Malicious software family classification method based on entropy graph visualization

Abstract

The invention relates to a malicious software family classification method based on an entropy graph, which performs entropy graph conversion on malicious software samples and classifies the entropy graph by using a deep learning model so as to realize accurate classification of malicious software families. The method is mainly applied to malicious software detection and classification in the field of network security, and the core of the method is to convert malicious software samples into entropy graphs and classify the entropy graphs through a convolutional neural network (CNN). The working process of the method comprises the following steps: extracting entropy value features from input malicious software original hexadecimal data, and generating an entropy graph as the input of a feature extractor; a convolutional neural network model in a feature extractor carries out feature extraction on the generated entropy graph, and the output of a global average pool layer is used as an extracted feature vector; a random forest classifier is selected as a classifier, the extracted feature vectors serve as input, and a final classification result is obtained. The method provides a new solution thought for malicious software family classification.

Description

Technical Field

[0001] This invention belongs to the field of network security and malware detection, specifically relating to a malware family classification method based on entropy maps and convolutional neural networks. This method utilizes the entropy features of malware samples, through image processing and deep learning models, to achieve accurate classification of different malware families. Background Technology

[0002] Since the dawn of computers, malware has been rampant. Initially, it primarily took the form of simple viruses, Trojans, backdoors, and worms. With the advent of the internet age and the rise of various online games and communication applications, Trojans targeting personal computers and remote control backdoors became widespread. As nations and enterprises accumulated critical data, hackers shifted their targets to large corporations and institutions, leading to targeted APT attacks against these organizations. To protect network assets, security researchers have proposed various measures to detect malware attacks, but malware types continue to evolve with operating systems and platforms. In the current internet environment, the number of malware programs is growing at an unprecedented rate, posing a significant challenge to cybersecurity. Most malware is not entirely recreated but rather modified and mutated from existing malware, potentially forming families with shared characteristics and behavioral patterns. Effective family classification of malware not only deepens our understanding of its behavioral patterns and propagation mechanisms but also significantly improves the efficiency of malware analysis, providing crucial support for security defense and threat attribution. Malware developers typically don't write new malicious code from scratch; instead, they evade security detection by modifying and redeveloping existing malware. This practice leads to newly emerging malware exhibiting a high degree of similarity in code structure and behavior patterns to existing malware, thus allowing them to be categorized into the same "family." As the commercialization of malware becomes increasingly prevalent, the similarities between malware families have further intensified. This trend of familialization not only reflects the standardization of malware development but also signifies that effective classification of malware families is more important than ever before.

[0003] Currently, image-based visualization analysis methods are being applied in malware analysis, as they can better represent the behavior and characteristics of malware. However, traditional visualization methods have significant limitations. Most methods use grayscale image features, which are relatively simplistic and prone to losing some information. A single feature extraction approach struggles to capture the inherent complexity and diversity of malware, leading to the loss of crucial information and consequently affecting the accuracy and robustness of classification models.

[0004] As malware technology continues to evolve, traditional feature extraction methods are becoming increasingly difficult to adapt to new changes, and there is an urgent need to develop new methods that are more efficient and can extract richer features. Summary of the Invention

[0005] "A Malware Family Classification Method Based on Entropy Map Visualization" is an invention proposed to address the imperfections of current malware visualization technology. The goal of the invention is to solve the problems of low classification accuracy and efficiency in existing malware family classification technologies.

[0006] This invention innovatively proposes a malware family classification method based on entropy maps. By transforming malware samples into entropy maps and utilizing a deep learning model to classify these entropy maps, accurate classification of malware families can be achieved. The invention mainly consists of the following parts: Firstly, the binary files of malware samples are preprocessed to generate entropy maps representing their characteristics. The binary files are divided into blocks, the entropy value of each block is calculated, and the entropy value is mapped to an entropy value image, thus obtaining the sample's entropy map. This entropy map can fully reflect the internal structure and distribution characteristics of malware samples. Secondly, a convolutional neural network (CNN) model is constructed to train and classify the generated entropy maps. Specifically, a training set is constructed using entropy maps of labeled malware samples, and the classification accuracy is improved by adjusting the model parameters. The trained CNN model can classify and predict the malware family to which new malware samples belong.

