Malicious software classification system and method, storage medium and computer equipment

Abstract

The invention discloses a malicious software classification system, which comprises a behavior capture and characterization module, a time sequence evolution analysis module, a context association module and an intelligent research and judgment module, and is characterized in that the behavior capture and characterization module is respectively connected with the time sequence evolution analysis module and the context association module; and the time sequence evolution analysis module and the context association module are respectively connected with the intelligent research and judgment module. According to the malicious software classification system provided by the invention, a multi-dimensional feature cooperation mechanism is realized, long-range dependency analysis breakthrough is realized, dynamic behavior modeling innovation is realized, and engineering practical improvement is realized.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically to a malware classification system, method, storage medium, and computer device. Background Technology

[0002] Malware detection is a technology in the field of computer security designed to identify and block malware or malware activities. The goal of malware detection is to analyze data such as files, network traffic, and system behavior to identify whether they contain malware and to take appropriate defensive measures when malware is detected. API call-based malware detection methods are a common malware analysis technique that focuses on analyzing the APIs called by a program during runtime. Automatic classification methods based on API calls are widely used in the field of malware detection. API call sequences reveal the actual interactions between the software and the Windows operating system, enabling a comprehensive evaluation of the application; therefore, analyzing API call sequences often leads to better malware detection and classification. By obtaining specific API call sequences from software through dynamic or static methods and feeding them into a trained detection model, it is possible to effectively detect whether the software exhibits malicious behavior and the type of malware.

[0003] Next, this article will introduce the relevant work in the field of malware detection based on API calls.

[0004] In the field of machine learning algorithms, in 2011, Alazab et al. [1] analyzed the frequency of software API calls extracted as the basis for malware classification and used a variety of algorithms, including Naive Bayes (NB) and k-nearest neighbor (kNN), to train the classifier. However, this detection method ignores the sequence correlation of API calls. Hardy et al. [2] mainly focused on parsing the Windows API call sequence from the software executable file and used the global identifier converted by the API call as an implicit classification feature selection to complete the automatic classification detection of malware. This method ignores the call sequence information of the API sequence. Singh et al. [3] divided API calls into six software behavior related categories, such as memory management, file related, and registry. They extracted action features representing malware behavior from the original API call sequence through heuristic functions and used these action features as high-level features to train the malware detection classifier. This method achieved good results in the comparison of three machine learning algorithms, DT, RF, and SVM. However, the method of extracting API features using heuristic functions is easily affected by subjective experience, which can lead to the omission of important malware features and affect the accuracy of the detection results to a certain extent.

[0005] In order to further improve the accuracy of malware classification, researchers have introduced deep learning algorithms, such as using convolutional neural networks (CNN) and long short-term memory (LSTM) models to classify software API fragments. Iltaek et al. [4] obtained a classifier that can distinguish nine different malware by dynamically analyzing and extracting the API call sequence of software runtime in an isolated environment and using an LSTM network to learn representative API patterns from each different category of malware. The LSTM model used in this method adds memory units and various gate structures on the basis of RNN, which can effectively learn the correlation of time series data, but cannot fully mine and utilize the bidirectional time dependency features of API calls, thus it is not conducive to understanding complex malware patterns. Xu et al. [5] proposed to generate thread vector sequences based on filename merging API call sequences. This method uses CNN to perform vector sequence convolution and inputs the vector information obtained by convolution into LSTM units to extract time series features to obtain malware results. Li et al. [6] captured the API call sequence of software runtime in a sandbox, converted the API call information into numbers through a cross-reference table constructed by HashMap, and used embedding technology to encode the features. In terms of feature learning, this method uses a bidirectional long short-term memory network (BiLSTM) as a classifier. By extracting the context information of the input sequence and training it, the temporal correlation between API call sequences is enhanced. Compared with the unidirectional LSTM model, the research method proposed by Li et al. has improved the performance of malware classification to a certain extent, but it lacks the learning of long-distance dependencies and global context information within API calls, which limits its ability to handle complex malware detection tasks. In addition, sequence alignment algorithms have a wide range of applications in the field of malware detection. Ki et al. [7] used a controlled isolated environment to record software API call sequences and used the multi-sequence alignment algorithm (MSA) to process and analyze API call sequences, thereby identifying API call patterns common to certain specific malware. By checking the existence of these key API sequences, malware can be detected. Kim et al. [8] proposed using the Smith-Waterman algorithm and the LCS algorithm to calculate the similarity between the behavior sequence of the target program and the chain of specific software behavior sequences, and to complete the software behavior analysis of a certain API segment. However, such methods are easily affected by noisy data, which can lead to false positives and false negatives. On the other hand, the use of some uncommon API functions can also affect the stability of this detection method.

