Malicious code variant feature mining method and system based on variational auto-encoder

Abstract

The invention discloses a variational auto-encoder-based malicious code variant feature mining method, which comprises the following steps of: learning a deep structure normal form of a normal code by using a variational auto-encoder, constructing a potential space of the normal code through unsupervised learning, and identifying any unknown variant deviating from the space due to difficult reconstruction; by calculating the reconstruction error, the abnormity can be accurately positioned to the byte offset of the original file, the basis for judging the abnormity by the model can be revealed in combination with the attention weight, and the interpretability is provided. The invention further provides a malicious code variant feature mining system based on the variational auto-encoder. The system comprises a feature extraction layer, a variational auto-encoder layer, an adversarial training layer, an anomaly detection layer, a variant mining layer, a rule generation layer and an engine integration layer.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for mining malicious code variant features based on variational autoencoders. Background Technology

[0002] Currently, malicious code primarily uses obfuscation, packing, and other transformation techniques to rapidly generate numerous variants in order to evade detection. These variants exhibit significant differences in surface characteristics, but their deep semantics and core behaviors are highly similar.

[0003] Traditional signature- or rule-based methods are highly sensitive to code variations and struggle to identify variants that have been obfuscated or packed, resulting in high false negative rates. Furthermore, most methods rely on single-type features such as byte sequences and API calls, failing to comprehensively characterize the multidimensional attributes of malicious code and exhibiting poor feature robustness. Most methods rely on supervised learning based on known samples, exhibiting weak generalization ability to unknown or zero-day malicious variants and lacking effective anomaly detection mechanisms. While existing deep learning models can improve detection rates, they cannot explain the judgment criteria, making it difficult for security analysts to trust and utilize the detection results for subsequent actions. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a method and system for mining malicious code variant features based on variational autoencoders.

[0005] To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended as a general commentary, nor is it intended to identify key / important components or to describe the scope of protection of these embodiments. Its sole purpose is to present some concepts in a simple form as a prelude to the detailed description that follows.

[0006] The present invention adopts the following technical solution:

[0007] Firstly, a method for malicious code variant feature mining based on variational autoencoders is provided, including:

[0008] Extract multimodal features from malicious code and establish mapping relationships;

[0009] Unsupervised pre-training of multimodal features of malicious code is performed using a variational autoencoder to learn the latent representation of the malicious code;

[0010] The decoder of the variational autoencoder is used as a generator network and is adversarially trained with a discriminator network used to distinguish between real and generated samples in order to balance reconstruction loss and adversarial loss.

[0011] Based on reconstruction error calculation, potential spatial distribution analysis and attention weight mapping, the abnormal regions of malicious code are detected, and the anomalies are located back to specific byte positions in the original binary file by setting statistical thresholds and mapping relationships.

[0012] Detection rules based on statistical features and fuzzy matching are generated, and the detection rules generated based on variational autoencoders are integrated with fuzzy hash signatures into an existing malware detection engine.

[0013] Furthermore, the multimodal features extracted from the malicious code include: binary image features, PE structure features, instruction sequence features, and entropy distribution features; the established mapping relationships include: mapping of binary image features to bytes, mapping of PE structure features to positions, mapping of instruction sequence features to code, and mapping of entropy distribution features to regions.

[0014] Furthermore, the process of using a variational autoencoder to perform unsupervised pre-training on the multimodal features of malicious code to learn the latent representation of the malicious code includes:

[0015] Encoder step: Fuse the extracted multimodal features and map them to the latent space, predicting the mean and variance parameters of the Gaussian distribution that the latent space follows; Sampling step: Sample according to the Gaussian distribution defined by the mean and variance parameters to obtain the latent representation of the malicious code; Decoder step: Take the latent representation of the malicious code as input, reconstruct the multimodal features, and obtain the reconstructed multimodal output;

[0016] Optimization steps: Based on the reconstruction loss between the multimodal output and the original multimodal features, and the KL divergence between the Gaussian distribution and the standard normal distribution, a total loss function is constructed, and the encoder and decoder are jointly optimized based on the total loss function.

[0017] Furthermore, the adversarial training process includes: the generator network using the decoder of the variational autoencoder to generate forged multimodal feature samples based on the latent representation extracted from real malicious code samples; inputting the forged multimodal feature samples and the real malicious code multimodal feature samples into the discriminator network for authenticity discrimination; calculating the adversarial loss based on the discrimination result, and constructing a total loss function by combining it with the reconstruction loss of the variational autoencoder, so as to jointly optimize the generator network and the discriminator network.

[0018] Furthermore, the process of detecting malicious code anomaly regions based on reconstruction error calculation, potential spatial distribution analysis, and attention weight mapping, and locating the anomaly back to a specific byte position in the original binary file by setting statistical thresholds and mapping relationships, includes:

[0019] Calculate the pixel-level error between the original multimodal features and the reconstructed features, generate an error heatmap, and use the mapping relationship between the binary image features and bytes to reverse map the coordinates of high-error pixels in the error heatmap back to the byte offsets of the original binary file to mark the positions of abnormal bytes.

[0020] The image attention weight map is extracted from the trained variational autoencoder encoder network to generate an attention heatmap. Using the mapping relationship between binary image features and bytes, the coordinates of high-weight pixels in the attention heatmap are mapped back to the byte offsets of the original binary file, and an importance score is assigned to each byte.

[0021] A statistical distribution model is established in the latent space based on normal samples. The latent representation of the test sample is compared with the statistical distribution model. Outliers that deviate from the normal distribution are detected as abnormal samples. The input features that cause the outliers are tracked through gradient backpropagation technology, and the contribution of different modal features to the anomaly detection is analyzed.

[0022] Set and adjust the statistical thresholds used for anomaly detection based on file type, file size, and file internal area.

[0023] Furthermore, the aforementioned method for mining malicious code variant features based on variational autoencoders also includes: mining malicious code variant features, family relationships, and evolutionary paths based on latent space clustering and pattern recognition.

[0024] Furthermore, the process of generating detection rules based on statistical features and fuzzy matching includes:

[0025] Based on the feature distribution of known malicious code sample sets, statistical analysis methods are used to determine one or more statistical feature thresholds according to the feature distribution, and the statistical feature thresholds are tested on independent validation sets.

[0026] The fuzzy hash value of the malicious code sample is calculated, and the calculated fuzzy hash value is stored as a signature in the hash signature library. Fuzzy matching is performed by comparing the fuzzy hash value of the sample to be tested with the signature in the hash signature library.

