networks and detecting malware, binary files are image-encoded, and then image encoding is used for training neural networks and detecting malware.
[0021] In the process of using encoded images as input to a malware detection model for malware identification, the model needs to extract visual features from the encoded image and perform attention calculations on these features to utilize them for identification. If the binary file is long or contains a large amount of irrelevant data, it incurs significant computational overhead, impacting the inference speed during the identification process. Therefore, it is possible to select only the more important visual features for attention calculations.
[0022] In this embodiment of the invention, the token is used as the decomposition target to determine which visual features are important, for the following reasons: First, in the process of encoding a binary file into an image, a token is a block in the binary file that has specific semantics (e.g., opcode, data block, file header, etc.); these tokens represent key information in the binary file. Therefore, embodiments of the present invention can identify semantic parts that are important to subsequent tasks (such as malware detection) by scoring the importance of the tokens.
[0023] Second, during the encoding process, each token is mapped to a region of the image. Therefore, the importance of a token directly corresponds to the importance of certain regions in the image. The attention mechanism can be guided to focus on important visual features in the image by selecting important tokens.
[0024] Therefore, segmenting a binary file can yield multiple tokens. The segmentation tool can be BERTTokenizer.
[0025] Then, for step 102, obtain the textual and visual features of each token.
[0026] In this embodiment of the invention, the importance of a token can be evaluated based on both its textual and visual features. The textual features are obtained by mapping the token to a unique ID and then performing a vector transformation; the visual features are extracted from an encoded image converted from a binary file.
[0027] The methods for obtaining text features and visual features are explained below.
[0028] First, text features After segmenting the byte sequence in the binary file using a word segmentation tool, each token is mapped to a unique ID by looking up the BERT vocabulary. The embedding layer of the BERT model then converts the unique ID of each token into an embedding vector. Here, the unique ID is the index of the vocabulary.
[0029] Taking the text "execute_malicious_code" in a binary file as an example, the tokenization tool BERTTokenizer can process the text into tokens and obtain the following tokens: Token 1: "execute"; Token 2: "malicious"; Token 3: "code"; By looking up the vocabulary, let's assume that the Token can be mapped to the following unique ID: Token 1: "execute" → 1010 Token 2: "malicious" → 3055 Token 3: "code" → 5022 This yields a unique ID matrix [1010, 3055, 5022] for multiple tokens. This unique ID matrix is then input into the BERT model, where the embedding layer converts it into an embedding vector.
[0030] Second, visual features In order to illustrate how the visual features of each token are obtained, this embodiment of the invention first describes the image encoding process.
[0031] In this embodiment of the invention, the binary file of the software can be converted into an encoded image in the following manner: A1: Determine the encoding method of structural information and the mapping relationship between binary bytes and image pixels; A2: Encode the byte sequence in the binary file into the image according to the encoding method of the structural information and the mapping relationship between binary bytes and image pixels.
[0032] A binary file typically consists of several distinct parts, such as code segments and data segments, each referred to as a segment. The location and content of segments within a binary file are crucial for malware identification. In this embodiment of the invention, by preserving segment information and optimizing it within an attention mechanism, the model is able to better understand the structural features of binary files.
[0033] In one implementation, segment information includes segment boundaries. Segment boundaries are physical separation points between different segments in a binary file, used to distinguish different parts of the binary file.
[0034] In another implementation, the segment information also includes the segment type. Segment types can include: .text segment, .data segment, .bss segment, .rodata segment, .stack segment, and .heap segment.
[0035] In order to preserve segment information in the encoded image, in one embodiment of the present invention, the segment information is encoded in at least one of the following ways: Each segment occupies a different region in the coded image; Different segments are distinguished using pixel or line spacing; and, Different segment types are coded using different colors.
[0036] In this embodiment of the invention, entropy is an indicator that measures the disorder or uncertainty of data. In binary files, high-entropy regions typically contain complex or random content, often associated with malicious behavior. This embodiment of the invention optimizes the attention mechanism by extracting entropy features to accurately identify key parts of malicious files.