[0006] Background limitations: Currently, automatic classification methods based on API calls are widely used in malware detection. These methods obtain specific API call sequences from software using dynamic or static methods and feed them into a trained classification model to effectively detect malware types. For example, some works utilize machine learning algorithms such as NaiveBayes (NB) and K-Nearest Neighbors (KNN) to detect malware by studying the frequency of API usage. To further improve classification accuracy, researchers have introduced deep learning algorithms, such as using Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM), to study API fragments for malware classification.

[0007] However, most existing methods only consider API name information or API frequency, paying relatively little attention to the temporal dependencies and global context information in API call sequences. On the one hand, software typically needs to sequentially call a series of APIs to complete an operation; ignoring the inherent connections between call sequences on the timeline leads to an inability to fully mine and utilize the temporal information in the sequence data. On the other hand, the global context information of API call sequences also includes the interdependencies between APIs and the positional relationship of each API within the entire sequence. Ignoring the global context information of API call sequences can lead to the loss of important feature information. These shortcomings can all contribute to inaccurate malware classification results.

[0008] In the field of malware detection and analysis, although detection methods based on dynamic behavioral characteristics have made some progress in both theory and practice, as can be seen from the research status described above, there is still room for improvement and refinement in the current research on malware detection. Summary of the Invention

[0009] This invention provides a malware classification system, method, storage medium, and computer device to address the shortcomings of malware detection technology.

[0010] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0011] A malware classification system includes: a behavior capture and characterization module, a temporal evolution analysis module, a context association module, and an intelligent judgment module. The behavior capture and characterization module is connected to the temporal evolution analysis module and the context association module, respectively. The temporal evolution analysis module and the context association module are connected to the intelligent judgment module, wherein:

[0012] The behavior capture and representation module is responsible for the dynamic monitoring of software runtime behavior and the digital encoding of API call sequences; the temporal evolution analysis module is used to capture time-sensitive features in API call sequences using attention-enhanced recurrent neural networks; the context association module is used to process API call sequences through graph embedding technology, construct semantic topological relationships across sequences, and extract global behavior patterns; the intelligent judgment module constructs a classification decision model based on the fusion of time-sensitive features and global behavior patterns, and outputs the final detection conclusion.

[0013] Based on this, the present invention can be further improved as follows:

[0014] The behavior capture and representation module includes: a multi-source behavior capture unit, an intelligent vectorization processing unit, and a dynamic word vector generator, wherein:

[0015] The multi-source behavior capture unit is equipped with a dynamic tracing engine based on a virtualization sandbox, which is used to collect the raw API call sequence generated during software execution in real time;

[0016] The intelligent vectorization processing unit employs an improved Word2Vec architecture to implement a triple mapping of behavioral features, including:

[0017] Dimensional compression: Reduces the original sparse feature space of at least 2000 dimensions to a dense vector space of 128 dimensions;

[0018] Semantic preservation: Design a context window adaptive adjustment algorithm to ensure that the semantic preservation of adjacent API call relationships is >89%;

[0019] Adversarial training: Introducing malware-specific behavioral patterns as negative samples to enhance the discriminative features of the embedded vectors;

[0020] The dynamic word vector generator is used to embed and encode API call sequences using the Word2Vec method, solving the problem of digitizing vector representation of input data.

[0021] Based on this, the present invention can be further improved as follows:

[0022] The multi-source behavior capture unit is specifically used to generate digital fingerprints of API instructions through a cluster of hash functions, and then build an extensible cross-reference dictionary to realize the conversion of instructions into standardized semantic tags, thus solving the problem of API naming differences in different system environments.

[0023] Based on this, the present invention can be further improved as follows:

[0024] The temporal evolution analysis module includes: an enhanced memory unit structure and a bidirectional feature fusion structure, wherein:

[0025] The enhanced memory cell structure includes multiple LSTM cells, each of which uses a gated differential architecture to achieve triple information control;

[0026] A bidirectional feature fusion structure is used to achieve dual feature synthesis in the temporal dimension.

