Multi-mode malicious software detection method and device
The multimodal malware detection method, which converts binary files into encoded images and combines them with text information, solves the problem of insufficient detection accuracy in existing technologies and achieves efficient and accurate detection of new and variant malware.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-31
- Publication Date
- 2026-04-03
AI Technical Summary
Existing malware detection methods lack sufficient accuracy when dealing with new and variant malware, failing to meet the high-efficiency and precise requirements of modern cybersecurity environments.
A multimodal malware detection method is adopted, which converts binary files into encoded images as visual modal inputs and combines them with text information related to security detection. Visual and text features are extracted and fused through an image encoding unit, an image processing unit, a text processing unit, and a multimodal fusion unit to generate more discriminative fused features.
It improves the detection accuracy of new and variant malware, enabling more accurate identification of malware, especially when dealing with unseen samples.
Smart Images
Figure CN121786835A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer security technology, and in particular to a method and apparatus for detecting multimodal malware. Background Technology
[0002] With the rapid development of information technology, the types and complexity of malware are constantly increasing, and traditional malware detection methods can no longer meet the demands for efficient and accurate malware detection in modern cybersecurity environments. Existing malware detection technologies mainly rely on static analysis, dynamic analysis, and feature-based matching methods. While these methods are effective in certain scenarios, their detection accuracy remains insufficient when dealing with new and variant malware. Summary of the Invention
[0003] This invention provides a method and apparatus for detecting multimodal malware. The technical solution is as follows: On the one hand, a multimodal malware detection method is provided, the method comprising: Obtain the binary file of the software to be processed, and obtain text information related to security detection; The binary file and the text information are input into the trained malware detection model; the malware detection model includes an image encoding unit, an image processing unit, a text processing unit, a multimodal fusion unit, and a decoding unit; The binary file is image-encoded using the image encoding unit to obtain an encoded image, and visual features are extracted from the encoded image using the image processing unit. The text processing unit is used to extract text features from the text information. The visual features and text features are fused using the multimodal fusion unit to obtain fused features; The fused features are decoded using the decoding unit to output detection results; the detection results include at least classification results.
[0004] On the other hand, a multimodal malware detection device is provided, the device comprising: The acquisition unit is used to acquire the binary file of the software to be processed, and to acquire text information related to security detection. An input unit is used to input the binary file and the text information into a trained malware detection model; the malware detection model includes an image encoding unit, an image processing unit, a text processing unit, a multimodal fusion unit, and a decoding unit; The malware detection model is used to perform the following operations on the input: The binary file is image-encoded using the image encoding unit to obtain an encoded image, and visual features are extracted from the encoded image using the image processing unit. The text processing unit is used to extract text features from the text information. The visual features and text features are fused using the multimodal fusion unit to obtain fused features; The fused features are decoded using the decoding unit to output detection results; the detection results include at least classification results.
[0005] On the other hand, a computer device is provided, the computer device including a memory and a processor, the memory for storing computer programs, and the processor for executing the computer programs stored in the memory to implement the steps of the multimodal malware detection method described above.
[0006] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements the steps of the multimodal malware detection method described above.
[0007] On the other hand, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the multimodal malware detection method described above.
[0008] The technical solution provided by this invention can bring at least the following beneficial effects: This invention converts the binary file of the software to be processed into an encoded image, which serves as one modality in the multimodal input of the model. This transforms the model from being unable to directly analyze discrete, low-semantic byte sequences to being able to directly process spatially consistent visual patterns. Furthermore, the encoded image effectively expresses the inherent structure of the binary file, enabling the model to extract rich and accurate visual features from it. In addition, textual information related to security detection is used as another modality in the multimodal input of the model. This textual information contains high-level semantics. Fusing textual features with visual features can generate more discriminative fused features, especially when dealing with new and variant malware, resulting in higher detection accuracy. Attached Figure Description
[0009] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0010] Figure 1 This is a flowchart of a multimodal malware detection method provided by an embodiment of the present invention; Figure 2 This is a diagram of a malware detection model architecture provided in an embodiment of the present invention; Figure 3 This is a structural diagram of a multimodal malware detection device provided in an embodiment of the present invention; Figure 4 This is a hardware architecture diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation
[0011] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.
