Hybrid expert routing optimization method and device based on priori knowledge and load balancing

Abstract

The invention discloses a hybrid expert routing optimization method and device based on priori knowledge and load balancing, and belongs to the technical field of artificial intelligence. The method comprises the steps of obtaining target features and metadata of to-be-processed software; the target feature is obtained based on a coded image converted from a binary file of to-be-processed software; calculating a routing weight of each expert by using the target features and the metadata and adopting a priori knowledge perception mechanism, and generating a candidate expert set based on the routing weights; and based on the current load condition of each candidate expert in the candidate expert set, optimizing a routing weight, and performing expert routing on the target feature by using the optimized routing weight. According to the method, allocation of computing resources can be dynamically adjusted, loads among experts are ensured to be balanced, the malicious software detection capability is enhanced, and the overall computing efficiency can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, in particular to a hybrid expert routing optimization method and device based on prior knowledge and load balancing. BACKGROUND

[0002] In the field of malware detection, existing deep learning models, especially those based on hybrid expert (MoE) architecture, have made some progress. MoE models improve the expressiveness and efficiency of the model by introducing multiple experts and a gating network to determine which expert to activate. SUMMARY

[0003] The present application provides a hybrid expert routing optimization method and device based on prior knowledge and load balancing. The technical solution is as follows: On the one hand, a hybrid expert routing optimization method based on prior knowledge and load balancing is provided, which includes: Obtaining target features and metadata of the software to be processed; the target features are obtained based on the encoded images converted from the binary files of the software to be processed; Using the target features and the metadata, calculating the routing weight of each expert using a prior knowledge perception mechanism, and generating a candidate expert set based on the routing weight; Based on the current load of each candidate expert in the candidate expert set, optimizing the routing weight, and using the optimized routing weight to perform expert routing on the target features.

[0004] On the other hand, a hybrid expert routing optimization device based on prior knowledge and load balancing is provided, which includes: An acquisition unit for acquiring target features and metadata of the software to be processed; the target features are obtained based on the encoded images converted from the binary files of the software to be processed; A processing unit for calculating the routing weight of each expert using a prior knowledge perception mechanism based on the target features and the metadata, and generating a candidate expert set based on the routing weight; An optimization unit for optimizing the routing weight based on the current load of each candidate expert in the candidate expert set, and using the optimized routing weight to perform expert routing on the target features.

[0005] On the other hand, a computer device is provided, which includes a memory and a processor, the memory is used to store computer programs, and the processor is used to execute the computer programs stored on the memory to realize the steps of the hybrid expert routing optimization method based on prior knowledge and load balancing.

[0006] In another aspect, a computer readable storage medium is provided, and the storage medium has stored therein a computer program, which, when executed by a processor, implements the steps of the hybrid expert routing optimization method based on prior knowledge and load balancing.

[0007] In another aspect, a computer program product is provided, and the computer program product comprises a computer program, which, when executed by a processor, implements the steps of the hybrid expert routing optimization method based on prior knowledge and load balancing.

[0008] The technical solution provided by the present application can bring at least the following beneficial effects: By introducing prior knowledge to guide routing to combine target features to realize the first round of expert screening, and then optimizing routing weights based on expert load conditions to realize the second round of expert screening, the target features are routed using the optimized routing weights, so that the allocation of computing resources can be dynamically adjusted, the load balance between experts is ensured, the malware detection capability is enhanced, and the overall computing efficiency is improved. BRIEF DESCRIPTION OF DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings described below are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0010] Figure 1 is a hybrid expert routing optimization method flow chart based on prior knowledge and load balancing provided by an embodiment of the present application; Figure 2 is a hybrid expert routing optimization device structure diagram based on prior knowledge and load balancing provided by an embodiment of the present application; Figure 3 is a hardware architecture diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0011] In order to make the purpose, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0012] Please refer to Figure 1The embodiment of the present application provides a hybrid expert routing optimization method based on prior knowledge and load balancing, and the method comprises the following steps: In step 100, the target feature and the metadata of the software to be processed are acquired; the target feature is acquired based on the encoded image obtained by converting the binary file of the software to be processed; In step 102, the routing weight of each expert is calculated by using the target feature and the metadata and a prior knowledge perception mechanism, and a candidate expert set is generated based on the routing weight; In step 104, the routing weight is optimized based on the current load condition of each candidate expert in the candidate expert set, and the target feature is routed to the expert by using the optimized routing weight.