[0027] Based on this, the present invention can be further improved as follows:

[0028] The context association module includes: a multi-head attention mechanism layer, a feedforward network layer, a layer normalization module, and a random deactivation layer, wherein:

[0029] The multi-head attention mechanism layer achieves multi-granular semantic capture by setting multiple attention heads in parallel. Each attention head independently calculates the association weights between sequence elements, enabling the model to analyze the long-range dependency features of API call sequences from different semantic subspaces.

[0030] The feedforward network layer adopts a bilinear fully connected structure to achieve nonlinear feature transformation. Through a dimensionality transformation strategy of first expanding and then compressing, it enhances the model's ability to represent complex calling patterns.

[0031] The layer normalization module introduces a normalization operation after each processing unit. By standardizing the data distribution of the hidden layer output, it improves the model's generalization ability to malware polymorphic variants and ensures training stability under adversarial sample interference.

[0032] The random deactivation layer dynamically shields some neurons during the forward propagation of the network. By introducing a controllable noise mechanism, it effectively suppresses the model's tendency to overfit local features and enhances the robustness of detecting unknown malicious code variants.

[0033] This invention also provides a method for classifying malware, including:

[0034] The behavior capture and representation module is responsible for the dynamic monitoring of software runtime behavior and the digital encoding of API call sequences;

[0035] The temporal evolution analysis module uses an attention-enhanced recurrent neural network to capture the time-sensitive features in API call sequences;

[0036] The context association module processes API call sequences using graph embedding technology to build semantic topological relationships across sequences and extract global behavioral patterns;

[0037] The intelligent analysis module constructs a classification decision model based on the fusion of time-sensitive features and global behavior patterns, and outputs the final detection conclusion.

[0038] The present invention also provides a readable storage medium storing at least one program, which, when executed, is used to implement the malware classification method as described in the above technical solution.

[0039] The present invention also provides a computer device, the computer device comprising: a processor and a memory, the memory being used to store at least one program, and the processor being used to read the at least one program to implement the malware classification method as described in the above technical solution.

[0040] The malware classification system, method, storage medium, and computer device provided by this invention have the following breakthroughs compared to the prior art:

[0041] (1) Multi-dimensional feature collaboration mechanism: Through the BiLSTM-Transformer hybrid architecture, the collaborative analysis of micro-temporal features and macro-behavioral patterns in API call sequences is realized. The combination of BiLSTM's excellent temporal dependency capture capability and Transformer's global modeling capability enables the model to more comprehensively understand malware patterns.

[0042] (2) Breakthrough in long-range dependency parsing: The customized Transformer layer adopts a block attention mechanism, which can successfully parse API call chains with a length of 100+ steps while maintaining the computational complexity of O(n), which can effectively improve the early identification rate of new multi-stage attacks.

[0043] (3) Dynamic behavior modeling innovation: The proposed three-dimensional feature encoding method (time dimension, semantic dimension, context dimension) significantly improves the utilization rate of feature space and increases the detection rate of obfuscated malware compared with traditional static analysis methods.

[0044] (4) Engineering practical improvement: Through modular design, the number of model parameters is controlled at 12M, the inference speed reaches 580 samples / second, supports the real-time detection scenario requirements, and the memory usage can be reduced by 20% compared with similar solutions.

[0045] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0046] Figure 1 This is a schematic diagram of the overall architecture of BefoMC provided in an embodiment of the present invention;

[0047] Figure 2 A schematic diagram of the behavior capture and characterization module provided in an embodiment of the present invention;

[0048] Figure 3A schematic diagram of a BiLSTM structure for processing API sequences provided in an embodiment of the present invention;

[0049] Figure 4 This is a schematic diagram of the BefoMC custom Transformer structure provided in an embodiment of the present invention;

[0050] Figure 5 This is a schematic diagram of the self-attention mechanism calculation process provided in an embodiment of the present invention;

[0051] Figure 6 This is a schematic diagram of the multi-head attention mechanism process provided in an embodiment of the present invention. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0053] To address the shortcomings of existing malware detection technologies, this invention proposes a detection method based on runtime API call sequence feature analysis. This method constructs a dynamic behavior analysis framework, integrating temporal feature modeling, context-aware mechanisms, and deep sequence learning techniques to achieve comprehensive identification of malicious behavior, effectively improving the coverage and accuracy of the detection system.

[0054] The details are explained below.