[0007] To implement this malware family classification method, this invention utilizes structural entropy as the core basis for malware visualization, converting the binary files of malware into entropy maps, thus providing a data format that can be directly input for training machine learning algorithms. The entire technical framework consists of three parts: an entropy map generator, a feature extractor, and a classifier. The entropy map generator extracts entropy features from the input raw hexadecimal data of the malware and generates an entropy map, which serves as the input to the feature extractor. The convolutional neural network model in the feature extractor extracts features from the generated entropy map, using the output of the global average pooling layer as the extracted feature vector. The classifier selects a random forest classifier, using the extracted feature vector as input to perform the malware family classification task, ultimately yielding the classification result. Attached Figure Description

[0008] The objectives, implementation methods, advantages, and features of the present invention will become clearer from the following detailed description taken in conjunction with the accompanying drawings.

[0009] Figure 1 It is the methodological framework for invention.

[0010] Figure 2This is the overall framework of the entropy graph generator.

[0011] Figure 3 It is the network structure of the feature extractor.

[0012] Figure 4 This is a flowchart of a random forest classifier. Detailed Implementation

[0013] This invention is primarily used to identify Webmail XSS attacks, focusing on both XSS vulnerabilities and XSS attack payloads. Therefore, email content and JavaScript source code are extracted from Webmail as raw data. After preprocessing, feature vector construction, and training, a final Webmail XSS detection model is obtained. The hierarchical framework of the invention is as follows: Figure 1 As shown.

[0014] The invention's overall framework comprises three parts: an entropy map generator, a feature extractor, and a classifier. The entropy map generator extracts entropy features from the raw hexadecimal data of the input malware and generates an entropy map, which serves as input to the feature extractor. The convolutional neural network model in the feature extractor extracts features from the generated entropy map, using the output of a global average pooling layer as the extracted feature vector. The classifier selects a random forest classifier, taking the extracted feature vector as input to perform a malware family classification task, ultimately yielding the classification result. Each part is described in detail below.

[0015] like Figure 2 As shown, the entropy graph generator's role is to acquire and process the raw data, then organize it before feeding it into the feature extractor. First, it reads the byte stream information of the malware's raw hexadecimal data, cuts the data into a series of fixed-size segments, and then calculates the Shannon entropy of each segment. The entropy value of each segment is treated as a data point on the image. By connecting the entropy values ​​of different parts of the malware, a continuous value stream is formed, thus generating the entropy graph. In this process, the file length is chosen as the horizontal axis of the entropy graph, while the corresponding entropy value is used as the vertical axis. Using the Matplotlib toolkit, this series of entropy values ​​is converted into a visual entropy graph and saved.

[0016] The choice to use convolutional neural networks (CNNs) to extract entropy map features is based on their powerful feature learning capabilities, enabling automatic identification and extraction of high-level features from malware entropy maps. This method effectively preserves the spatial information of the entropy map, enhancing the ability to identify malware family structure characteristics. Furthermore, CNNs exhibit robustness to minor image changes, can handle high-dimensional data, and have been widely applied and validated in the field of image classification.

[0017] The CNN model constructed in this invention is as follows: Figure 3 As shown, the model design includes 13 convolutional layers in 6 convolutional blocks, with convolutional layers of the same color belonging to the same block. The model uses an entropy map as input data, followed by an initial layer and several convolutional layers, with each group of convolutional layers immediately followed by a pooling layer. As the network deepens, the feature depth in the convolutional layers gradually increases from 16 to 512. Each convolutional layer uses a 3 × 3 kernel. By stacking multiple smaller kernels, the receptive field of each pixel in the feature map on the original input image is expanded, while simultaneously increasing the network depth and the number of non-linear transformations applied. This structural design allows the network to effectively capture higher-level and more complex features using fewer parameters.