[0012] Please refer to Figure 1 The present invention provides a multimodal malware detection method, the method comprising: Step 100: Obtain the binary file of the software to be processed, and obtain text information related to security detection; Step 102: Input the binary file and the text information into the trained malware detection model; the malware detection model includes an image encoding unit, an image processing unit, a text processing unit, a multimodal fusion unit, and a decoding unit; Step 104: The binary file is image-encoded using the image encoding unit to obtain an encoded image, and visual features are extracted from the encoded image using the image processing unit. Step 106: Extract text features from the text information using the text processing unit; Step 108: The visual features and text features are fused using the multimodal fusion unit to obtain fused features; Step 110: Decode the fused features using the decoding unit to output a detection result; the detection result includes at least a classification result.
[0013] In this embodiment of the invention, by converting the binary file of the software to be processed into an encoded image as one modality of the model's multimodal input, the model transforms from being unable to directly analyze discrete, low-semantic byte sequences into being able to directly process spatially consistent visual patterns. Furthermore, the encoded image effectively expresses the inherent structure of the binary file, enabling the model to extract rich and accurate visual features from it. Additionally, by using security detection-related textual information as another modality of the model's multimodal input, which contains high-level semantics, fusing textual and visual features generates more discriminative fused features. This results in higher detection accuracy, especially when dealing with new and variant malware.
[0014] The following description Figure 1 The execution method for each step is shown.
[0015] First, for step 100, obtain the binary file of the software to be processed, and obtain the text information related to security detection.
[0016] In this embodiment of the invention, to improve the accuracy of malware detection, multiple modalities can be input to provide heterogeneous data sources for subsequent analysis. The multiple modalities in this embodiment include at least data from the following two modalities: First modality: The binary file of the software to be processed; The second modality: text information related to security detection.
[0017] The two modes will be explained separately below.
[0018] For the first mode: the binary file of the software to be processed. The binary files of software contain unique, original, and crucial essential characteristics. By using these characteristics as modal inputs and transforming them into coded images in subsequent processes, the model can fully learn and understand the intrinsic nature of the software, thereby enabling more accurate classification of the software.
[0019] In one implementation, the binary file of the software to be processed can be read directly from the file system, network traffic capture, memory dump, sandbox runtime environment, or security intelligence sharing platform.
[0020] For the second modality: text information related to security detection In one embodiment of the present invention, the text information includes at least: contextual information describing the background and features of the software to be processed; The context information includes at least one of the following: Information regarding the family affiliation of known or suspected malware to the software in question; The historical detection records, behavior logs, or threat intelligence summaries of the software to be processed; Key summaries of static or dynamic analysis reports related to the software to be processed; Human annotations or descriptions of the risks of the software to be addressed, provided by upstream systems or analysts.
[0021] In this embodiment of the invention, the context is used to guide the model's detection decisions, enabling it to better adapt to different malware samples and new attack methods.
[0022] Text information can be obtained from the alarm context of the security operations platform, the threat intelligence database, or generated based on manually input instructions or upstream systems.
[0023] In this embodiment of the invention, binary files are used to provide low-level, structured, and objective empirical evidence, while textual information can provide high-level semantics, intent, and context. Using both as multimodal inputs can achieve complementarity of input information, thereby enabling the model to have higher recognition capabilities.
[0024] Then, steps 102 to 110 will be explained simultaneously.
[0025] Please refer to Figure 2 This is a schematic diagram of the structure of the malware detection model in an embodiment of the present invention. The malware detection model provides two input interfaces, which receive binary files and text information respectively; the malware detection model is a multimodal neural network, which internally includes at least the following functional units: an image encoding unit, an image processing unit, a text processing unit, a multimodal fusion unit, and a decoding unit.
[0026] The processing method for each unit is as follows: The image encoding unit is used to convert binary files into encoded images; The image processing unit is used to extract visual features from the coded image; The text processing unit is used to extract text features from text information; The multimodal fusion unit is used to fuse visual and textual features; The decoding unit is used to generate the final detection result based on the fused features.
[0027] The implementation methods of each unit are explained below.
[0028] 1. Image coding unit In this embodiment of the invention, the image encoding unit is used to convert unstructured binary files into an encoded image that retains the program's internal structural information and can be effectively processed by a neural network, thereby extracting visual features that are discriminative for malware detection.