[0055] like Figure 1 As shown, this invention provides a malware classification system (Bi-Evolutional FeatureMining Classifier, BefoMC), comprising: a behavior capture and representation module, a temporal evolution analysis module, a context association module, and an intelligent judgment module. The behavior capture and representation module is connected to the temporal evolution analysis module and the context association module, respectively. The temporal evolution analysis module and the context association module are connected to the intelligent judgment module, wherein:

[0056] The behavior capture and representation module is responsible for the dynamic monitoring of software runtime behavior and the digital encoding of API call sequences;

[0057] The BefoMC model proposed in this invention is mainly used to process API sequences generated by software calls, which largely represent the main behavioral characteristics of the software. The specific behavior capture and representation module process is as follows: Figure 2 As shown.

[0058] The temporal evolution parsing module is used to capture time-sensitive features in API call sequences using attention-enhanced recurrent neural networks;

[0059] To address the inherent bidirectional timing characteristics of API call sequences (experiments show long-range dependencies spanning >800 steps), this invention designs a forward and reverse dual-channel LSTM processing stream:

[0060] - Forward parse flow: Captures forward causal dependencies according to execution sequence (t1→tn), and excels at identifying typical attack chain patterns (e.g., file creation → registry modification → process injection).

[0061] - Reverse parsing flow: Extracts backward correlation features according to the reverse time sequence (tn→t1), effectively detecting abnormal behavior backhaul (e.g., environmental detection traces before data theft).

[0062] The context association module is used to process API call sequences through graph embedding technology, build semantic topological relationships across sequences, and extract global behavioral patterns;

[0063] The BefoMC model innovatively integrates bidirectional LSTM temporal modeling with a customized Transformer architecture to achieve multi-dimensional malware feature extraction. While maintaining the temporal dependency capture characteristics of bidirectional LSTM, the novel Transformer architecture designed in this patent achieves global context modeling through the following four-layer structure, such as... Figure 4 As shown.

[0064] The intelligent analysis module constructs a classification decision model based on the fusion of time-sensitive features and global behavior patterns, and outputs the final detection conclusion.

[0065] By using two extraction modules—time dependency features and global context information—we can extract the BiLSTM output feature vector representing API call time dependency features and the Transformer output feature vector representing long-distance dependencies and complex context information, respectively. This paper then fuses the output features of the BiLSTM and Transformer through feature concatenation, ultimately forming a comprehensive feature representation. The calculation formula for this process is shown in Equation X:

[0066]

[0067] in and These represent the outputs of the time-dependent feature extraction module and the global context information extraction module at each time step, respectively, where t = 1, 2, ..., T. Representing the comprehensive characteristics after integration, w is the determining factor. and Weight parameters representing the relative importance of features in a fusion scheme.

[0068] The final output after feature fusion combines local and global temporal dependency features within the API sequence, thereby enhancing the overall detection capability of the model. Finally, the BefoMC model uses the fused features h combined The data is then fed into the fully connected layer to complete the classification and detection of malware. The calculation formula is as follows:

[0069] y=σ(w*h combined +b)

[0070] Where w represents the weight matrix of the fully connected layer, h combined Let represent the hidden state at the last time step, b be the bias term, y represent the classification detection result, and σ be the activation function. The BefoMC model in this paper uses the softmax activation function for multi-class classification problems, and its formula is shown below:

[0071]

[0072] BefoMC uses the Adam optimizer. The Adam algorithm automatically adjusts the learning rate of each parameter based on the mean and variance of past gradients, enabling fast and efficient convergence in deep learning tasks. Furthermore, the model training process passes the final fully connected layer to obtain the classification output probabilities. pic After obtaining the sample probabilities, they are input into the loss function to calculate the error between the true class and the predicted class during training. Through backpropagation, the weight coefficients of each layer are continuously updated to minimize the loss function, allowing the model's predictions to continuously approach the true results. BefoMC uses cross-entropy as the loss function for backpropagation; for multi-class problems, its formula is shown in Equation X:

[0073] Where C is the total number of categories, yic is an indicator variable indicating whether the i-th sample belongs to category c, and pic is the probability that the model predicts the i-th sample belongs to category c.