[0027] We define a similarity measurement method in a multidimensional feature space to comprehensively evaluate the similarity between the sample under test and known malicious code.

[0028] Furthermore, the process of establishing the mapping from binary image features to bytes includes: converting the binary file into a 256×256 grayscale image by byte value, with each pixel corresponding to one byte; establishing the mapping relationship from pixel coordinates (x, y) to file offset: offset = y×256 + x; mapping byte values ​​0-255 to pixel grayscale values; and marking the PE file segments corresponding to different regions in the image.

[0029] The process of establishing a mapping from PE structural features to locations includes: extracting PE file header information and recording the offset position of the PE file header information in the file; parsing the section table and establishing a mapping from section names to file offset ranges; locating the position and size of the import table in the file; and extracting resource information and its position in the file.

[0030] The process of establishing a mapping from instruction sequence features to code includes: establishing a mapping from instructions to file offsets through disassembly; extracting the opcode sequence and preserving the file position of each instruction; and tracing register usage patterns and their corresponding instruction positions.

[0031] The process of establishing a mapping from instruction sequence features to code includes: calculating the entropy values ​​of different regions of the file and dividing it into blocks of 1KB; establishing a mapping relationship between entropy values ​​and file regions; detecting encrypted and compressed regions and marking their positions in the file; and analyzing the randomness of byte distribution to identify suspicious regions.

[0032] Secondly, a malware variant signature mining system based on a variational autoencoder is also provided, including:

[0033] The feature extraction layer is used to extract multimodal features from malicious code and establish mapping relationships;

[0034] The variational autoencoder layer is used to perform unsupervised pre-training on the multimodal features of malicious code using a variational autoencoder to learn the latent representation of the malicious code.

[0035] Adversarial training layers are used to train the decoder of the variational autoencoder as a generator network against a discriminator network used to distinguish between real and generated samples, in order to balance reconstruction loss and adversarial loss.

[0036] The anomaly detection layer is used to detect malicious code anomaly regions based on reconstruction error calculation, potential spatial distribution analysis and attention weight mapping, and locate the anomaly back to a specific byte position in the original binary file by setting statistical thresholds and mapping relationships.

[0037] The rule generation layer is used to generate detection rules based on statistical features and fuzzy matching.

[0038] An engine integration layer is used to integrate the detection rules generated based on the variational autoencoder with fuzzy hash signatures into an existing malware detection engine;

[0039] The variant mining layer is used to mine malware variant features, family relationships, and evolutionary paths based on latent spatial clustering and pattern recognition.

[0040] The beneficial effects of this invention are as follows: It utilizes a variational autoencoder to learn the deep structural paradigm of normal code to cope with obfuscation, packing, and other variant techniques. It does not rely on surface signatures but constructs a potential space of normal code through unsupervised learning. Any unknown variants that deviate from this space will be identified due to the difficulty of reconstruction, effectively solving the problem of weak generalization ability. By calculating the reconstruction error, the model can accurately locate anomalies to the byte offset of the original file. Combined with attention weights, it can reveal the basis for the model's anomaly judgment, providing analysts with a reliable and actionable location report, and realizing a closed loop from detection to handling. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a flowchart illustrating a method for mining malicious code variant features based on a variational autoencoder according to the present invention. Detailed Implementation

[0043] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0044] like Figure 1 As shown in some illustrative embodiments, a method for mining malware variant features based on variational autoencoders is provided, including the following steps:

[0045] 101: Extract multimodal features from malicious code and establish mapping relationships.

[0046] Multimodal features include: binary image features, PE structure features, instruction sequence features, and entropy distribution features.

[0047] The established mapping relationships include: mapping of binary image features to bytes, mapping of PE structure features to positions, mapping of instruction sequence features to code, and mapping of entropy distribution features to regions.

[0048] The process of establishing the mapping from binary image features to bytes includes the following steps:

[0049] First, the binary file is converted into a 256×256 grayscale image, with each pixel corresponding to one byte. Specifically, the entire malicious code file is read in binary mode, resulting in a byte array. The one-dimensional byte stream of this array is then filled into a two-dimensional image matrix in row-major order. This two-dimensional image matrix has a fixed image size, such as 256×256, totaling 65536 pixels. If the file size exceeds 65536 bytes, it is truncated; otherwise, it is padded with zeros or specific padding values, allowing files of different sizes to be compared in the same dimension.

[0050] Then, establish the mapping relationship between pixel coordinates (x, y) and file offset: offset = y × 256 + x. Here, for any pixel in the image, its coordinates (x, y), where x is the column index and y is the row index, correspond to the byte offset in the original file, ensuring that its position in the original binary file can be located from any point on the image.

[0051] Then, the byte values ​​0-255 are mapped to pixel grayscale values. Grayscale value = byte value, so that the brightness of the image reflects the numerical distribution of bytes in the file. For example, byte 0x00 will be displayed as a black area, while byte 0xFF will be displayed as a white area.

[0052] Finally, the PE file segments corresponding to different regions in the image are marked. By parsing the PE file header, the offset range of each segment (such as .text, .data, .rsrc) in the file can be obtained. Using the inverse operation of offset = y×256 + x, the file offset range is converted into a rectangular region on the image. For example, the .text segment may correspond to a rectangle from (x1, y1) to (x2, y2) on the image. In this way, when analyzing the image texture, it can be determined whether a specific texture pattern (such as dense texture) corresponds to a code segment or a data segment.

[0053] Different families of malware exhibit unique texture patterns in images, such as uniform textures after packing or repetitive patterns of specific code segments. Therefore, by transforming abstract binary data into intuitive images, security analysts can understand the overall structure of malware. Furthermore, these texture and structural features can be automatically extracted using image processing models, eliminating the need for manual design. In addition, when the model identifies a key region in the image, the mapping from coordinates to offsets allows tracing back to the corresponding bytes in the original file, enabling analysis of the actual content of that region and thus improving interpretability.

[0054] The process of establishing the mapping from PE structural features to locations includes the following steps:

[0055] First, extract the PE file header information and record its offset within the file. The PE file format is the standard for Windows executable files, and its header information contains key metadata such as program loading, execution, and dependencies. The extracted PE file header information includes: entry point address, image base address, file alignment value, section alignment value, operating system version, and subsystem type. This information indicates the runtime environment and loading method of malicious code. After extracting the PE file header information, record the start and end offsets of the DOS header, PE signature, file header, and optional headers within the file. For example, the PE signature is typically located at offset 0x3C.