[0037] In one embodiment of the present invention, the method for determining high-entropy regions in a binary file may include: sliding a window across the binary file, calculating the entropy value of the window region after each slide, and determining the window region whose entropy value exceeds an entropy threshold as a high-entropy region of the binary file. The entropy value can be determined by calculating the byte probability distribution.
[0038] To preserve high-entropy regions in encoded images, in one embodiment of the present invention, the encoding method for high-entropy regions can be as follows: the pixel positions of the encoded image corresponding to the byte range of the high-entropy region in the binary file can be set as specific feature markers. These feature markers include specific colors and / or specific patterns. This allows the neural network to focus more on these high-entropy regions during training, improving the accuracy of malware detection.
[0039] In this embodiment of the invention, the mapping relationship between binary bytes and image pixels can include at least: single-channel mapping and multi-channel mapping. Single-channel mapping encodes one byte into one pixel; multi-channel mapping encodes multiple bytes (three bytes for RGB channels and four bytes for RGBA channels) into one pixel.
[0040] It should be noted that, to further ensure the structural fidelity of the binary file content, in one embodiment of the present invention, the line width of the encoded image corresponding to different binary files is adaptively obtained based on the size and structure of the binary file. The line width of the encoded image is the minimum value that can carry the binary file, and the line width is within a preset line width range. Furthermore, the size of the encoded image satisfies a preset aspect ratio. This avoids the loss of important information caused by a fixed line width.
[0041] As can be seen from the image encoding process described above, due to the encoding method of structural information and the mapping relationship between binary bytes and image pixels, each token is mapped to a region of the image during the encoding process. Therefore, by determining the encoded region in the encoded image corresponding to the token, the image processing module can determine the visual features corresponding to that encoded region, and the visual features corresponding to that encoded region can be identified as the visual features of the token. The encoded region in the encoded image corresponding to the token can be determined based on the encoding method of structural information and the mapping relationship between binary bytes and image pixels. The image processing module extracts visual features using computer vision technology; the image processing module can be a Convolutional Neural Network (CNN) or a Visual Transformer (ViT).
[0042] Next, for step 104, the importance of each token is scored using the textual and visual features of each token, and a score is obtained for each token.
[0043] In this embodiment of the invention, the importance scoring method may include: Calculate text feature scores for multiple tokens based on the text features of each token; Calculate visual feature scores for multiple tokens based on the visual features of each token. The importance scores of multiple tokens are calculated by weighting text feature scores and visual feature scores.
[0044] Specifically, the importance score can be calculated using the following formula: In other words, the importance score is calculated using the following formula: in, For the scoring results; , These are weighting coefficients; Scoring is applied to text features to represent the importance of each token in the text modality; A score is assigned to the visual features, representing the contribution of each visual feature extracted from the coded image to the token. Let be the embedding vector corresponding to the text features of the i-th token; For the first The visual characteristics of each token; n is the total number of tokens.
[0045] It should be noted that, It has n dimensions, and each dimension corresponds to a token. The embedding vector of each token is obtained from the embedding layer of the BERT model. It contains the semantic information of that token and is used in subsequent models to capture contextual relationships and meanings. The text feature score is calculated by summing the embedding vectors of all tokens. The summation operation is to combine the semantic information of each token to obtain the feature representation of the entire text modality.
[0046] Visual features contain spatial and structural information about the image-based binary file, which helps describe the layout and behavior of the binary file. The calculation method for visual feature scores is similar to that for text feature scores; a comprehensive visual feature score is generated by summing all visual feature vectors. This score reflects the influence of image-based features in the final decision.
[0047] This reflects the contribution of each token to the malware detection task. Through weighted summation, It can integrate information from both textual and visual features to provide a comprehensive score for each token. This score directly affects the model's focus on that token, thereby improving the model's accuracy in malware detection.
[0048] It should also be noted that the weighting coefficients w1 and w2 determine the relative influence of textual features and visual features on the final token score. In this embodiment of the invention, the weighting coefficients can be determined in at least the following ways: Method 1: Preset rules.