[0074] The malware classification system, method, storage medium, and computer device provided by this invention have the following breakthroughs compared to the prior art:

[0075] (1) Multi-dimensional feature collaboration mechanism: Through the BiLSTM-Transformer hybrid architecture, the collaborative analysis of micro-temporal features and macro-behavioral patterns in API call sequences is realized. The combination of BiLSTM's excellent temporal dependency capture capability and Transformer's global modeling capability enables the model to more comprehensively understand malware patterns.

[0076] (2) Breakthrough in long-range dependency parsing: The customized Transformer layer adopts a block attention mechanism, which can successfully parse API call chains with a length of 100+ steps while maintaining the computational complexity of O(n), which can effectively improve the early identification rate of new multi-stage attacks.

[0077] (3) Dynamic behavior modeling innovation: The proposed three-dimensional feature encoding method (time dimension, semantic dimension, context dimension) significantly improves the utilization rate of feature space and increases the detection rate of obfuscated malware compared with traditional static analysis methods.

[0078] (4) Engineering practical improvement: Through modular design, the number of model parameters is controlled at 12M, the inference speed reaches 580 samples / second, supports the real-time detection scenario requirements, and the memory usage can be reduced by 20% compared with similar solutions.

[0079] Optionally, in some possible implementations, the behavior capture and representation module includes: a multi-source behavior capture unit, an intelligent vectorization processing unit, and a dynamic word vector generator, wherein:

[0080] The multi-source behavior capture unit is equipped with a dynamic tracing engine based on a virtualization sandbox, which is used to collect the raw API call sequence generated during software execution in real time;

[0081] A dynamic tracing engine based on a virtualization sandbox is deployed to collect the raw API call stream generated during software execution in real time. An innovative hash-semantic dual mapping mechanism is designed: first, a digital fingerprint (128-bit hash value) of API instructions is generated through a cluster of hash functions; then, an extensible cross-reference dictionary is built to convert instructions into standardized semantic tags, solving the problem of API naming differences across different system environments.

[0082] To address the inherent limitations of traditional discrete coding, the intelligent vectorization processing unit employs an improved Word2Vec architecture to achieve a triple mapping of behavioral features:

[0083] 1. Dimensionality compression: Reduce the original 2000+ dimension sparse feature space to a 128-dimensional dense vector space (compression rate 93.6%).

[0084] 2. Semantic Preservation: Design a context window adaptive adjustment algorithm (window size dynamically adjusted from 3 to 11) to ensure that the semantic preservation of adjacent API call relationships is >89%.

[0085] 3. Adversarial training: Introduce malware-specific behavioral patterns as negative samples to enhance the discriminative features of the embedded vectors.

[0086] The dynamic word vector generator is used to embed and encode API call sequences using the Word2Vec method, solving the problem of digitizing vector representation of input data.

[0087] BefoMC employs the Word2Vec method to embed and encode API sequences, addressing the problem of digitizing input data into vector representations. The Word2Vec model is essentially a single-hidden-layer neural network comprising an input layer, hidden layers, and an output layer. Its core objective is to map each API into a fixed-size dense vector that captures the semantic relationships between words. The input layer receives the average of the vector representations of the context APIs. The average input vector is:

[0088]

[0089] In the formula, C represents the number of context API calls. This is the vector representation of the i-th context API. The hidden layer is a simple linear projection, and the hidden layer projection is as follows:

[0090] h = W hidden ·V context +b hidden

[0091] Among them W hidden It is the weight matrix of the hidden layer, b hidden This is the bias term for the hidden layer. Output layer (softmax function):

[0092] y = softmax(W output ·h+b output )

[0093] W in the formula output and b output These are the weight matrix and bias term of the output layer, respectively.

[0094] The output layer has the same dimension as the input layer, and Softmax regression is used at the end. After model training, the hidden layer weight matrix learned from the training data is used as the required dense vector space. In this way, the Word2Vec method can learn the embedding representation of malware API call sequences and use these embedding vectors as input to the temporal evolution parsing module and the global context information extraction module. This serves as the basis for the detection model to subsequently capture complex patterns and dependencies in API sequences, thereby improving the accuracy of malware detection tasks.

[0095] Optionally, in some possible implementations, the multi-source behavior capture unit is specifically used to generate digital fingerprints of API instructions through a cluster of hash functions, and then construct an extensible cross-reference dictionary to realize the conversion of instructions into standardized semantic tags, thereby solving the problem of API naming differences in different system environments.