[0056] Next, the section table is parsed to establish a mapping from section names to file offset ranges. Specifically, the section table is parsed to extract the name of each section (e.g., .text, .data, .rsrc), virtual size, original data size, offset in the file, virtual address in memory, and section characteristic flags. A mapping relationship is established for each section, such as (".text", [0x400, 0x8000]), indicating that the .text section starts at 0x400 and ends at 0x8000 in the file.

[0057] Simultaneously, the location and size of the import table in the file are determined. Specifically, the import table is parsed to extract the external dynamic link libraries that the malicious code depends on and their function names; the precise offset and size of the import table data structure in the file are recorded. Therefore, when analyzing a suspicious API call, the location in the file where the API name string is stored can be located.

[0058] Simultaneously, resource information and its location within the file are extracted. Resource sections are parsed to extract the resource types they contain, such as icons, bitmaps, version information, and even other executable files or configuration data that may be hidden by malicious code. Then, a mapping is established between the resource hierarchy and the offsets and sizes of specific data blocks in the file.

[0059] PE (Preinstallation Object) structural features can provide higher-level semantic information than raw bytes. For example, a sequence of API calls can directly reflect the intent of malicious code, but this is difficult to obtain directly from bytes or images. Moreover, many malicious codes hide their true code through packing or obfuscation, but PE header information is an important clue for detecting packing and is not easily changed by simple code modifications. Furthermore, when a sample is determined to be suspicious based on PE structural features, the mapping relationship can be used to directly jump to the location of the import table and related code segments in the file, thereby improving interpretability.

[0060] The process of establishing the mapping from instruction sequence features to code includes the following steps:

[0061] First, a mapping from instructions to file offsets is established through disassembly. Specifically, the disassembler engine translates the machine code into assembly instructions, starting from the entry point or the beginning of the code segment in the PE file. When parsing each instruction, the disassembler engine provides the instruction's starting address and length. Therefore, a list or dictionary can be created to record mapping relationships such as {"instruction": "mov eax, [ebp+8]", "file offset": 0x4015A, "length": 6}.

[0062] Simultaneously, the opcode sequence is extracted, and the file position of each instruction is preserved. Specifically, the opcode portion of the instruction is extracted, ignoring the operands. For example, the N-gram opcode sequence can be extracted as a feature. When a meaningful N-gram opcode sequence is extracted, all positions in the file where this pattern appears can be recorded through the instruction-to-offset mapping described above.

[0063] Simultaneously, it tracks register usage patterns and their corresponding instruction locations. Specifically, it analyzes register usage within instruction sequences, such as which registers are frequently used for function parameter passing, which are used as loop counters, or whether there are any special or atypical register usage patterns. When a specific register usage pattern is identified, the file locations of all instructions involved in that pattern can be recorded; for example, eax might be used consecutively in three different memory addressing operations.

[0064] Instruction sequences directly reflect a program's execution logic. Malicious code variants often evade detection by inserting junk instructions, rearranging code blocks, and renaming registers. By extracting opcode sequences and register usage patterns, rather than relying on specific addresses or register names, more robust features to these changes can be generated. Furthermore, through mapping relationships, security analysts can directly locate the specific code segment in the sample that implements the malicious function, thereby improving interpretability.

[0065] The process of establishing the mapping from instruction sequence features to code includes the following steps:

[0066] First, the entropy values ​​of different regions of the file are calculated, and the file is divided into blocks of 1KB. Specifically, the entire binary file is divided into fixed-size blocks, and the entropy of the bytes in each block is calculated.

[0067] Next, a mapping relationship between entropy values ​​and file regions is established. Specifically, the entropy values ​​of all blocks are arranged in order to form an entropy distribution curve or histogram, with each calculated entropy value corresponding to a file region.

[0068] Simultaneously, the system detects encrypted and compressed regions, marks their locations within the file, analyzes the randomness of byte distribution, and identifies suspicious regions. Specifically, it analyzes entropy distribution to identify contiguous blocks with entropy values ​​significantly higher than the average level and marks them as encrypted / compressed regions. It can also analyze regions with extremely low entropy values, which may contain a large amount of zero-padding or duplicate data. When a suspicious region with a high entropy value is detected, its starting offset and size within the file are recorded. Through mapping, it can be determined which parts of the file exhibit high randomness, guiding analysts to focus on these regions.

[0069] Packing and encryption are the most common obfuscation techniques used by malicious code. Entropy distribution provides important context for other characteristics. For example, if instruction sequence analysis finds a strange loop that happens to be located in a high-entropy region, it is almost certainly a decryption loop. Moreover, once a suspicious packed / encrypted area is located through entropy analysis, reverse engineers can attempt to unpack or decrypt that area instead of blindly analyzing the entire file, greatly improving the efficiency of reverse engineering.

[0070] 102: Variational Autoencoder pre-training, which utilizes a variational autoencoder to perform unsupervised pre-training on the multimodal features of malicious code to learn the latent representation of the malicious code. Specifically, it includes: encoder steps, sampling steps, decoder steps, and optimization steps.

[0071] Encoder steps: Fuse the extracted multimodal features and map them to the latent space, predicting the mean and variance parameters of the Gaussian distribution that the latent space follows.

[0072] The encoder's task is to predict the parameters of the probability distribution that the latent vectors follow, and its output consists of two vectors: a mean vector and a mean vector. , representing the central location of the latent representation; variance vector or log-variance vector This represents the uncertainty or distribution range of the latent representation. Assume a latent representation... Obeys an encoder output and Given a Gaussian distribution with parameters, a point is randomly sampled from the Gaussian distribution. This point is the potential representation of the malicious code sample, which is a compressed, low-dimensional vector that is considered to contain the core semantic information of the input multimodal features.

[0073] First, the encoder network needs to receive multimodal features as input, which is achieved by designing multiple branches. For example, one branch of the encoder network receives binary image features obtained after converting the malicious code file into a two-dimensional matrix. This can be processed using a two-dimensional convolutional neural network to capture local texture, pattern, and structural information in the image. This information corresponds to the arrangement and combination patterns of specific byte blocks in the malicious code. For instance, packed or obfuscated code will exhibit high-entropy regions with textures that are significantly different from normal code in the binary image. Another branch of the encoder network receives structured features parsed from the PE file header. This can be processed using a fully connected network. For instance, a suspicious section name combined with an abnormal entry point address represents a strong indicator of malicious activity. Yet another branch of the encoder network receives the opcode sequence obtained after disassembly. This can be processed using a recurrent neural network to capture the temporal dependencies in the sequence, thereby understanding the code's execution logic. For instance, a combination of push, call, and pop may represent a function call. The last branch of the encoder network receives the entropy sequence calculated after dividing the file into fixed-size blocks. This can be processed using a one-dimensional CNN or RNN.