[0029] In one implementation, the image encoding unit can image-encode a binary file to obtain an encoded image in the following manner: Step A1: Determine the total number of bytes in the binary file; Step A2: Based on the total number of bytes in the binary file, determine the appropriate line width to accommodate the binary file; Step A3: Use the adapted line width to perform image encoding on the binary file to obtain the encoded image of the binary file.
[0030] In this embodiment of the invention, since the binary files of different software are of different sizes, if a fixed line width image is used for encoding during the encoding process, all binary files will be forced to follow the same formatting standard, which will destroy the internal structural information of the binary files and cause structural distortion.
[0031] Based on this, by determining the appropriate line width, binary files from different software are encoded according to the corresponding appropriate line width, thereby ensuring that the spatial consistency of the original binary file structure can be maintained to the greatest extent in the encoded image.
[0032] In one implementation, the method for determining the line width to be adapted can include: A21: Determine the mapping relationship between binary bytes and image pixels; A22: Based on the mapping relationship and the total number of bytes in the binary file, determine the total number of pixels in the encoded image; A23: Determine the initial line width based on the total number of pixels and the target aspect ratio; A24: Adjust the initial line width based on the preset line width range so that the adjusted line width is within the preset line width range.
[0033] Step A21 may include at least the following two mapping relationships: The first mapping relationship is a single-channel 8-bit image, which encodes one byte (8 bits) into one pixel, with grayscale values ranging from 0 to 255. Therefore, the total number of pixels in the image is equal to the total number of bytes in the binary file, and the image size satisfies: width × height ≥ total number of bytes.
[0034] For example, binary byte 0x00 is mapped to a grayscale value of 0 for an image pixel, binary byte 0x01 is mapped to a grayscale value of 10 for an image pixel, binary byte 0x10 is mapped to a grayscale value of 20 for an image pixel, and binary byte 0x11 is mapped to a grayscale value of 30 for an image pixel.
[0035] The second mapping relationship is for multi-channel images. For three-channel RGB, three bytes can be encoded into one pixel; for four-channel RGBA, four bytes can be encoded into one pixel. Therefore, the total number of pixels in the image = ceil(total number of bytes / number of channels), where the number of channels = 3 / 4. The image size satisfies: width × height ≥ total number of pixels. The ceil function rounds up.
[0036] It should be noted that, in addition to the two mapping relationships mentioned above, other mapping relationships can also be included, such as encoding one byte into multiple pixels.
[0037] In one implementation, the preset line width ranges from 32 to 1024 bytes.
[0038] Assuming the target aspect ratio is W / H and the total number of pixels is N, the initial line width can be determined by W×H≥N. To avoid extreme imbalance or excessively large blank areas, in step A24, the line width can be adjusted to the preset line width range using the following formula: Fit line width = max(min(initial line width, maximum line width endpoint), minimum line width endpoint) This ensures that the line width is within the preset range and that the width and height of the image are as balanced as possible.
[0039] Furthermore, in order to preserve the structural information of the binary file, in one embodiment of the present invention, the image encoding of the binary file may include: Step A31: Determine the encoding method of structural information in the binary file; the structural information includes segment information and / or high-entropy regions; the encoding method of structural information is different from the encoding method of other information; Step A32: Encode the structural information into the image based on the encoding method.
[0040] In one embodiment of the present invention, segment information may include segment boundaries.
[0041] Segment boundaries refer to the physical separation points between different segments in a binary file, used to distinguish different parts of the binary file. In this embodiment of the invention, determining the segment boundaries of a binary file may include: determining multiple segments in the binary file, and determining the start boundary and end boundary of each segment.
[0042] Specifically, the starting and ending boundaries of each segment are determined as follows: the file format is parsed, the metadata is read using tools to obtain the starting address, effective size and alignment granularity, and then the starting boundary is determined based on the aligned starting address in the metadata. The starting address and effective size are aligned upwards to the alignment granularity to obtain the ending boundary.
[0043] Furthermore, the segment information also includes: segment type. Segment types can include: .text segment, .data segment, .bss segment, .rodata segment, .stack segment, and .heap segment.