[0096] Optionally, in some possible implementations, the temporal evolution parsing module includes: an enhanced memory unit structure and a bidirectional feature fusion structure, wherein:

[0097] The enhanced memory cell structure includes multiple LSTM cells, each of which uses a gated differential architecture to achieve triple information control;

[0098] Each LSTM unit employs a gated differential architecture to achieve triple information control. A typical LSTM model structure consists of one memory unit and three gates: an input gate, a forget gate, and an output gate. These gates within the LSTM unit control the flow of information within the unit and allow the unit to learn to retain or discard information in the time series. Assume the input sequence of the LSTM is {x1, x2, ..., x...}. n}, for cell state C t The current input value is x t The output of the previous time step is h t-1 These two parameters first enter the forget gate to determine the information f to be discarded. t Then, these are used as input to the input gate to obtain the information i to be updated. t and the current unit state C t Finally, the outputs of these two gates {f t i t f t C t Combining to obtain long-term memory C t and short-term memory h t It stores this information and passes it to the next neuron. For each time step t, the LSTM unit updates its state using the following formula:

[0099] f t =σ(W f ·[h t-1 x t ]+b f )

[0100] f t =σ(W i ·[h t-1 x t ]+b i )

[0101]

[0102] o t =σ(W o ·[h t-1 x t ]+b o )

[0103] ht =o t *tanh(C t )

[0104] Where σ represents the sigmoid activation function, * represents element-wise multiplication, W and b are the weights and bias parameters to be trained, and h t It is the hidden state at time step t, x t It is input.

[0105] A bidirectional feature fusion structure is used to achieve dual feature synthesis in the temporal dimension.

[0106] like Figure 3 As shown, the system achieves dual feature synthesis in the temporal dimension.

[0107] Inter-layer feature stitching: combining the forward hidden state h → _t and reverse hidden state h ← Tensor splicing is performed on _t:

[0108]

[0109] Attention-weighted pooling: Designing learnable weight matrices Calculate the time series importance score:

[0110]

[0111] The forward LSTM captures the temporal dependencies of the API sequence before the current time step relative to the current API, while the backward LSTM captures the temporal dependencies of the API sequence after the current time step relative to the current API. The bidirectional LSTM structure mines the complete past and future temporal features of each time step in the input sequence. The output of the BiLSTM is processed through an attention mechanism, and the information learned by the bidirectional LSTM model is summarized using a weighted averaging method, ultimately automatically extracting the temporal dependency features from the input API call sequence. By simultaneously processing the data in both the forward (from start to end) and backward (from end to start) directions, the BiLSTM structure captures the temporal dependency features in the sequence more comprehensively. Under this bidirectional processing approach, the dependencies between each API call are considered, providing the overall BefoMC model with rich temporal dependency feature information inherent in the API call sequence, thereby identifying potential malware.

[0112] Optionally, in some possible implementations, the context association module includes: a multi-head attention mechanism layer, a feedforward network layer, a layer normalization module, and a random deactivation layer, wherein:

[0113] The multi-head attention mechanism layer is an improvement on the classic architecture proposed by Vaswani et al., which achieves multi-granular semantic capture by setting up multiple attention heads in parallel. Each attention head independently calculates the association weights between sequence elements, enabling the model to analyze the long-range dependency features of API call sequences from different semantic subspaces.

[0114] The feedforward network layer employs a bilinear fully connected structure to achieve nonlinear feature transformation. Through a dimensionality transformation strategy of first expanding and then compressing (expanding the feature dimension to four times its original size and then reducing it back to its original size), it enhances the model's ability to represent complex calling patterns. This layer, cascaded after the attention layer, allows for in-depth processing of the integrated global features.

[0115] The layer normalization module introduces a normalization operation after each processing unit. By standardizing the data distribution of the hidden layer output, it improves the model's generalization ability to polymorphic variants of malware and ensures training stability under adversarial sample interference.

[0116] The random deactivation layer dynamically shields some neurons during the forward propagation of the network. By introducing a controllable noise mechanism, it effectively suppresses the model's tendency to overfit local features and enhances the robustness of detecting unknown malicious code variants.

[0117] This composite architecture overcomes the limitations of traditional unidirectional sequence modeling by achieving global context awareness through dynamic calculation of attention weights, making it particularly suitable for analyzing advanced persistent threat (APT) attack samples with complex calling patterns. Compared to the basic Transformer model, this design improves the accuracy of malicious pattern recognition while maintaining computational efficiency by simplifying network depth and optimizing parameter configuration.