[0074] After receiving multimodal features, the encoder network outputs its own high-dimensional features from each branch, mapping them to a unified intermediate feature space. Then, a feature fusion layer (such as concatenation, attention-based weighting, or gating) integrates these intermediate features, thus achieving multimodal feature fusion. For example, the attention mechanism can dynamically learn which modality's features are more important in different situations; for a packed virus, the weights of entropy and binary image features might be automatically increased.

[0075] Then, the fused integrated feature vector is input into two independent fully connected layers, which output the mean parameters of the Gaussian distribution that the latent space follows. And log-variance parameter These two parameters together define a probability distribution of the malware sample in the latent space, where logarithmic variance is used to ensure the numerical stability of the variance.

[0076] Sampling steps: Sampling is performed according to a Gaussian distribution defined by the mean and variance parameters to obtain a potential representation of malicious code. Specifically, a random noise vector is first sampled from a standard normal distribution. Then through the formula Calculate the final latent representation. This represents element-wise multiplication. Latent representation. The sampling process is decomposed into a deterministic part. and a random part This allows the gradient to flow smoothly through the mean and variance parameters, thus enabling end-to-end training. This refers to the coordinates of the malicious code sample in a continuous, structured potential space.

[0077] Decoder steps: Taking the latent representation of the malicious code as input, reconstructing multimodal features, and obtaining the reconstructed multimodal output. The task of the decoder network is to extract features from the latent representation. The original four multimodal features were recovered to verify... Does it contain enough information?

[0078] The latent representation obtained from sampling As input to the decoder network, multiple branches can be designed for the decoder network, each responsible for reconstructing features of an original modality. For example, the binary image reconstruction branch can use a transposed 2D convolutional network to... Progressive upsampling is used to generate a reconstructed image with the same size as the original binary image; the PE structural feature reconstruction branch uses a fully connected network to... Mapping back to the original PE structure feature vector; the instruction sequence reconstruction branch uses an RNN decoder to... As the initial state, an opcode sequence is gradually generated; the entropy distribution reconstruction branch uses a one-dimensional transposed CNN or RNN to... The original entropy sequence is reconstructed. The outputs of each branch of the decoder network together constitute the reconstructed multimodal output. For example, for the same malware sample, the decoder network simultaneously outputs a reconstructed binary image, a reconstructed PE feature vector, a reconstructed instruction sequence, and a reconstructed entropy sequence.

[0079] Optimization steps: Based on the reconstruction loss between the multimodal output and the original multimodal features, and the KL divergence between the Gaussian distribution and the standard normal distribution, a total loss function is constructed, and the encoder and decoder are jointly optimized based on the total loss function. The purpose of the optimization step is to improve the efficiency of feature learning by simultaneously optimizing all parameters of the encoder and decoder by minimizing a total loss function.

[0080] Specifically, the reconstruction loss is calculated first. The four multimodal outputs reconstructed by the decoder network are compared item by item with the original four multimodal features extracted in step 101, and the reconstruction loss is calculated. For example, for continuous values ​​such as binary images and entropy distributions, mean squared error or mean absolute error can be used; for the numerical part of PE structural features, MSE or MAE can be used; for discrete sequences such as instruction sequences, cross-entropy loss is usually used. The reconstruction losses of the four modalities are weighted and summed to obtain the total reconstruction loss, which measures the ability of the latent representation to retain the integrity of the original information.

[0081] Then, the KL divergence is calculated, which is the KL divergence between the Gaussian distribution predicted by the encoder and the standard normal distribution. The KL divergence is a regularization term that forces the encoder to constrain the latent distribution of all samples to be close to the standard normal distribution. This can prevent the model from overfitting and make the latent space continuous, smooth and structured, which is convenient for subsequent generation, interpolation and clustering analysis.

[0082] Finally, the total loss function is constructed and optimized. In this application, the final total loss function is a weighted sum of the reconstruction loss and the KL divergence, and all parameters of the encoder and decoder are jointly iteratively optimized using the backpropagation algorithm and the gradient descent optimizer until the model converges.

[0083] Traditional methods typically use different features independently, making it difficult to capture the inherent connections between them. This invention, through a multimodal variational autoencoder, fuses the binary image (visual form of malicious code), the PE structure (identity information), the instruction sequence (behavioral logic), and the entropy distribution (encryption state) within a unified framework. This allows the model to learn latent representations that are no longer single features, but high-order semantic features that reflect the complex relationships between attributes, thereby achieving multimodal semantic fusion and improving feature representation capabilities. For example, the model can automatically learn the combination pattern of "high-entropy region + non-standard section name + numerous XOR instructions," which is closely related to the high-level concept of "packed malware," something that no single feature can independently express.

[0084] Meanwhile, this application uses reconstruction loss to make the model ignore unimportant and volatile surface details and focus on learning the intrinsic structure that is important for reconstructing the original multimodal patterns. KL divergence regularization makes the latent space have a good topological structure, thus constructing a structured and interpretable latent space. Without labeling data, new malicious code families can be automatically discovered by directly clustering the latent representations, and family affiliation judgment can be made for unknown samples.

[0085] 103: Adversarial training, which involves using the decoder of the variational autoencoder as a generator network and adversarially training it against the discriminator network used to distinguish between real and generated samples, in order to balance reconstruction loss and adversarial loss.

[0086] The purpose of adversarial training is to introduce an adversarial mechanism, in which the generator and discriminator networks compete with each other and evolve together, so that the variational autoencoder learns malicious code features that are more difficult to forge and bypass, thereby improving the robustness and generalization ability of the model.

[0087] First, the generator network uses the decoder of a variational autoencoder to generate forged multimodal feature samples based on latent representations extracted from real malicious code samples.