[0013] In the embodiment of the present application, the first round of expert screening is realized by introducing prior knowledge to guide routing and combining the target feature, then the second round of expert screening is realized by optimizing the routing weight based on the load condition of the expert, and the target feature is routed to the expert by using the optimized routing weight, so that the allocation of the computing resource can be dynamically adjusted, the load balance between the experts is ensured, the malware detection capability is enhanced, and the overall computing efficiency is improved.

[0014] The execution mode of each step is described below. Figure 1

[0015] Firstly, in step 100, the target feature and the metadata of the software to be processed are acquired.

[0016] The application scenario of the embodiment of the present application is that the malware detection system is used to detect the software to be processed, so as to identify whether the software to be processed is malware. The object to be identified is the binary file of the software to be processed, and the byte sequence of the binary file contains the essential features of the software. By identifying these essential features in the binary file, the software can be more accurately identified as malware or normal software.

[0017] Considering that the byte sequence cannot be used for neural network training and malware identification. In order to be able to train and identify these essential features, in the embodiment of the present application, the binary file is encoded into an image, so that the byte sequence is converted into an image evidence. Since the encoded image contains the content of the byte sequence and the encoded image can be used for neural network training and malware detection, the binary file is image encoded, and then the neural network training and malware detection are performed by using the image encoding.

[0018] ​After the binary file is converted into an encoded image, the encoded image is input into the malware detection system, the target feature is obtained based on the encoded image by the malware detection system, and then the target feature is routed to a more suitable expert for processing to output a detection result. The detection result can include a maliciousness classification; in addition, it can also include at least one of a family label, a structured explanation text, a confidence and an energy-type uncertainty. The maliciousness classification can be a binary classification, a ternary classification or a fine-grained classification; the family label is a specific family or variant to which the malware belongs; the structured explanation text is a structured text form to explain the detection decision of the model, which is used to provide a human-readable reasoning process; the confidence is a degree of confidence of the model to its own prediction, reflecting the reliability of the prediction; and the energy-type uncertainty is an uncertainty measurement based on an energy model, and a high energy value indicates high uncertainty.

[0019] The target feature and the metadata of the software to be processed in this step are described below.

[0020] First, the acquisition method of the target feature of the software to be processed is described.

[0021] In an embodiment of the present application, the visual feature of the encoded image can be directly used as the target feature. Therefore, the acquisition method of the target feature can be: Step 1000, converting a binary file of software to be processed into an encoded image, and retaining structural information of the binary file during the conversion; the structural information includes byte information and a high-entropy region.

[0022] The structure of the binary file usually includes multiple different parts, such as code segments, data segments, etc. Each part is called a segment. The position and content of the segment in the binary file are crucial for the identification of malware. In an embodiment of the present application, by retaining the segment information and optimizing it in the attention mechanism, the malware detection system can better understand the structural features of the binary file.

[0023] In an implementation, the segment information includes a segment boundary. The segment boundary refers to a physical separation point between different segments in the binary file, which is used to distinguish different parts of the binary file.

[0024] In another implementation, the segment information further includes a segment type. The segment type can include a.text segment, a.data segment, a.bss segment, a.rodata segment, a.stack segment and a.heap segment.

[0025] The high-entropy region usually contains complex or random content, which is usually related to malicious behavior. In an embodiment of the present application, the attention mechanism is optimized by extracting the entropy feature, so as to accurately identify the key part of the malicious file.

[0026] In one embodiment of the present invention, the method for determining high-entropy regions in a binary file may include: sliding a window across the binary file, calculating the entropy value of the window region after each slide, and determining the window region whose entropy value exceeds an entropy threshold as a high-entropy region of the binary file. The entropy value can be determined by calculating the byte probability distribution.

[0027] In this step, in order to convert the binary file into an encoded image so that the encoded image retains the structural information of the binary file, the encoding process may include: encoding the byte sequence in the binary file into the image according to the encoding method of the structural information and the mapping relationship between binary bytes and image pixels, so that the encoded image retains the structural information of the binary file.

[0028] In one implementation, the encoding method for structural information may include: The segment information is encoded in at least one of the following ways: Each segment occupies a different region in the coded image; Different segments are distinguished using pixel or line spacing; and, Different segment types are coded using different colors.