[0044] In one implementation, the segment information is encoded as follows: Each segment occupies a different region in the coded image; Different segments are distinguished by pixel spacing or line spacing; and / or Different segment types are coded using different colors.
[0045] In this embodiment of the invention, when encoding a binary file into an image, segment boundaries and even segment types in the binary file are preserved, which enables the encoded image to more effectively express the internal structure of the binary file.
[0046] In this embodiment of the invention, a high-entropy region refers to a region in a file where byte data exhibits high randomness and complexity, such as encrypted or compressed data. These regions have a uniform byte distribution, making it difficult to infer subsequent bytes from past byte patterns; they are typically associated with specifically processed data. In this embodiment, the randomness and complexity of data within a region can be determined by calculating its entropy value. High-entropy regions have higher entropy values, while low-entropy regions (such as zero-padding or static data) have lower entropy values. High-entropy regions are generally carriers of malware, such as encrypted malicious code or compressed malicious payloads. Therefore, by identifying high-entropy regions in a binary file and preserving them as structural information in the encoded image, the subsequent neural network can more accurately capture the core hidden features of malware during training.
[0047] In one embodiment of the present invention, determining the high-entropy region of a binary file may include: using a sliding window to slide across the binary file, calculating the entropy value of the window region after each slide, and determining the window region whose entropy value exceeds the entropy threshold as the high-entropy region of the binary file.
[0048] In one implementation, the high-entropy region is encoded by setting the pixel positions of the encoded image corresponding to the byte range of the high-entropy region in the binary file as specific feature markers. These feature markers include specific colors and / or specific patterns.
[0049] It's understandable that because structural information needs to be encoded into the image, the total number of pixels in the image that can accommodate the binary file will change, and consequently, the line width will also change. When converting a binary file into an encoded image, the mapping relationship between binary bytes and image pixels, as well as the encoding method of structural information, can be used to encode the binary file into an image with an adapted line width, thus obtaining the encoded image of the binary file.
[0050] 2. Image Processing Unit In this embodiment of the invention, the image processing unit is used to extract visual features from the encoded image; the image processing module can be a convolutional neural network (CNN) or a visual transformer (ViT). Through multi-layer convolution and attention mechanisms, high-level visual features represented by multiple feature maps or tokens can be extracted from the encoded image. These features encode information such as the texture, shape, and spatial relationships of the image. At this point, the feature maps are two-dimensional. Further, the two-dimensional feature maps can be flattened or pooled to form a vector sequence of one-dimensional visual features for use by the subsequent multimodal fusion unit.
[0051] Because the encoded image retains structural information, the image processing module will pay attention to this structural information during the extraction of visual features.
[0052] 3. Text Processing Unit In this embodiment of the invention, a text processing unit is used to extract text features from text information. This text processing unit may include a word segmenter, a text encoder, and a feature pooler. The text encoder may be a BERT encoder, a RoBERTa encoder, or a Transformer encoder.
[0053] Specifically, a word segmenter can be used to segment the text information to obtain a word sequence composed of multiple tokens. By looking up a pre-trained word embedding table or using the model's built-in embedding layer, each token is transformed into a low-dimensional dense vector. The low-dimensional dense vector corresponding to the word segmentation sequence is input into a text encoder to generate a context-aware feature vector for each token through a self-attention mechanism. This feature vector contains the token's own semantics and the relationship information between the token and other tokens in the text. A feature pooler is used to pool the feature vectors of all tokens to obtain text features. These text features are used to express the global semantics of the entire text information.
[0054] 4. Multimodal fusion unit In this embodiment of the invention, the multimodal fusion unit is used to fuse visual features and text features to achieve complementarity and synergy between the two modal features, and to enable visual features to be guided and focused by text features.
[0055] Specifically, visual and textual features can first be projected and transformed to map them to the same feature space dimension. Then, a pre-defined fusion strategy is used to fuse the visual and textual features to obtain fused features. These fused features simultaneously contain visual evidence from the binary file-to-image conversion and semantic guidance from the textual information. The pre-defined fusion strategy can be feature-level concatenation fusion, cross-attention fusion, or decision-level fusion.
[0056] 5. Decoding Unit In this embodiment of the invention, the decoding unit is used to generate the final detection result based on the fused features. The decoding unit can be an autoregressive language model or a classifier. The detection result includes at least a classification result. This classification result can be binary, ternary, or fine-grained classification.