[0088] The generator network's input is the latent representation extracted from the multimodal features of the real malicious code sample by the encoder in step 102. Based on the semantic encoding of the input, the generator network reconstructs a multimodal feature sample. Since the latent space of the variational autoencoder is continuous and regularized, the sample generated by the generator network is not a copy of the original sample, but rather a reasonable variant or interpolated sample based on its semantics. For example, for a specific malicious family, the generator network might generate a forged sample that differs slightly in its PE structure or is slightly obfuscated in its instruction sequence, but retains the core malicious logic.

[0089] In this application, the generator network directly reuses the decoder of the variational autoencoder that has already been trained in step 102, eliminating the need for reconstruction and thus improving efficiency. Furthermore, it ensures that the generator network can generate samples based on learned malware knowledge. Since the forged samples generated by the generator network represent the model's understanding of possible variants within malware families and are a reasonable extension based on real data distribution, they are high-quality samples for training the discriminator network and, in turn, improving the encoder. Then, the forged multimodal feature samples and the real malware multimodal feature samples are input together into the discriminator network for authentication.

[0090] The discriminator network receives two types of features: first, the raw, unprocessed multimodal features of the malicious code extracted in step 101; and second, multimodal feature samples generated by the generator network. The discriminator network's goal is a binary classification task, that is, to distinguish as accurately as possible between real and fake data. Specifically, this can be represented by outputting a probability value indicating the likelihood that an input sample is real.

[0091] Finally, the adversarial loss is calculated based on the discrimination results, and the total loss function is constructed by combining the reconstruction loss of the variational autoencoder to jointly optimize the generator network and the discriminator network.

[0092] The adversarial loss calculated based on the discrimination results consists of two parts:

[0093] For discriminator networks: real samples are classified as true (e.g., with a probability close to 1), and fake samples are classified as false (e.g., with a probability close to 0). Therefore, their loss function will penalize incorrect classifications.

[0094] For generator networks: the goal is to deceive the discriminator network into classifying its own generated fake samples as real. Therefore, its loss function will penalize the discriminator for successfully identifying fake samples.

[0095] The reconstruction loss from step 102 is combined with the adversarial loss calculated based on the discrimination result to construct a total loss function, for example, total loss = a reconstruction loss + b adversarial loss, where a and b are hyperparameters used to balance the importance of the two.

[0096] The joint optimization process consists of two parts:

[0097] Fixed generator network, trained discriminator network: Using fake and real samples generated by the current generator network, the network parameters of the discriminator network are updated to improve its discrimination ability;

[0098] Fix the discriminator network and train the generator network: use the current feedback of the discriminator network to update the network parameters of the generator network, so that the generated fake samples are more realistic and can better deceive the discriminator network. At the same time, since the total loss still includes the reconstruction loss, the generator network is also constrained not to deviate too far from the semantics of the original input while pursuing realism, thus ensuring the rationality of the reconstruction.

[0099] Traditional models exhibit performance degradation when faced with adversarial samples that have undergone minor perturbations, such as code obfuscation or packing. This invention addresses this by having the model continuously engage in a game with a generator network capable of producing high-quality variants during training. This results in a final feature representation that is more immune to various deformation and obfuscation techniques, thereby enhancing the model's robustness and resistance to adversarial attacks. Furthermore, adversarial training leads to a more compact distribution of samples in the latent space and clearer boundaries between different families, thus enhancing feature discriminative power and improving detection accuracy.

[0100] 104: Anomaly Detection and Attention Mapping. This involves detecting malicious code anomalies based on reconstruction error calculation, latent spatial distribution analysis, and attention weight mapping. By setting statistical thresholds and mapping relationships, the anomalies are located back to specific byte positions in the original binary file. Specifically, it includes the following steps:

[0101] Anomaly region localization based on reconstruction error: Calculate the pixel-level error between the original multimodal features and the reconstructed features, generate an error heatmap, and use the mapping relationship between binary image features and bytes to reverse map the coordinates of high-error pixels in the error heatmap back to the byte offsets of the original binary file to mark the location of abnormal bytes.

[0102] After completing the variational autoencoder pre-training and adversarial training enhancements, a model capable of anomaly detection is built. This model can compress malicious code into a semantically informative latent representation and reconstruct its input. After training, the model learns the structure and patterns of normal code. When encountering variants of malicious code, due to their structural or content deviations from normal patterns, the model will struggle to reconstruct them perfectly, resulting in reconstruction errors.

[0103] The input binary file is converted into multimodal features, such as binary images or opcode sequences. The original multimodal features are then compared pixel-by-pixel with the features reconstructed by the variational autoencoder, and the difference is calculated to generate an error heatmap. Brighter areas in the heatmap represent more severe reconstruction failures and a higher probability of anomalies. Using a pre-established mapping between binary image features and bytes, the coordinates of the highlighted pixels in the error heatmap are reverse-analyzed to pinpoint the specific byte locations in the original binary file, thus identifying anomalous bytes. The visualization of the error heatmap makes anomalies more intuitive; through reverse mapping, abstract image anomalies can be directly mapped to specific code bytes, improving interpretability.

[0104] Key region identification based on attention weights: Extract image attention weight maps from the trained variational autoencoder network, generate attention heatmaps, and use the mapping relationship between binary image features and bytes to backmap the coordinates of high-weight pixels in the attention heatmap back to the byte offsets of the original binary file, and assign importance scores to each byte.

[0105] From the variational autoencoder network, the attention weight map generated during input image processing is extracted and visualized as an attention heatmap. The highlighted areas represent the regions the model focuses on analyzing. Similarly, utilizing a pre-established mapping between binary image features and bytes, the coordinates of high-weight pixels are inversely mapped to byte offsets in the original file, assigning an importance score to each byte. This inverse mapping directly maps abstract image anomalies to specific code bytes, improving interpretability and enhancing the reliability of the detection results.

[0106] Anomaly detection based on latent spatial distribution: A statistical distribution model is established in the latent space based on normal samples. The latent representation of the sample to be tested is compared with the statistical distribution model. Outliers that deviate from the normal distribution are detected as anomalies. Gradient backpropagation technology is used to track the input features that lead to the outliers and to analyze the contribution of different modal features to anomaly detection.

[0107] Variational autoencoders compress input samples into a low-dimensional latent representation. The latent representations of all normal samples cluster together, forming a dense normal cluster, while anomalous samples deviate from this cluster. In this application, a statistical distribution model of normal samples is constructed using a large number of latent representations of normal samples through statistical methods, such as a Gaussian Mixture Model (GMM). The latent representation of the test sample is compared with this model, and its deviation is calculated, such as by Mahalanobis distance. If the deviation exceeds a preset threshold, it is identified as an outlier, i.e., an anomalous sample. For samples identified as anomalous, gradient backpropagation is used to track which input features contribute most to the deviation of the latent representation from the normal distribution, allowing for further analysis of the relative importance of different modal features in anomaly detection.