[0029] Encoding high-entropy regions can be achieved by setting the pixel positions of the encoded image corresponding to the byte range of the high-entropy region in the binary file as specific feature markers. These feature markers include specific colors and / or specific patterns. This allows the neural network to focus more intently on these high-entropy regions during training, improving the accuracy of malware detection.

[0030] In this embodiment of the invention, the mapping relationship between binary bytes and image pixels can include single-channel mapping and multi-channel mapping. Single-channel mapping encodes one byte into one pixel; multi-channel mapping encodes multiple bytes (three bytes for RGB channels and four bytes for RGBA channels) into one pixel.

[0031] Furthermore, to ensure the structural fidelity of the binary file content, in one embodiment of the present invention, the line width of the encoded image corresponding to different binary files is adaptively obtained based on the size and structure of the binary files. The line width of the encoded image is the minimum value that can carry the binary file, and the line width is within a preset line width range. Additionally, the size of the encoded image satisfies a preset aspect ratio. This avoids the loss of important information caused by a fixed line width.

[0032] Step 1002: Use the image processing module to extract visual features from the encoded image, and determine the target features based on the extracted visual features.

[0033] In the embodiment of the present application, the image processing module can be a convolutional neural network (CNN) or a visual Transformer (ViT), and the image processing module can extract visual features from the encoded image. Since the structural information is retained in the encoded image, the image processing module will focus on these structural information during the extraction of visual features.

[0034] In another embodiment of the present application, in order to make the malware detection system have higher recognition accuracy, a security context can also be introduced to fuse the text features of the security context with the visual features to enrich the security context as the target feature. On the basis of the above steps 1000-1002, the acquisition method of the target feature can also include: acquiring a security context and extracting text features from the security context; fusing the visual features and the text features, and determining the fused features as the target feature.

[0035] The security context at least includes one or more of the following: threat intelligence summary, recent detection results, malware-related family features, and malware-related historical information; the threat intelligence summary can include known features, attack organizations, industry trends, etc.; the recent detection results can include alerts, associated data, sandbox analysis, etc.; the family features can include behaviors, codes, structures, etc.; and the historical information can include infection, disposal, and propagation information, etc.

[0036] In the embodiment of the present application, by introducing the security context, the detection decision of the malware detection system can be guided, so that it can better adapt to different malware samples and new attack methods.

[0037] The above completes the description of the acquisition method of the target feature, and the metadata of the software to be processed will be described below.

[0038] In the embodiment of the present application, the metadata at least includes one of the following: family features, behavior features, and attack features.

[0039] The family features usually include static features such as file hash, code structure, string, import function, section information, etc., which can be extracted from the binary file.

[0040] The behavior features are obtained through dynamic analysis (sandbox running), such as API call sequence, file operation, registry operation, network activity, etc.

[0041] The attack features can include exploit techniques and evasion techniques, which can be extracted from static features and dynamic features, such as code patterns of specific exploits, anti-debugging techniques, etc.

[0042] Since the process of obtaining the behavior characteristics by dynamically analyzing the software in actual deployment is time-consuming, the metadata can preferentially select the family characteristics and attack characteristics extracted by static analysis.

[0043] In this way, the metadata of the binary file can be obtained.

[0044] Then, for step 102, the routing weight of each expert is calculated by using the target characteristics and the metadata and a priori knowledge perception mechanism, and a candidate expert set is generated based on the routing weight.

[0045] In order to realize routing guided by prior knowledge, an embodiment of the present application can further include: a prior knowledge base is pre-established, and the prior knowledge base stores family characteristics, behavior characteristics and attack characteristics of different malware; and each expert is associated with specific prior knowledge. That is, each expert has the most proficient family characteristics, behavior characteristics and attack characteristics. For example, expert A is proficient in ransomware family and specializes in file encryption behavior and RSA encryption attack characteristics. Expert B is proficient in processing trojans.