[0018] After feature extraction, a 512-dimensional flattened feature vector is directly generated by performing global average pooling. One advantage of global average pooling is that it does not contain any learnable weights, which helps reduce the risk of overfitting the model to the training data distribution. Unlike typical CNN architectures, this study uses global average pooling instead of traditional fully connected layers as the final output layer of the network. This layer calculates the average value for each channel of the feature map and concatenates these averages into a comprehensive global feature vector. By summarizing the features of the entire image region, global average pooling reveals the global features of the image. Unlike traditional fully connected layers, global average pooling significantly reduces the number of model parameters due to its lack of trainable parameters and predetermined weight allocation, thus helping to mitigate overfitting. Finally, the model performs malware family classification by passing the 512-dimensional feature vector generated by the global average pooling layer to the classifier. This method enables the model to effectively extract key feature information from the entropy map, achieving accurate classification of malware families.

[0019] The feature extractor generates a 512-dimensional feature vector through a global average pooling layer, which is then input into a random forest classifier such as... Figure 4 In this study, malware families are classified. Random forest classifiers fall under the category of ensemble learning, combining numerous decision trees to handle classification and regression tasks. The core advantage of this method lies in its ability to comprehensively utilize the predictive power of each decision tree, thereby significantly improving the overall performance and stability of the model. In the random forest algorithm, each independently trained tree incorporates randomly selected elements during its generation process. This strategy aims to reduce the bias and variance of the entire model to the data, enhancing its generalization ability.

[0020] This study applies random forests to the decision-making part of a deep learning architecture to achieve accurate classification of malware families. This strategy combines the excellent feature recognition capabilities of deep learning with the efficiency and stability of random forests in classification decisions, aiming to improve the accuracy and speed of malware type identification. This ensemble approach optimizes the model's ability to handle complex data structures while effectively reducing the possibility of overfitting, ensuring high accuracy in model predictions.

[0021] As described above, this invention successfully visualizes malware as entropy images and performs family classification. This invention offers the following innovations compared to traditional malware family classification methods:

[0022] I. Addressing common problems in current malware grayscale visualization techniques, such as reliance on single low-level features and susceptibility to information loss, this invention proposes an innovative visualization method that visualizes malware as entropy maps. Compared to traditional methods, entropy maps can more comprehensively reflect the feature information of malware. This paper explores similarity calculation methods for entropy maps by designing different file segmentation lengths and conducting comparative experiments, effectively utilizing these high-level features for malware detection and classification. This method not only optimizes the feature extraction process but also significantly improves classification accuracy and efficiency by accurately capturing the essential characteristics of malware.

[0023] Second, an improvement is made to the ordinary CNN model by replacing fully connected layers with global average pooling layers. Compared to traditional fully connected layers, global average pooling layers, due to the lack of learnable parameters and fixed weight matrices, significantly reduce the total number of parameters in the model, helping to avoid overfitting. This improvement not only deepens the network's understanding of malware features but also significantly improves classification performance.

[0024] Although preferred embodiments of the invention have been described for illustrative purposes, those skilled in the art will understand that various modifications, additions, and substitutions are possible without departing from the scope and spirit of the invention as disclosed in the appended claims.

Claims

1. A method for classifying malware families based on entropy graph visualization, characterized in that, The method includes the following steps: A. Obtain malware samples from the malware sample library and convert them into binary format; B. Preprocess the binary format malware samples to generate the corresponding entropy map; C. Construct a training set for malware family classification using the generated entropy graph, and train the model using a convolutional neural network (CNN); D. Use a trained CNN model to classify new malware samples and identify the malware family to which they belong.

2. The malware family classification method based on entropy graph visualization according to claim 1, characterized in that, The preprocessing process in step B includes the following: B1. Malware samples are divided into blocks of fixed length, and the entropy value of each block is calculated. B2. Treat the entropy value of each segment as a data point on the image. By connecting the entropy values ​​of each part of the malware, a continuous value stream is formed, thereby generating an entropy image of size 300×300×1.

3. The malware family classification method based on entropy graph visualization according to claim 1, characterized in that, The training process in step C includes the following: C1. A global average pooling layer replaces the traditional fully connected layer as the final output layer of the network. This layer calculates the average value of each channel of the feature map and concatenates these average values ​​into a comprehensive global feature vector. C2. The 512-dimensional feature vector generated by the global average pooling layer is input into the random forest classifier to classify malware families.

Images