[0057] It should be noted that in the various units of the malware detection model, the image coding unit can be performed according to a preset coding rule, or it can be performed with other units based on the constraints of the loss function during model training.
[0058] To make the output detection results more complete, in addition to the classification results, the output detection results can also include: structured explanatory text and confidence scores; the structured explanatory text explains the model's detection decisions in structured text form, and is used to provide a human-readable reasoning process, which can include family tags, attack behaviors, threat indicators, etc.; among them, family tags are the specific family or variant to which the malware belongs; the detection confidence score is a quantitative measure of the model's confidence in its own predictions, reflecting the reliability of the predictions.
[0059] In one embodiment of the present invention, the recognition accuracy of the malware detection model can be guaranteed. The training method of the malware detection model is as follows: based on multiple samples, a policy network in a reinforcement learning model is used to generate multimodal actions for the input, and a composite reward value is calculated for the generated multimodal actions using pre-set sub-rewards; an advantage estimate is calculated based on the composite reward value, and an objective function of a proximal policy optimization algorithm is constructed using the advantage estimate; the parameters of the policy network are updated to maximize the objective function, and the iteratively optimized policy network is determined as the trained malware detection model; the sub-rewards include at least: a structural consistency reward for evaluating whether the generated structured explanatory text conforms to the set structural specifications, a key element hit reward for evaluating the key element matching degree, and a confidence calibration reward for calibrating the generated detection confidence to approximate the preset operational indicators.
[0060] The policy network is configured to receive the software's binary file and text information related to security detection, and output multimodal actions including classification results, structured explanatory text, and confidence scores.
[0061] In the policy optimization process based on advantage estimation, the reward signal of the policy network is a composite reward value obtained by weighting multiple sub-rewards. Each sub-reward is explained below.
[0062] First, structural consistency rewards In this embodiment of the invention, the structural consistency reward is used to evaluate whether the generated structured explanatory text conforms to the set structural specifications.
[0063] In one implementation, the structural consistency reward can at least be checked and established for field order and field integrity.
[0064] Specifically, the structural consistency reward is calculated as follows: the structured explanatory text generated by the policy network is compared with the target text, and an order consistency score is generated based on whether the field order is consistent. In addition, an integrity score is generated based on the coverage of all fields in the target text by the generated fields. The target text is the structured explanatory text in the real multimodal action output by the training sample. The structural consistency reward is calculated based on the consistency score and the integrity score.
[0065] Second, key element hit reward In this embodiment of the invention, the key element hit reward is used to evaluate the key element matching degree. In one implementation, the key elements include at least malware family tags and attack behaviors.
[0066] Specifically, the key element hit reward is calculated as follows: identify and extract malware family tags and attack behaviors contained in the structured explanatory text generated by the policy network; match the extraction results with real targets, and calculate the key element hit reward using the precision and recall of the matching.
[0067] Third, confidence calibration reward In this embodiment of the invention, the confidence calibration reward is used to calibrate the generated detection confidence level to approximate a preset operational metric. In one implementation, the operational metric includes the false positive rate (FPR) and the true positive rate (TPR).
[0068] The confidence calibration reward is calculated as follows: a target confidence threshold is determined based on preset operational indicators; and a confidence calibration reward is calculated based on the deviation between the generated detection confidence and the target confidence threshold.
[0069] In this embodiment of the invention, once the operational indicators are determined, the target confidence threshold can be determined using either a ranking search method or a PPO dynamic calibration method. Specifically, this can be achieved while ensuring... Under the premise of minimizing FPR, the confidence level that minimizes FPR is selected as the target confidence threshold.
[0070] After obtaining the structural consistency reward, key element hit reward, and confidence calibration reward, the composite reward value can be calculated using a weighted method.
[0071] In this embodiment of the invention, during the training process of the malware detection model, by introducing structural consistency rewards, key element hit rewards, and confidence calibration rewards, the malware detection model not only possesses high-precision classification capabilities but also provides clear and logically consistent explanations, thereby improving the model's interpretability. By linking operational metrics with the model training process, optimizations closely aligned with actual business needs are achieved. This linked optimization ensures the model's practical application effectiveness, thereby reducing false positives and false negatives and improving detection reliability. The introduction of reinforcement learning algorithms enables the model to adaptively adjust when facing different types of malware, improving the model's flexibility and adaptability, especially when handling new and unseen samples.