[0046] Then, the routing weight of each expert is calculated by using the target characteristics and the metadata and a priori knowledge perception mechanism, and a candidate expert set is generated based on the routing weight. Step 1020, determining the first matching degree of the software to be processed and each expert according to the metadata and the specific prior knowledge associated with each expert; In the embodiment of the present application, when the metadata includes family characteristics, behavior characteristics and attack characteristics, this step can specifically include: A0, assigning a corresponding first score to the expert based on whether the family characteristics in the metadata are included in the specific prior knowledge associated with the expert; A2, assigning a corresponding second score to the expert based on the similarity between the behavior characteristics in the specific prior knowledge associated with the expert and the behavior characteristics in the metadata; A4, assigning a corresponding third score to the expert based on the similarity between the attack characteristics in the specific prior knowledge associated with the expert and the attack characteristics in the metadata; A4, determining the first matching degree of the software to be processed and each expert by using the first score, the second score and the third score.

[0047] In step A0, if the expert is associated with specific prior knowledge having the family characteristics in the metadata, the expert is assigned a higher score. In step A2, if the expert is associated with specific prior knowledge having a higher similarity to the behavior characteristics in the metadata, the expert is assigned a higher score. In step A4, if the expert is associated with specific prior knowledge having a higher similarity to the attack characteristics in the metadata, the expert is assigned a higher score.

[0048] In one implementation, in step A4, the first matching degree P1 can be determined by the following calculation formula: P1=α×T1+β×T2+γ×T3 Wherein, T1, T2, T3 are respectively the first score, the second score and the third score after normalization processing, and α, β, γ are respectively learnable parameters.

[0049] Step 1022, based on the similarity between the target characteristics and the feature vector corresponding to each expert, determine the second matching degree between the software to be processed and each expert; In the embodiment of the application, in the mixed expert architecture, each expert has a feature vector, and the feature vector represents the malware family, behavior pattern or attack characteristics that the expert is good at. The feature vector of the expert can be obtained in at least the following ways: Firstly, based on the statistical characteristics of the expert training data: by collecting the features of the samples processed by each expert during the training process, the statistical quantities of these features are calculated, and the statistical quantities are taken as the feature vector of the expert.

[0050] Secondly, based on the expert model parameters: the weights of the first layer or the weights of all layers of the neural network corresponding to the expert are extracted, and the weights obtained by combining the weights in a set combination manner are taken as the feature vector of the expert.

[0051] Thirdly, based on the performance characteristics of the expert: the performance of the expert in different families and different behavior patterns is used to construct the feature vector. For example, if the detection accuracy of the expert in family A is high, the expert will have a higher weight in the characteristics related to family A.

[0052] Fourthly, based on learning: in the training process, each expert has a corresponding feature vector, and interacts with the sample feature vector through a routing mechanism. Through end-to-end training, the feature vectors are optimized so that the expert feature vector can better represent its expertise.

[0053] In this way, the similarity between the target characteristics and the feature vector of the expert is calculated, and the second matching degree can be obtained.

[0054] It should be noted that the similarity of the present step and the similarity in step 1020 can be calculated using cosine similarity or dot product. Both calculation methods can effectively calculate the similarity of the target feature and the feature vector of the expert. The higher the similarity, the stronger the matching degree of the software to be processed and the expert.

[0055] Step 1024, according to the first matching degree and the second matching degree, determining the comprehensive matching degree of the software to be processed and each expert, and taking the comprehensive matching degree as the routing weight of the corresponding expert.

[0056] The comprehensive matching degree Q can be calculated by the following calculation formula: Q=r1×P1+r2×P2 Wherein, P2 is the second matching degree, and r1, r2 are learnable parameters.

[0057] In the embodiment of the application, after obtaining the routing weight of each expert, a number of experts with the largest routing weight can be selected to generate a candidate expert set, so as to complete the first round of expert screening.

[0058] Further, in order to improve the calculation accuracy of the expert routing weight, when calculating the first matching degree by using the target feature and the specific prior knowledge associated with each expert, the target feature can further include: refined features based on dynamic security context, reconstructed features based on Token score, in addition to the above-mentioned visual features.

[0059] In one implementation, the refined features based on dynamic security context are obtained in the following manner: Obtain the last iteration feature and the security context of the current stage; the last iteration feature is the feature used by the malware detection model in the last round of training process; According to the correlation degree of each feature in the last iteration feature and the security context, determine the weight score of each feature in the last iteration feature, and retain the features with weight scores greater than the gating threshold as refined features.

[0060] Since the malware and attack strategies are also changing in the use process of the malware detection model, in order to enable the malware detection model to cope with these changes, when selecting experts, new security contexts are introduced to guide feature selection, so that the features with higher correlation with the new security context are retained in the last iteration feature. Thus, when selecting experts, the features most related to the current security environment can be used for calculation, and the finally selected experts can also perform malware detection based on the refined features, thereby improving the accuracy of the detection results.