[0049] In some cases, w1 and w2 may be preset based on domain knowledge or prior research experience. For example, if text features are more important for malware identification, w1 may be set higher, and vice versa.
[0050] Method 2: Dynamic learning.
[0051] During model training, w1 and w2 are dynamically optimized. This method uses optimization algorithms such as gradient descent to gradually adjust the weight coefficients during training to maximize the model's performance on a specific task (such as the accuracy of malware detection).
[0052] Let's continue to use the three tokens mentioned above as examples to illustrate this importance score.
[0053] First, obtain the embedding vector for each token. Assume that the embedding vector (which can be a one-dimensional vector) generated for each token using the BERT model is as follows: The embedding vector for Token 1 ("execute") is: 0.1, 0.2, 0.3 Embedding vector for Token 2 ("malicious"): 0.4, 0.5, 0.6 Embedding vector of Token 3 ("code"): 0.7, 0.8, 0.9 Based on the embedding vectors of the three tokens mentioned above, the following text feature scores can be calculated: S text =(0.1+0.4+0.7,0.2+0.5+0.8,0.3+0.6+0.9)=(1.2,1.5,1.8) Then obtain the visual features of each token, for example: Visual characteristics of Token 1 ("execute"): 0.1, 0.5, 0.3 Visual characteristics of Token 2 ("malicious"): 0.4, 0.2, 0.6 Visual characteristics of Token 3 ("code"): 0.7, 0.1, 0.8 Based on the visual features of the three tokens mentioned above, the following visual feature scores can be calculated: S visual =(0.1+0.4+0.7,0.5+0.2+0.1,0.3+0.6+0.8)=(1.2,0.8,1.7) Assuming weight coefficients w1=0.7 and w2=0.3, the importance scores for multiple tokens are as follows: S token =0.7⋅(1.2,1.5,1.8)+0.3⋅(1.2,0.8,1.7) Element-by-element calculation: S token =(0.84+0.36,1.05+0.24,1.26+0.51)=(1.2,1.29,1.77) In other words, the importance scores for the three tokens are (1.2, 1.29, 1.77). That is, the importance score for Token1 is 1.2, the importance score for Token2 is 1.29, and the importance score for Token3 is 1.77. This importance score represents the importance or anomaly of each token under the comprehensive evaluation of textual and visual features.
[0054] Furthermore, in addition to using the textual and visual features of the token to score its importance, one embodiment of the present invention can further combine security context to score the importance of the token. The security context includes at least one or more of the following: threat intelligence summary, recent detection results, family characteristics related to malware, and historical information related to malware; wherein, the threat intelligence summary may include known features, attack organizations, industry trends, etc.; recent detection results may include alerts, correlation data, sandbox analysis, etc.; family characteristics may include behavior, code, structure, etc.; and historical information may include infection, handling, and propagation information, etc.
[0055] Specifically, it may include: Calculate the similarity between the features of each token and the security context; The weight score corresponding to the features of each token is determined based on similarity. The importance of multiple tokens is scored by using the weighted scores of the features of each token.
[0056] in, The weight score of the text features of the i-th token; denoted as the weight score of the j-th visual feature.
[0057] It should be noted that the greater the similarity, the higher the weight score corresponding to the token's features.
[0058] Finally, regarding step 106, "Calculate attention weights for the K highest-scoring tokens and perform feature weighted fusion on the K highest-scoring tokens based on the attention weights to obtain attention features," and step 108, "Reconstruct the attention features and pooling features to utilize the reconstructed features for task processing."
[0059] In this embodiment of the invention, the value of K can be a fixed threshold or dynamically selected, and the value of K is determined by the training data or preset rules.
[0060] The higher the score of a token, the more important it is, and these tokens contain key information. When calculating the attention of the K highest-scoring tokens, their scores can be used to determine attention weights, ensuring that the sum of the attention weights of the K tokens is 1. Then, by using these attention weights to perform feature weighted fusion on the K highest-scoring tokens, we obtain the attention features.