[0072] Furthermore, once the malware detection model is trained, this version of the malware detection model is released to achieve multimodal detection of the software to be processed.
[0073] Furthermore, after the malware detection model is released, it enters the inference phase.
[0074] In the inference phase, in order to reduce the false negative rate and false positive rate, after decoding the fused features using the decoding unit and before outputting the detection result, the following steps may be taken: calculating the energy score and interpretation sparsity of the software to be processed, using the energy score and interpretation sparsity to determine the decision type of the software to be processed, and performing corresponding processing according to the decision type of the software to be processed; the decision type includes trusted software, rejected software, and uncertain software.
[0075] If the software to be processed is trusted software, the detection result will be output directly. If the software to be processed is rejected software, then the rejected software is routed to the backup analysis process; If the software to be processed is uncertain, the model decision threshold is conditionally adjusted for the software based on its energy score and explained sparsity, and the software is re-evaluated using the adjusted decision threshold.
[0076] Specifically, the joint gating function can be used to calculate the function output value for energy fraction and interpreted sparsity, and the decision type of the software to be processed can be determined by comparing the function output value with the confidence threshold and the rejection threshold.
[0077] In one implementation, the joint gating function can be: in, For the function output value, For the gating weight parameters, It is a Sigmoid or equivalent monotonic mapping function. Energy fraction To explain sparsity.
[0078] If the function output value is greater than the trust threshold, the software to be processed is determined to be trustworthy software; if the function output value is less than the rejection threshold, the software to be processed is determined to be rejection software; if the function output value is greater than the rejection threshold but less than the trust threshold, the software to be processed is determined to be uncertain software. It can be understood that the rejection threshold is less than the trust threshold.
[0079] In one implementation, when conditionally adjusting the model decision threshold based on the energy score and interpretation sparsity of the software to be processed, the model decision threshold is a rejection threshold. The adjusted rejection threshold can then be calculated using the following formula: in, This is the adjusted rejection threshold. The original rejection threshold, This serves as a reference threshold for energy fraction and the explanation of sparsity. It is a monotonic nonlinear function. This is for adjusting the coefficient.
[0080] It should be noted that this conditional adjustment to the model decision threshold only applies to the re-evaluation process of the current sample and does not affect the judgment logic of other samples.
[0081] During the inference phase, time windows can be used to calculate the performance metrics of the malware detection model, and the model parameters can be updated when the performance metrics are found to be unsatisfactory.
[0082] When model parameters need to be updated, the model update phase begins. During the model update phase, dynamic context can be introduced to participate in the model update process.
[0083] Specifically, the model update method may include: Obtain the features from the previous iteration and the context of the current iteration; the features from the previous iteration are the features used by the malware detection model during the previous training process; Use the current context to filter out retained features from the features of the previous iteration; The malware detection model is trained in this round using the preserved features to obtain the updated malware detection model.
[0084] By using the current context to dynamically activate features from the previous iteration, the malware detection model can focus on retaining features most relevant to the current security environment during training updates, thereby improving its ability to detect new threats.
[0085] In one implementation, when selecting retained features from the previous iteration features using the current iteration context, the weight score of each feature in the previous iteration features can be determined based on the degree of correlation between each feature in the previous iteration features and the current iteration context. Features with weight scores exceeding a gating threshold are then retained. This degree of correlation can be determined by calculating similarity.
[0086] In summary, a system for multimodal malware detection can operate in a production environment for malware detection in the following manner: modeling phase, optimization phase, release phase, inference phase, and model update phase.
[0087] During the modeling phase, the system receives the binary file of the software to be processed, along with text information related to security detection. The image encoding unit converts the binary file into an encoded image that retains its binary structure. The image processing unit extracts visual features from the encoded image, and the text processing unit extracts text features from the text system. These features are then interacted with by the multimodal fusion unit to form fused features. Finally, the decoding unit outputs the detection result based on the fused features. This detection result includes at least a classification result; in addition, it may include structured explanatory text, confidence scores, etc.