[0061] In one implementation, the reconstructed features based on Token score are obtained in the following manner: The importance score of each Token in the software binary file is scored based on the text feature and the visual feature of the Token, and the attention weight of the K Tokens with the highest scores is calculated. The K Tokens with the highest scores are weighted and fused based on the attention weight to obtain an attention feature. The attention feature and a pooling feature are reconstructed to obtain a reconstructed feature, wherein the pooling feature is obtained by pooling and fusing the features of the remaining Tokens.

[0062] The text feature of the Token can be extracted by using a BERT model, and the visual feature of the Token is obtained by using the visual feature of the encoding region in the encoding image to which the Token is mapped as the visual feature of the Token. When scoring the importance of the Token, the text feature score and the visual feature score of multiple Tokens can be used for calculation.

[0063] In the process of encoding the binary file into an image, the Token is a block with a specific semantic in the binary file. These Tokens represent the key information in the binary file. Therefore, by scoring the importance of the Token, the semantic part important for subsequent tasks (such as malware detection) can be identified. In addition, in the encoding process, each Token is mapped to a region in the image. Therefore, the importance of the Token directly corresponds to the importance of some regions in the image, and the important Tokens can be selected to guide the attention mechanism to focus on the important visual features in the image.

[0064] By sparsely selecting the K Tokens with the highest scores for weighted fusion of features, and pooling and fusing the features of the remaining Tokens at low cost, the attention calculation of irrelevant Tokens can be reduced, and the computational and memory overheads can be greatly reduced. In addition, by using the dynamic reconstruction mechanism, the important information can be ensured to be retained, and the accuracy of the detection result can be ensured while reducing the computational complexity.

[0065] Finally, for step 104, the routing weight is optimized based on the current load condition of each candidate expert in the candidate expert set, and the target feature is routed to the experts using the optimized routing weight.

[0066] Considering that different candidate experts have different load conditions, if the target feature is directly routed to the expert with the maximum routing weight, the processing speed may be slow due to the large load of the expert, thereby affecting the identification efficiency of the malware. Therefore, the routing weight needs to be optimized based on the current load condition of each candidate expert to ensure that the identification accuracy and the identification efficiency coexist.

[0067] In an embodiment of the application, the step can specifically include steps 1040-1042: Step 1040, based on the current load condition of each candidate expert in the candidate expert set, a load adjustment factor of each candidate expert is calculated; In the embodiment of the application, the current load condition can be quantified as a load indicator L_i, such as between 0 and 1, 0 indicating idle and 1 indicating overload.

[0068] When calculating the load adjustment factor of each candidate expert, the calculation function needs to meet: When the load is 0, the load adjustment factor should be greater than 1 (encourage allocation) or equal to 1 (no effect); When the load is 1, the load adjustment factor should be less than 1 (suppress allocation), or even close to 0; The load adjustment factor should be monotonically decreasing with the load.

[0069] In one implementation, the load adjustment factor S_i is adjusted by: S_i=exp(-λ×Li) Where λ is a load sensitivity coefficient, used to control the degree of influence of load on the adjustment factor.

[0070] In addition, the calculation function can also be a linear function, a threshold-based adjustment function, etc.

[0071] Step 1042, using the load adjustment factor of each candidate expert, the routing weight is adjusted and optimized.

[0072] In one implementation, the product of the load adjustment factor and the routing weight can be used as the adjusted routing weight.

[0073] In addition, other adjustment and optimization methods can also be used, such as using addition method.

[0074] Based on the adjusted and optimized routing weight, the target feature is routed to the expert with the maximum routing weight, and the target feature is analyzed and recognized by the expert to output the recognition result.

[0075] In the embodiment of the application, by introducing prior knowledge guided routing and double-wheel load feedback mechanism, the allocation of computing resources is dynamically adjusted, and the load balance between experts is ensured, thereby improving the overall computing efficiency. Further, through accurate expert routing and load balancing, the system can route malware samples to the most suitable expert, thereby improving the accuracy of malware detection. At the same time, due to the optimization of computing overhead, the system can maintain high efficiency during inference, meeting the needs of real-time detection tasks. And through the load balancing between experts, the application effectively avoids the problems of computing bottleneck and excessive load, improves the stability and fault tolerance of the system, and ensures long-term stable malware detection service.