[0061] Since attention calculation is costly, this embodiment of the invention does not require attention calculation for the features of all tokens, but only for the features of the K most important tokens. For the remaining tokens other than the K highest-scoring tokens, since the features of these tokens contain less key information, they can be processed by a low-cost pooling operation. Then, the pooled features of the remaining tokens are fused to obtain pooled features.
[0062] In one implementation, the pooling operation includes any one of the following: average pooling, max pooling, and weighted pooling.
[0063] After obtaining the attention features and pooling features, the features can be reconstructed in the following ways: concatenation, weighted fusion, gating fusion, etc.
[0064] Once the reconstructed features are obtained, they can be used for subsequent tasks, such as malware detection, family identification, or behavioral analysis.
[0065] In this embodiment of the invention, the Top-K sparse selection mechanism can reduce the attention calculation of irrelevant tokens, significantly reducing computational and memory overhead, and is particularly suitable for real-time processing of long sequences or large-scale binary image data. Due to the reduction in computation and memory usage, the recognition speed can be improved, meeting the real-time requirements of malware detection tasks, especially when performing rapid detection on large-scale data, maintaining high recognition efficiency. In addition, the dynamic reconstruction mechanism can ensure the preservation of important information, reducing computational complexity while ensuring the accuracy of detection results.
[0066] Please refer to Figure 2 This invention provides a feature reconstruction device based on token scoring, the device comprising: The word segmentation unit 200 is used to perform word segmentation on the binary file to be analyzed using word segmentation tools to obtain multiple tokens; The acquisition unit 202 is used to acquire the text features and visual features of each token; the text features are obtained by mapping the token to a unique ID and then performing vector conversion; the visual features are extracted based on the encoded image converted from the binary file. Scoring unit 204 is used to score the importance of each token by using the textual and visual features of each token, and obtain the score of each token. The calculation unit 206 is used to calculate the attention weights for the K highest score tokens, and perform feature weighted fusion on the K highest score tokens based on the attention weights to obtain the attention features; The reconstruction unit 208 is used to reconstruct the features of attention features and pooling features, so as to use the reconstructed features for task processing; the pooling features are obtained by pooling and fusing the features of the remaining tokens.
[0067] In one embodiment of the present invention, the binary file is converted into an encoded image by: determining the encoding method of structural information and the mapping relationship between binary bytes and image pixels; and encoding the byte sequence in the binary file into the image according to the encoding method of structural information and the mapping relationship between binary bytes and image pixels.
[0068] In one embodiment of the present invention, the structural information includes segment information and / or high-entropy regions; The segment information is encoded in at least one of the following ways: each segment occupies a different region in the encoded image; different segments are distinguished by pixel intervals or line intervals; and different segment types are encoded using different colors. The encoding method for high-entropy regions is as follows: the pixel positions of the encoded image corresponding to the byte range of the high-entropy region in the binary file are set as specific feature markers.
[0069] In one embodiment of the present invention, the scoring unit is specifically used to: calculate the text feature score of multiple tokens based on the text features of each token; calculate the visual feature score of multiple tokens based on the visual features of each token; and calculate the importance score of multiple tokens by weighting the text feature score and the visual feature score.
[0070] In one embodiment of the present invention, the importance score of each token is performed by combining the textual and visual features of each token with the security context; the security context includes at least one or more of the following: threat intelligence summary, recent detection results, family characteristics related to malware, and historical information related to malware.
[0071] In one embodiment of the present invention, the step of scoring the importance of the corresponding Token includes: calculating the similarity between the features of each Token and the security context; determining the weight score corresponding to the features of each Token based on the similarity; and using the weight score of the features of each Token to score the importance of multiple Tokens.
[0072] It should be noted that the token-based feature reconstruction device provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the token-based feature reconstruction device and the token-based feature reconstruction method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.