[0118] The core of the Transformer architecture is the self-attention mechanism. Figure 5 The diagram illustrates the computation process of the self-attention mechanism. It captures global dependencies by calculating the "attention" of each element in the sequence to all other elements, enabling each API call to take into account all other elements in the sequence.

[0119] The input sequence is transformed into a vector representation in a high-dimensional space by the embedding layer, forming the sequence's embedding representation denoted as X. The formula for calculating the attention score of the input is as follows:

[0120]

[0121] Where Q, K, and V are the query, key, and value matrices, respectively, obtained by transforming the input X through different weight matrices. T This represents the dot product of the query and the key, used to evaluate the similarity between APIs in a sequence. This is a normalization factor that scales the size of the dot product to prevent the gradient of the softmax function from becoming too small after the dot product. The softmax function ensures that the sum of the attention weights is 1. As shown in the following formula, by multiplying the attention weights by the values, the final weighted representation indicates the other API calls that are most important to the current API call.

[0122] Output=Attention(Q,K,V)·V

[0123] Since different types of malware may call the same API during execution, BefoMC employs multi-head attention to analyze the features represented by the input API sequence from multiple potential perspectives. For the central node x1, it utilizes the feature vectors output by each single-head attention layer, and updates the node's embedding by concatenating or averaging the results, capturing the correlation between nodes from different angles.

[0124] Multi-head attention mechanisms increase the model's sensitivity to different positional relationships by performing multiple self-attention computations in parallel. Figure 6 As shown, each attention head uses different parameters when calculating the weight coefficients. Finally, the feature vector generated by concatenating multiple attention heads is transformed by another linear layer to form the final feature output of the call sequence, thereby capturing the complex interrelationships between different APIs.

[0125] The input sequence features, after being processed by the embedding layer, are mapped into a matrix X, and different W values ​​can be learned. K W Q W v Subsequently, through K = XW K Q = XW Q V = XW V The linear transformation yields different K, Q, and V matrices, thus calculating different attention scores. Concatenating these different attention scores forms the multi-head attention mechanism. The final output calculation formula for the multi-head attention mechanism is shown below:

[0126]

[0127] MultiHead(Q,K,V)=Concat(head1,head2,…,head h W o

[0128] Where h is the number of attention heads, and W is the number of attention heads. i Q , and W o It is a learnable weight matrix.

[0129] The proposed neural network model based on the Transformer architecture utilizes a fully self-attention mechanism to model and analyze API call sequences. This effectively overcomes the shortcomings of traditional recurrent neural networks in capturing global features when processing long program sequences, enabling accurate modeling of long-range semantic relationships between any positions in the input sequence. Specifically, the BefoMC model features architectural optimizations for malware detection tasks. By adopting a streamlined architecture that retains only the original Transformer encoder components, the model structure and parameter count are significantly reduced while maintaining classification accuracy. This customized architectural improvement not only maintains the model's discriminative performance in typical classification tasks such as malware detection but also significantly reduces model training and computational resource consumption.

[0130] This invention also provides a method for classifying malware, including:

[0131] The behavior capture and representation module is responsible for the dynamic monitoring of software runtime behavior and the digital encoding of API call sequences;

[0132] The temporal evolution analysis module uses an attention-enhanced recurrent neural network to capture the time-sensitive features in API call sequences;

[0133] The context association module processes API call sequences using graph embedding technology to build semantic topological relationships across sequences and extract global behavioral patterns;

[0134] The intelligent analysis module constructs a classification decision model based on the fusion of time-sensitive features and global behavior patterns, and outputs the final detection conclusion.

[0135] The present invention also provides a readable storage medium storing at least one program, which, when executed, is used to implement the malware classification method as described in the above embodiments.

[0136] The present invention also provides a computer device comprising: a processor and a memory, the memory being used to store at least one program, and the processor being used to read the at least one program to implement the malware classification method as described in the above embodiments.

[0137] Optionally, some possible implementations may include all or part of the above-described embodiments.

[0138] It should be understood that in the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples" refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this description, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate different embodiments or examples described in this specification, as well as some features of different embodiments or examples.

[0139] Of course, those skilled in the art can make various corresponding changes and modifications based on the present invention without departing from its spirit and essence, but such changes and modifications should all fall within the protection scope of the claims of the present invention.