[0076] Reference is made to Figure 2 The embodiment of the present application provides a hybrid expert routing optimization device based on prior knowledge and load balancing, which comprises: The acquisition unit 200 is used for acquiring target features and metadata of a software to be processed, wherein the target features are acquired based on an encoded image converted from a binary file of the software to be processed; The processing unit 202 is used for calculating routing weights of each expert by using the target features and the metadata and adopting a prior knowledge perception mechanism, and generating a candidate expert set based on the routing weights; The optimization unit 204 is used for optimizing the routing weights based on current load conditions of each candidate expert in the candidate expert set, and performing expert routing on the target features by using the optimized routing weights.

[0077] In an embodiment of the present application, the metadata at least comprises one of the following: family features, behavior features and attack features; Further comprising: a prior knowledge base is pre-established, wherein the prior knowledge base stores family features, behavior features and attack features of different malicious softwares; and each expert is associated with specific prior knowledge; When the processing unit performs the step of calculating the routing weights of each expert by using the target features and the metadata and adopting the prior knowledge perception mechanism, the step specifically comprises: determining a first matching degree of the software to be processed and each expert according to the metadata and the specific prior knowledge associated with each expert; determining a second matching degree of the software to be processed and each expert based on a similarity between the target features and a feature vector corresponding to each expert; and determining a comprehensive matching degree of the software to be processed and each expert according to the first matching degree and the second matching degree, and taking the comprehensive matching degree as the routing weight of the corresponding expert.

[0078] In an embodiment of the present application, when the metadata comprises the family features, the behavior features and the attack features, the processing unit, when performing the step of determining the first matching degree of the software to be processed and each expert according to the metadata and the specific prior knowledge associated with each expert, specifically comprises: assigning a corresponding first score to the expert based on whether the specific prior knowledge associated with the expert has the family features in the metadata; assigning a corresponding second score to the expert based on a similarity between the behavior features in the specific prior knowledge associated with the expert and the behavior features in the metadata; assigning a corresponding third score to the expert based on a similarity between the attack features in the specific prior knowledge associated with the expert and the attack features in the metadata; and determining the first matching degree of the software to be processed and each expert by using the first score, the second score and the third score.

[0079] In an embodiment of the present application, the target feature is obtained by converting a binary file of the software to be processed into an encoded image, and the structure information of the binary file is preserved during the conversion; the structure information includes byte information and high-entropy regions; the image processing module is used to extract visual features from the encoded image, and the target feature is determined based on the extracted visual features.

[0080] In an embodiment of the present application, the target feature is determined based on the extracted visual features, including: obtaining a security context, and extracting text features from the security context; the visual features and the text features are fused, and the fused features are determined as the target feature.

[0081] In an embodiment of the present application, the optimization unit is specifically configured to: calculate a load adjustment factor of each candidate expert based on the current load condition of each candidate expert in the candidate expert set; and adjust and optimize the routing weight by using the load adjustment factor of each candidate expert.

[0082] It should be noted that the hybrid expert routing optimization device based on prior knowledge and load balancing provided in the above embodiments is only used as an example for the division of the above functional modules, and in actual applications, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the hybrid expert routing optimization device based on prior knowledge and load balancing provided in the above embodiments and the hybrid expert routing optimization method based on prior knowledge and load balancing belong to the same concept, and the specific implementation process is described in the method embodiments, which will not be repeated here.

[0083] Embodiments of the present application also provide a computer device, which refers to Figure 3 The computer device includes a processor and a memory, and the memory stores at least one instruction, at least one program, a code set or an instruction set, which is loaded and executed by the processor to implement the hybrid expert routing optimization method based on prior knowledge and load balancing provided by each method embodiment.

[0084] Embodiments of the present application also provide a computer readable storage medium, which stores at least one instruction, at least one program, a code set or an instruction set, which is loaded and executed by the processor to implement the hybrid expert routing optimization method based on prior knowledge and load balancing provided by each method embodiment.

[0085] The embodiment of the present application further provides a computer program product, which comprises a computer program, and a processor of a computer device reads the computer program from a computer readable storage medium, and the processor executes the computer program, so that the computer device executes the prior knowledge and load balancing based hybrid expert routing optimization method in any of the above described embodiments.