[0088] In the optimization phase, in addition to monitoring losses, several sub-rewards are introduced. These sub-rewards include at least structural consistency rewards, key element hit rewards, and confidence calibration rewards, and are linked with the operational metric FPR@TPR to achieve strategy optimization.
[0089] During the release phase, the released malware detection model is versioned. Versioning management can include the model version number, decision threshold version number, and the samples (input data and detection results) used during the training of this version of the model.
[0090] During the inference phase, samples can be judged based on the energy score and explained sparsity in the output detection results. If a sample is rejected, it will be automatically routed to the backup analysis process, and its conclusion will be used as the reinjection sample. At the same time, the model performance is evaluated in a rolling manner using a time window, and the model parameters are updated when the model performance deteriorates.
[0091] During the model update phase, security context is used to guide the model's detection decisions, enabling it to better adapt to different malware samples and new attack methods.
[0092] Please refer to Figure 3This invention provides a multimodal malware detection device, which includes: The acquisition unit 300 is used to acquire the binary file of the software to be processed, and to acquire text information related to security detection. The input unit 302 is used to input the binary file and the text information into the trained malware detection model; the malware detection model includes an image encoding unit, an image processing unit, a text processing unit, a multimodal fusion unit, and a decoding unit; The malware detection model is used to perform the following operations on the input: The binary file is image-encoded using the image encoding unit to obtain an encoded image, and visual features are extracted from the encoded image using the image processing unit. The text processing unit is used to extract text features from the text information. The visual features and text features are fused using the multimodal fusion unit to obtain fused features; The fused features are decoded using the decoding unit to output detection results; the detection results include at least classification results.
[0093] In one embodiment of the present invention, the text information includes at least contextual information describing the background and features of the software to be processed; The context information includes at least one of the following: Information regarding the family affiliation of known or suspected malware to the software in question; The historical detection records, behavior logs, or threat intelligence summaries of the software to be processed; Key summaries of static or dynamic analysis reports related to the software to be processed; Human annotations or descriptions of the risks of the software to be addressed, provided by upstream systems or analysts.
[0094] In one embodiment of the present invention, the step of image encoding the binary file to obtain an encoded image includes: determining the total number of bytes in the binary file; determining an appropriate line width that can accommodate the binary file based on the total number of bytes in the binary file; and using the appropriate line width to perform image encoding on the binary file to obtain an encoded image of the binary file.
[0095] In one embodiment of the present invention, the image encoding of the binary file includes: determining the encoding method of structural information in the binary file; the structural information includes segment information and / or high-entropy regions; and encoding the structural information into an image based on the encoding method.
[0096] In one embodiment of the present invention, the detection result further includes: structured explanatory text and confidence level; The training method of the malware detection model is as follows: based on multiple samples, a policy network in a reinforcement learning model is used to generate multimodal actions for the input, and a composite reward value is calculated for the generated multimodal actions using pre-set sub-rewards; an advantage estimate is calculated based on the composite reward value, and an objective function of a proximal policy optimization algorithm is constructed using the advantage estimate; the parameters of the policy network are updated to maximize the objective function, and the iteratively optimized policy network is determined as the trained malware detection model; the sub-rewards include at least: a structural consistency reward for evaluating whether the generated structured explanatory text conforms to the set structural specifications, a key element hit reward for evaluating the key element matching degree, and a confidence calibration reward for calibrating the generated detection confidence to approximate the preset operational indicators.
[0097] In one embodiment of the present invention, after the malware detection model decodes the fused features using the decoding unit, before outputting the detection result, it is further configured to: calculate the energy score and interpretation sparsity of the software to be processed, determine the decision type of the software to be processed using the energy score and interpretation sparsity, and perform corresponding processing according to the decision type of the software to be processed; the decision type includes trusted software, rejected software, and uncertain software.
[0098] It should be noted that the multimodal malware detection device provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the multimodal malware detection device and the multimodal malware detection method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.
[0099] Embodiments of this application also provide a computer device, please refer to... Figure 4 The computer device includes a processor and a memory, the memory storing at least one instruction, at least one program, code set, or instruction set, the at least one instruction, at least one program, code set, or instruction set being loaded and executed by the processor to implement the multimodal malware detection method provided in the above-described method embodiments.