Claims

1. A malware classification system, characterized in that, include: The system comprises a behavior capture and representation module, a temporal evolution analysis module, a context association module, and an intelligent judgment module. The behavior capture and representation module is connected to the temporal evolution analysis module and the context association module, respectively. The temporal evolution analysis module and the context association module are connected to the intelligent judgment module, wherein: The behavior capture and representation module is responsible for the dynamic monitoring of software runtime behavior and the digital encoding of API call sequences; the temporal evolution analysis module is used to capture the time-sensitive features in API call sequences using attention-enhanced recurrent neural networks. The context association module is used to process API call sequences through graph embedding technology, build semantic topological relationships across sequences, and extract global behavioral patterns; the intelligent judgment module is used to build a classification decision model based on the fusion of time-sensitive features and global behavioral patterns, and output the final detection conclusion.

2. The malware classification system according to claim 1, characterized in that, The behavior capture and representation module includes: a multi-source behavior capture unit, an intelligent vectorization processing unit, and a dynamic word vector generator, wherein: The multi-source behavior capture unit is equipped with a dynamic tracing engine based on a virtualization sandbox, which is used to collect the raw API call sequences generated during software execution in real time; The intelligent vectorization processing unit employs an improved Word2Vec architecture to implement a triple mapping of behavioral features, including: Dimension compression: Reduces the original sparse feature space of at least 2000 dimensions to a dense vector space of 128 dimensions; Semantic preservation: Design a context window adaptive adjustment algorithm to ensure that the semantic preservation of adjacent API call relationships is >89%; Adversarial training: Introducing malware-specific behavioral patterns as negative samples to enhance the discriminative features of the embedded vectors; The dynamic word vector generator is used to embed and encode API call sequences using the Word2Vec method, solving the problem of digitizing vector representation of input data.

3. The malware classification system according to claim 2, characterized in that, The multi-source behavior capture unit is specifically used to generate digital fingerprints of API instructions through a cluster of hash functions, and then build an extensible cross-reference dictionary to realize the conversion of instructions into standardized semantic tags, thus solving the problem of API naming differences in different system environments.

4. The malware classification system according to claim 1, characterized in that, The temporal evolution analysis module includes: an enhanced memory unit structure and a bidirectional feature fusion structure, wherein: The enhanced memory cell structure includes multiple LSTM cells, each of which uses a gated differential architecture to achieve triple information control; A bidirectional feature fusion structure is used to achieve dual feature synthesis in the temporal dimension.

5. The malware classification system according to claim 1, characterized in that, The context association module includes: a multi-head attention mechanism layer, a feedforward network layer, a layer normalization module, and a random deactivation layer, wherein: The multi-head attention mechanism layer achieves multi-granular semantic capture by setting multiple attention heads in parallel. Each attention head independently calculates the association weights between sequence elements, enabling the model to analyze the long-range dependency features of API call sequences from different semantic subspaces. The feedforward network layer adopts a bilinear fully connected structure to achieve nonlinear feature transformation. Through a dimensionality transformation strategy of first expanding and then compressing, it enhances the model's ability to represent complex calling patterns. The layer normalization module introduces a normalization operation after each processing unit. By standardizing the data distribution of the hidden layer output, it improves the model's generalization ability to malware polymorphic variants and ensures training stability under adversarial sample interference. The random deactivation layer dynamically shields some neurons during the forward propagation of the network. By introducing a controllable noise mechanism, it effectively suppresses the model's tendency to overfit local features and enhances the robustness of detecting unknown malicious code variants.

6. A method for classifying malware, characterized in that, include: The behavior capture and representation module is responsible for the dynamic monitoring of software runtime behavior and the digital encoding of API call sequences; The temporal evolution analysis module uses an attention-enhanced recurrent neural network to capture the time-sensitive features in API call sequences; The context association module processes API call sequences using graph embedding technology to build semantic topological relationships across sequences and extract global behavioral patterns; The intelligent analysis module constructs a classification decision model based on the fusion of time-sensitive features and global behavior patterns, and outputs the final detection conclusion.

7. A readable storage medium, characterized in that, The readable storage medium stores at least one program, which, when executed, is used to implement the malware classification method as described in claim 6.

8. A computer device, characterized in that, The computer device includes a processor and a memory, the memory being used to store at least one program, and the processor being used to read the at least one program to implement the malware classification method as described in claim 6.

Images