[0108] Dynamic threshold setting and adaptive adjustment: This application sets and adjusts statistical thresholds for anomaly detection based on file type, file size, and internal file regions. A single, fixed threshold is insufficient to handle diverse file types and sizes. This application dynamically sets and adjusts the thresholds for anomaly detection based on the file type (e.g., PE, ELF), file size, and internal file regions (e.g., header, code segment, data segment). For example, for resource-rich PE files, the normal fluctuation range of the data segment may be larger than that of the pure code segment; therefore, different threshold standards should be used. This avoids misclassifying reasonable but high-absolute-value errors in large, normal files as anomalies, enabling the model to adapt to different scenarios and file types, thus improving detection accuracy.

[0109] Step 104 combines reconstruction error, attention weights, and latent spatial distribution, and calibrates using dynamic thresholds. By combining local anomalies represented by reconstruction error with global anomalies represented by latent spatial distribution, it can detect both subtle code tampering and overall structural anomalies, effectively combating code obfuscation and variant techniques. Moreover, it can directly map anomalies to specific code bytes, improving interpretability and enhancing the reliability of the detection results.

[0110] 105: Variant Feature Mining, which involves mining malware variant features, family relationships, and evolutionary paths based on latent space clustering and pattern recognition. Specifically, it includes the following steps:

[0111] Using the encoder of the trained variational autoencoder, multiple malicious code samples are encoded into corresponding low-dimensional latent vectors.

[0112] In the space formed by low-dimensional potential vectors, cluster analysis is performed on all potential vectors to form one or more sample clusters, where each sample cluster contains one or more malicious code samples;

[0113] For at least one sample cluster, analyze the distribution characteristics and statistical properties of the potential vectors within the cluster to identify variant patterns of the malware family corresponding to the sample cluster;

[0114] Based on the relative positions and distances of different sample clusters in the potential space, the associations and evolution paths among the malware families represented by different sample clusters are analyzed.

[0115] Step 105 transforms the difficult-to-analyze high-dimensional bytecode data into low-dimensional vectors with clear semantics, thereby reducing the complexity of analysis. Malicious code families can be automatically discovered and classified based solely on the inherent similarity of the code, facilitating the identification of new, unknown variants using code obfuscation techniques such as polymorphism and polymorphism. By analyzing the relationships between clusters, an evolutionary map of malware can be further drawn, helping security researchers understand the attacker's technical evolution path, predict the possible directions of future variants, and provide clues for attribution analysis.

[0116] 106: Fuzzy matching rule generation, which involves generating detection rules based on statistical features and fuzzy matching. This includes the following steps:

[0117] First, based on the feature distribution of a known malicious code sample set, statistical analysis methods are used to determine one or more statistical feature thresholds according to the feature distribution, and the statistical feature thresholds are tested on an independent validation set.

[0118] The feature distribution originates from the results of steps 104 and 105. For example, a threshold can be set for a specific malware family identified in the latent space by utilizing its reconstruction error distribution, or by setting a threshold based on the statistical characteristics of frequently occurring key byte regions in the attention weight graph (such as the frequency of occurrence of specific instruction sequences). When a new malware family is discovered and forms a new cluster, its feature distribution is automatically analyzed to generate a new threshold, enabling a rapid response to new threats. Furthermore, the validation set testing process ensures that the deep learning-based threshold exhibits low false positives and high recall in real-world environments.

[0119] Then, the fuzzy hash value of the malicious code sample is calculated, and the calculated fuzzy hash value is stored as a signature in the hash signature library. Fuzzy matching is performed by comparing the fuzzy hash value of the sample under test with the signature in the hash signature library.

[0120] Traditional fuzzy hashing typically applies to the entire binary file, making it susceptible to interference from irrelevant padding data or resource files. In this invention, the attention mapping in step 104 is used to locate the fuzzy hash value only for key code regions or abnormal byte fragments identified by the model. The resulting signature eliminates a significant amount of noise, thus exhibiting greater robustness against code obfuscation, packing, and other variant techniques. Furthermore, each signature can be annotated with the results of variant feature mining in step 105, transforming the signature library itself into a structured knowledge base, rather than merely a blacklist.

[0121] Finally, a similarity measurement method in a multidimensional feature space is defined to comprehensively evaluate the similarity between a test sample and known malware. This comprehensive evaluation includes combining the results of threshold determination and fuzzy hash matching. For example, the final malware score of a test sample can be calculated as follows:

[0122] Malicious score = W1×A + W2×B + W3×C;

[0123] Where A is the statistical feature anomaly degree; B is the fuzzy hash similarity; C is the latent spatial distance, which comes from step 105 and measures the proximity of the sample to known malicious families; W1, W2, and W3 are configurable weights.

[0124] When a sample is judged to be malicious, not only can a score be given, but the reasons can also be clearly explained. For example, the sample is judged to be high-risk because its statistical characteristics in the key area exceed the threshold (high contribution of weight W1), and its core code fragment is highly similar to the fuzzy hash signature of the "APT-XX" family (high contribution of weight W2), and it is adjacent to the cluster of this family in the latent space (high contribution of weight W3).

[0125] While the final generated rules are formally based on traditional threshold and hash matching, they incorporate the generalization and pattern recognition capabilities of deep learning models. This allows security devices deploying these rules to achieve high detection accuracy without introducing significant computational overhead. Furthermore, fuzzy hashing based on attention regions can effectively identify disguises such as code obfuscation, packing, and recompilation, improving the accuracy of identifying different variants of malicious code from the same source.

[0126] 107: Detection engine integration, which integrates the detection rules generated by the variational autoencoder and the fuzzy hash signature into the existing malicious code detection engine, thereby enabling support for hybrid detection.

[0127] Byte offset information, fuzzy hash signatures, and threshold rules based on statistical features are provided as input to an existing malware detection engine. This allows the engine to combine static feature scanning, dynamic behavior analysis, pinpoint detection based on byte offset information, and similarity matching of fuzzy hash signatures to make a comprehensive judgment on malware. The comprehensive judgment includes assigning weights to the outputs of different detection methods or employing a decision fusion model to arrive at the final detection result.