[0086] For the convenience of description, the above system or device is described in various modules or units in terms of functions. Of course, the functions of each unit can be implemented in the same or multiple software and / or hardware in the implementation of the present application.

[0087] From the above description of the embodiments, those skilled in the art can clearly understand that the present application can be implemented by means of software and the necessary general hardware platform. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in various embodiments or some parts of the embodiments of the present application.

[0088] Finally, it should be noted that in this document, relational terms such as first and second and third and fourth, and the like can only be used to distinguish one entity or action from another entity or action, without necessarily requiring or implying any such actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0089] The above description is only the preferred embodiments of the present application, and it should be pointed out that for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be regarded as the protection scope of the present application.

Claims

1. A hybrid expert routing optimization method based on prior knowledge and load balancing, characterized in that, The method includes: The target features and their metadata of the software to be processed are obtained; the target features are obtained based on the encoded image after the binary file of the software to be processed is converted. Using the target features and the metadata, a prior knowledge awareness mechanism is employed to calculate the routing weight of each expert, and a candidate expert set is generated based on the routing weight. Based on the current load of each candidate expert in the candidate expert set, the routing weights are optimized, and the optimized routing weights are used to perform expert routing for the target features.

2. The method according to claim 1, characterized in that, The metadata includes at least one of the following: family characteristics, behavioral characteristics, and attack characteristics; It also includes: a pre-established prior knowledge base, which stores the family characteristics, behavioral characteristics, and attack characteristics of different malware; each expert is associated with specific prior knowledge; The step of calculating the routing weight of each expert using the target features and the metadata, employing a prior knowledge awareness mechanism, includes: Based on the metadata and the specific prior knowledge associated with each expert, the first matching degree between the software to be processed and each expert is determined; Based on the similarity between the target features and the feature vectors corresponding to each expert, the second matching degree between the software to be processed and each expert is determined; Based on the first matching degree and the second matching degree, the comprehensive matching degree between the software to be processed and each expert is determined, and the comprehensive matching degree is used as the routing weight of the corresponding expert.

3. The method according to claim 2, characterized in that, When the metadata includes family characteristics, behavioral characteristics, and attack characteristics, determining the first matching degree between the software to be processed and each expert based on the specific prior knowledge associated with the metadata includes: Based on whether the specific prior knowledge associated with the expert possesses the family characteristics in the metadata, a corresponding first score is assigned to the expert. Based on the similarity between the behavioral features in the specific prior knowledge associated with the expert and the behavioral features in the metadata, a corresponding second score is assigned to the expert. Based on the similarity between the attack features in the specific prior knowledge associated with the expert and the attack features in the metadata, a corresponding third score is assigned to the expert. The first matching degree between the software to be processed and each expert is determined using the first score, the second score, and the third score.

4. The method according to claim 1, characterized in that, The target features are obtained in the following way: The binary file of the software to be processed is converted into an encoded image, and the structural information of the binary file is preserved during the conversion process; the structural information includes byte information and high-entropy regions; The image processing module is used to extract visual features from the coded image, and the target features are determined based on the extracted visual features.

5. The method according to claim 4, characterized in that, The determination of target features based on extracted visual features includes: Obtain the security context and extract text features from it; Visual features and text features are fused, and the fused features are determined as the target features.

6. The method according to any one of claims 1-5, characterized in that, The optimization of routing weights based on the current load status of each candidate expert in the candidate expert set includes: Based on the current load status of each candidate expert in the candidate expert set, calculate the load adjustment factor for each candidate expert; The routing weights are adjusted and optimized using the load adjustment factor of each candidate expert.

7. A hybrid expert routing optimization device based on prior knowledge and load balancing, characterized in that, The device includes: The acquisition unit is used to acquire the target features and metadata of the software to be processed; the target features are acquired based on the encoded image after the binary file of the software to be processed is converted. The processing unit is used to calculate the routing weight of each expert using the target features and the metadata, employing a prior knowledge awareness mechanism, and to generate a candidate expert set based on the routing weights. The optimization unit is used to optimize the routing weights based on the current load of each candidate expert in the candidate expert set, and to perform expert routing for the target feature using the optimized routing weights.

8. A computer device, characterized in that, The computer device includes a memory and a processor. The memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the steps of the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1-6.

Images