[0073] Embodiments of this application also provide a computer device, please refer to... Figure 3 The computer device includes a processor and a memory, the memory storing at least one instruction, at least one program, code set, or instruction set, wherein at least one instruction, at least one program, code set, or instruction set is loaded and executed by the processor to implement the feature reconstruction method based on token scoring provided in the above-described method embodiments.
[0074] Embodiments of this application also provide a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the feature reconstruction method based on token scoring provided in the above-described method embodiments.
[0075] Embodiments of this application also provide a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium and executes the computer program, causing the computer device to perform any of the token-based feature reconstruction methods described in the above embodiments.
[0076] For ease of description, the above systems or devices are described separately as various modules or units based on their functions. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware components.
[0077] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.
[0078] Finally, it should be noted that in this document, relational terms such as first, second, third, and fourth are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0079] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.
Claims
1. A feature reconstruction method based on token scoring, characterized in that, The method includes: The binary file to be analyzed is segmented using a word segmentation tool to obtain multiple tokens; The text features and visual features of each token are obtained; the text features are obtained by mapping the token to a unique ID and then performing vector transformation; the visual features are extracted based on the encoded image converted from the binary file. The importance of each token is scored using the textual and visual features of each token, resulting in a score for each token. Calculate attention weights for the K highest-scoring tokens, and then perform feature weighted fusion on the K highest-scoring tokens based on the attention weights to obtain attention features; Attention features and pooling features are reconstructed to utilize the reconstructed features for task processing; the pooling features are obtained by pooling and fusing the features of the remaining tokens.
2. The method according to claim 1, characterized in that, The method by which the binary file is converted into an encoded image: Determine the encoding method of structural information and the mapping relationship between binary bytes and image pixels; The byte sequence in the binary file is encoded into the image according to the encoding method of structural information and the mapping relationship between binary bytes and image pixels.
3. The method according to claim 2, characterized in that, The structural information includes segment information and / or high-entropy regions; The segment information is encoded in at least one of the following ways: Each segment occupies a different region in the coded image; Different segments are distinguished using pixel or line spacing; and, Different segment types are coded using different colors; The encoding method for high-entropy regions is as follows: Set the pixel positions of the encoded image corresponding to the byte range of the high-entropy region in the binary file as specific feature markers.
4. The method according to claim 1, characterized in that, The method of scoring the importance of each token using its textual and visual features includes: Calculate text feature scores for multiple tokens based on the text features of each token; Calculate visual feature scores for multiple tokens based on the visual features of each token. The importance scores of multiple tokens are calculated by weighting text feature scores and visual feature scores.
5. The method according to claim 4, characterized in that, The importance score for each token is determined by combining the textual and visual features of each token with the security context. The security context includes at least one or more of the following: threat intelligence summary, recent detection results, family characteristics associated with malware, and historical information associated with malware.
6. The method according to claim 5, characterized in that, The importance scoring of the corresponding tokens includes: Calculate the similarity between the features of each token and the security context; The weight score corresponding to the features of each token is determined based on similarity. The importance of multiple tokens is scored by using the weighted scores of the features of each token.
7. A feature reconstruction device based on token scoring, characterized in that, The device includes: The word segmentation unit is used to segment the binary file to be analyzed using word segmentation tools to obtain multiple tokens; The acquisition unit is used to acquire the text features and visual features of each token; the text features are obtained by vector conversion after mapping the token to a unique ID; the visual features are extracted based on the encoded image converted from the binary file. The scoring unit is used to score the importance of each token by utilizing the textual and visual features of each token, and obtain a score for each token. The computation unit is used to calculate the attention weights for the K highest-scoring tokens, and to perform feature weighted fusion on the K highest-scoring tokens based on the attention weights to obtain the attention features; The reconstruction unit is used to reconstruct the features of attention features and pooling features, so as to use the reconstructed features for task processing; the pooling features are obtained by pooling and fusing the features of the remaining tokens.
8. A computer device, characterized in that, The computer device includes a memory and a processor. The memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the steps of the method according to any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in any one of claims 1-6.
10. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1-6.