[0128] This invention also provides a malware variant signature mining system based on variational autoencoders, comprising:

[0129] The feature extraction layer is used to extract multimodal features from malicious code and establish mapping relationships;

[0130] The variational autoencoder layer is used to perform unsupervised pre-training on the multimodal features of malicious code using a variational autoencoder to learn the latent representation of the malicious code.

[0131] Adversarial training layers are used to train the decoder of the variational autoencoder as a generator network against a discriminator network used to distinguish between real and generated samples, in order to balance reconstruction loss and adversarial loss.

[0132] The anomaly detection layer is used to detect malicious code anomaly regions based on reconstruction error calculation, potential spatial distribution analysis and attention weight mapping, and locate the anomaly back to a specific byte position in the original binary file by setting statistical thresholds and mapping relationships.

[0133] The variant mining layer is used to mine malware variant features, family relationships, and evolutionary paths based on latent spatial clustering and pattern recognition.

[0134] The rule generation layer is used to generate detection rules based on statistical features and fuzzy matching.

[0135] An engine integration layer is used to integrate the detection rules generated based on variational autoencoders with fuzzy hash signatures into existing malware detection engines.

[0136] The multimodal features extracted from malicious code include: binary image features, PE structure features, instruction sequence features, and entropy distribution features; the established mapping relationships include: mapping of binary image features to bytes, mapping of PE structure features to positions, mapping of instruction sequence features to code, and mapping of entropy distribution features to regions.

[0137] The process of establishing a mapping from binary image features to bytes includes: converting the binary file into a 256×256 grayscale image by byte value, with each pixel corresponding to one byte; establishing a mapping relationship from pixel coordinates (x, y) to file offset: offset = y×256 + x; mapping byte values ​​0-255 to pixel grayscale values; and marking the PE file segments corresponding to different regions in the image.

[0138] The process of establishing a mapping from PE structural features to locations includes: extracting PE file header information and recording the offset position of the PE file header information in the file; parsing the section table and establishing a mapping from section names to file offset ranges; locating the position and size of the import table in the file; and extracting resource information and its position in the file.

[0139] The process of establishing a mapping from instruction sequence features to code includes: establishing a mapping from instructions to file offsets through disassembly; extracting the opcode sequence and preserving the file position of each instruction; and tracing register usage patterns and their corresponding instruction positions.

[0140] The process of establishing a mapping from instruction sequence features to code includes: calculating the entropy values ​​of different regions of the file and dividing it into blocks of 1KB; establishing a mapping relationship between entropy values ​​and file regions; detecting encrypted and compressed regions and marking their positions in the file; and analyzing the randomness of byte distribution to identify suspicious regions.

[0141] The variational autoencoder layer includes:

[0142] The encoder module is used to fuse the extracted multimodal features and map them to the latent space, predicting the mean and variance parameters of the Gaussian distribution that the latent space follows; the sampling module is used to sample according to the Gaussian distribution defined by the mean and variance parameters to obtain the latent representation of the malicious code; the decoder module is used to take the latent representation of the malicious code as input, reconstruct the multimodal features, and obtain the reconstructed multimodal output.

[0143] The optimization module is used to construct a total loss function based on the reconstruction loss between the multimodal output and the original multimodal features and the KL divergence between the Gaussian distribution and the standard normal distribution, and to jointly optimize the encoder and decoder based on the total loss function.

[0144] The adversarial training layer includes:

[0145] The generator module is used by the generator network to generate forged multimodal feature samples based on the latent representation extracted from real malicious code samples using the decoder of the variational autoencoder. The discriminator module is used to input the forged multimodal feature samples and the real malicious code multimodal feature samples into the discriminator network for authenticity discrimination. The optimization module is used to calculate the adversarial loss based on the discrimination result and construct the total loss function by combining it with the reconstruction loss of the variational autoencoder, so as to jointly optimize the generator network and the discriminator network.

[0146] The anomaly detection layer includes:

[0147] The calculation and generation module is used to calculate the pixel-level error between the original multimodal features and the reconstructed features, generate an error heatmap, and use the mapping relationship between the binary image features and bytes to reverse map the coordinates of high-error pixels in the error heatmap back to the byte offset of the original binary file to mark the position of abnormal bytes.

[0148] The extraction and allocation module is used to extract the image attention weight map from the encoder network of the trained variational autoencoder, generate an attention heatmap, and use the mapping relationship between the binary image features and bytes to map the coordinates of high-weight pixels in the attention heatmap back to the byte offset of the original binary file, and assign an importance score to each byte.

[0149] An analysis module is established to build a statistical distribution model in the latent space based on normal samples. The latent representation of the test sample is compared with the statistical distribution model to detect outliers that deviate from the normal distribution as abnormal samples. The input features that cause the outliers are tracked through gradient backpropagation technology, and the contribution of different modal features to the anomaly detection is analyzed.

[0150] The settings adjustment module is used to set and adjust the statistical thresholds used for anomaly detection based on file type, file size, and file internal area.

[0151] The rule generation layer includes:

[0152] The test module is designed to determine one or more statistical feature thresholds based on the feature distribution of a known malicious code sample set, using statistical analysis methods, and then test the statistical feature thresholds on an independent validation set.

[0153] The storage matching module is used to calculate the fuzzy hash value of the malicious code sample, store the calculated fuzzy hash value as a signature in the hash signature library, and perform fuzzy matching by comparing the fuzzy hash value of the sample to be tested with the signature in the hash signature library.

[0154] Define an evaluation module to define similarity measurement methods in a multidimensional feature space to comprehensively evaluate the similarity between the sample under test and known malicious code.

[0155] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for malicious code variant feature mining based on variational autoencoders, characterized in that, include: Extract multimodal features from malicious code and establish mapping relationships; Unsupervised pre-training of multimodal features of malicious code is performed using a variational autoencoder to learn the latent representation of the malicious code; The decoder of the variational autoencoder is used as a generator network and is adversarially trained with a discriminator network used to distinguish between real and generated samples in order to balance reconstruction loss and adversarial loss. Based on reconstruction error calculation, potential spatial distribution analysis and attention weight mapping, the abnormal regions of malicious code are detected, and the anomalies are located back to specific byte positions in the original binary file by setting statistical thresholds and mapping relationships. Detection rules based on statistical features and fuzzy matching are generated, and the detection rules generated based on variational autoencoders are integrated with fuzzy hash signatures into an existing malware detection engine.