[0100] Embodiments of this application also provide a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the multimodal malware detection method provided in the above-described method embodiments.
[0101] Embodiments of this application also provide a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium and executes the computer program, causing the computer device to perform any of the multimodal malware detection methods described in the above embodiments.
[0102] For ease of description, the above systems or devices are described separately as various modules or units based on their functions. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware components.
[0103] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.
[0104] Finally, it should be noted that in this document, relational terms such as first, second, third, and fourth are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0105] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.
Claims
1. A method for detecting multimodal malware, characterized in that, The method includes: Obtain the binary file of the software to be processed, and obtain text information related to security detection; The binary file and the text information are input into the trained malware detection model; the malware detection model includes an image encoding unit, an image processing unit, a text processing unit, a multimodal fusion unit, and a decoding unit; The binary file is image-encoded using the image encoding unit to obtain an encoded image, and visual features are extracted from the encoded image using the image processing unit. The text processing unit is used to extract text features from the text information. The visual features and text features are fused using the multimodal fusion unit to obtain fused features; The fused features are decoded using the decoding unit to output detection results; the detection results include at least classification results.
2. The method according to claim 1, characterized in that, The text information includes at least contextual information describing the background and characteristics of the software to be processed; The context information includes at least one of the following: Information regarding the family affiliation of known or suspected malware to the software in question; The historical detection records, behavior logs, or threat intelligence summaries of the software to be processed; Key summaries of static or dynamic analysis reports related to the software to be processed; Human annotations or descriptions of the risks of the software to be addressed, provided by upstream systems or analysts.
3. The method according to claim 1, characterized in that, The process of encoding the binary file into an image to obtain an encoded image includes: Determine the total number of bytes in the binary file; Determine the appropriate line width to accommodate the binary file based on the total number of bytes in the binary file; The binary file is image encoded using the adapted line width to obtain the encoded image of the binary file.
4. The method according to claim 3, characterized in that, The image encoding of the binary file includes: Determine the encoding method of structural information in the binary file; the structural information includes segment information and / or high-entropy regions. The structural information is encoded into the image based on the aforementioned encoding method.
5. The method according to claim 1, characterized in that, The detection results also include: structured explanatory text and confidence level; The training method of the malware detection model is as follows: based on multiple samples, a policy network in a reinforcement learning model is used to generate multimodal actions for the input, and a composite reward value is calculated for the generated multimodal actions using pre-set sub-rewards; an advantage estimate is calculated based on the composite reward value, and an objective function of a proximal policy optimization algorithm is constructed using the advantage estimate; the parameters of the policy network are updated to maximize the objective function, and the iteratively optimized policy network is determined as the trained malware detection model; the sub-rewards include at least: a structural consistency reward for evaluating whether the generated structured explanatory text conforms to the set structural specifications, a key element hit reward for evaluating the key element matching degree, and a confidence calibration reward for calibrating the generated detection confidence to approximate the preset operational indicators.
6. The method according to any one of claims 1-5, characterized in that, After decoding the fused features using the decoding unit, and before outputting the detection result, the method further includes: The energy score and explained sparsity of the software to be processed are calculated. The decision type of the software to be processed is determined by the energy score and explained sparsity, and corresponding processing is performed according to the decision type of the software to be processed. The decision type includes trusted software, rejected software, and uncertain software.
7. A multimodal malware detection device, characterized in that, The device includes: The acquisition unit is used to acquire the binary file of the software to be processed, and to acquire text information related to security detection. An input unit is used to input the binary file and the text information into a trained malware detection model; the malware detection model includes an image encoding unit, an image processing unit, a text processing unit, a multimodal fusion unit, and a decoding unit; The malware detection model is used to perform the following operations on the input: The binary file is image-encoded using the image encoding unit to obtain an encoded image, and visual features are extracted from the encoded image using the image processing unit. The text processing unit is used to extract text features from the text information. The visual features and text features are fused using the multimodal fusion unit to obtain fused features; The fused features are decoded using the decoding unit to output detection results; the detection results include at least classification results.
8. A computer device, characterized in that, The computer device includes a memory and a processor. The memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the steps of the method according to any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in any one of claims 1-6.
10. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1-6.