2. The method for malicious code variant feature mining based on variational autoencoder according to claim 1, characterized in that, The multimodal features extracted from malicious code include: binary image features, PE structure features, instruction sequence features, and entropy distribution features; The established mapping relationships include: mapping of binary image features to bytes, mapping of PE structure features to positions, mapping of instruction sequence features to code, and mapping of entropy distribution features to regions.

3. The method for malicious code variant feature mining based on variational autoencoder according to claim 2, characterized in that, The process of using a variational autoencoder to perform unsupervised pre-training on the multimodal features of malicious code to learn the latent representation of the malicious code includes: Encoder step: Fuse the extracted multimodal features and map them to the latent space, predicting the mean and variance parameters of the Gaussian distribution that the latent space follows; Sampling step: Sample according to the Gaussian distribution defined by the mean and variance parameters to obtain the latent representation of the malicious code; Decoder step: Take the latent representation of the malicious code as input, reconstruct the multimodal features, and obtain the reconstructed multimodal output; Optimization steps: Based on the reconstruction loss between the multimodal output and the original multimodal features, and the KL divergence between the Gaussian distribution and the standard normal distribution, a total loss function is constructed, and the encoder and decoder are jointly optimized based on the total loss function.

4. The method for malicious code variant feature mining based on variational autoencoder according to claim 3, characterized in that, The adversarial training process includes: The generator network utilizes the decoder of the variational autoencoder to generate forged multimodal feature samples based on the latent representations extracted from real malicious code samples. The forged multimodal feature samples and the real malicious code multimodal feature samples are then input into the discriminator network for authenticity determination. Based on the determination results, the adversarial loss is calculated and combined with the reconstruction loss of the variational autoencoder to construct the total loss function, thereby jointly optimizing the generator network and the discriminator network.

5. The method for malicious code variant feature mining based on variational autoencoder according to claim 4, characterized in that, The process of detecting malicious code anomaly regions based on reconstruction error calculation, potential spatial distribution analysis, and attention weight mapping, and locating the anomaly back to a specific byte position in the original binary file by setting statistical thresholds and mapping relationships, includes: Calculate the pixel-level error between the original multimodal features and the reconstructed features, generate an error heatmap, and use the mapping relationship between the binary image features and bytes to reverse map the coordinates of high-error pixels in the error heatmap back to the byte offsets of the original binary file to mark the positions of abnormal bytes. The image attention weight map is extracted from the trained variational autoencoder encoder network to generate an attention heatmap. Using the mapping relationship between binary image features and bytes, the coordinates of high-weight pixels in the attention heatmap are mapped back to the byte offsets of the original binary file, and an importance score is assigned to each byte. A statistical distribution model is established in the latent space based on normal samples. The latent representation of the test sample is compared with the statistical distribution model. Outliers that deviate from the normal distribution are detected as abnormal samples. The input features that cause the outliers are tracked through gradient backpropagation technology, and the contribution of different modal features to the anomaly detection is analyzed. Set and adjust the statistical thresholds used for anomaly detection based on file type, file size, and file internal area.

6. The method for malicious code variant feature mining based on variational autoencoder according to claim 5, characterized in that, Also includes: This method utilizes latent spatial clustering and pattern recognition to mine the characteristics, family relationships, and evolutionary paths of malicious code variants.

7. The method for malicious code variant feature mining based on variational autoencoder according to claim 6, characterized in that, The process of generating detection rules based on statistical features and fuzzy matching includes: Based on the feature distribution of known malicious code sample sets, statistical analysis methods are used to determine one or more statistical feature thresholds according to the feature distribution, and the statistical feature thresholds are tested on independent validation sets. The fuzzy hash value of the malicious code sample is calculated, and the calculated fuzzy hash value is stored as a signature in the hash signature library. Fuzzy matching is performed by comparing the fuzzy hash value of the sample to be tested with the signature in the hash signature library. We define a similarity measurement method in a multidimensional feature space to comprehensively evaluate the similarity between the sample under test and known malicious code.

8. The method for malicious code variant feature mining based on variational autoencoder according to claim 7, characterized in that, The process of establishing a mapping from binary image features to bytes includes: converting the binary file into a 256×256 grayscale image by byte value, with each pixel corresponding to one byte; establishing a mapping relationship from pixel coordinates (x, y) to file offset: offset = y×256 + x; mapping byte values ​​0-255 to pixel grayscale values; and marking the PE file segments corresponding to different regions in the image. The process of establishing a mapping from PE structural features to locations includes: extracting PE file header information and recording the offset position of the PE file header information in the file; parsing the section table and establishing a mapping from section names to file offset ranges; locating the position and size of the import table in the file; and extracting resource information and its position in the file. The process of establishing a mapping from instruction sequence features to code includes: establishing a mapping from instructions to file offsets through disassembly; extracting the opcode sequence and preserving the file position of each instruction; and tracing register usage patterns and their corresponding instruction positions. The process of establishing a mapping from instruction sequence features to code includes: calculating the entropy values ​​of different regions of the file and dividing it into blocks of 1KB; establishing a mapping relationship between entropy values ​​and file regions; detecting encrypted and compressed regions and marking their positions in the file; and analyzing the randomness of byte distribution to identify suspicious regions.

9. A malware variant feature mining system based on variational autoencoders, characterized in that, include: The feature extraction layer is used to extract multimodal features from malicious code and establish mapping relationships; The variational autoencoder layer is used to perform unsupervised pre-training on the multimodal features of malicious code using a variational autoencoder to learn the latent representation of the malicious code. Adversarial training layers are used to train the decoder of the variational autoencoder as a generator network against a discriminator network used to distinguish between real and generated samples, in order to balance reconstruction loss and adversarial loss. The anomaly detection layer is used to detect malicious code anomaly regions based on reconstruction error calculation, potential spatial distribution analysis and attention weight mapping, and locate the anomaly back to a specific byte position in the original binary file by setting statistical thresholds and mapping relationships. The rule generation layer is used to generate detection rules based on statistical features and fuzzy matching. An engine integration layer is used to integrate the detection rules generated based on variational autoencoders with fuzzy hash signatures into existing malware detection engines.

10. A malware variant feature mining system based on variational autoencoder according to claim 9, characterized in that, Also includes: The variant mining layer is used to mine malware variant features, family relationships, and evolutionary paths based on latent spatial clustering and pattern recognition.

Images