Malware adversarial training defense method and device based on analog quantum annealing

Abstract

The present application belongs to the field of information security, and relates to a malware adversarial training defense method and device based on analog quantum annealing, a computer device and a storage medium. The method comprises the following steps: extracting structured discrete features of malware and binarizing to generate a binary feature vector; constructing a quadratic unconstrained binary optimization function containing an adversarial term, a functionally equivalent constraint and a format legality penalty, and converting adversarial sample generation into a discrete optimization problem; mapping the function to an Ising model, simulating quantum tunneling effect through Trotter-Suzuki decomposition, performing analog quantum annealing search, and solving the optimal flip vector to generate an adversarial sample; using a benign and original malicious sample to pre-train a WGAN-GP discriminator; calling the aforementioned search to generate an adversarial sample from the original malicious sample, iteratively completing the training, and obtaining a final detector. The method can adapt to a wider range of adversarial strategy distribution, and improve the generalization ability and defense robustness against unknown evasion attacks.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and apparatus for malware adversarial training and defense based on simulated quantum annealing. Background Technology

[0002] Malware detection is a crucial technique in cybersecurity, aiming to identify malicious software entities by analyzing the structural characteristics and behavioral patterns of Windows PE executable files. Traditional malware detection methods primarily rely on signature-based approaches or rule-based heuristic detection mechanisms, such as signature matching, hash value comparison, and behavioral rule bases.

[0003] With the development of machine learning technology, deep learning-based malware detection methods have gradually become a research hotspot. Among them, deep learning detection methods based on static analysis extract features such as PE header fields, API call sequences, and byte n-grams to construct neural network classifiers for maliciousness discrimination, achieving detection results superior to traditional methods.

[0004] However, deep learning models inherently possess vulnerabilities and are susceptible to adversarial attacks. In malware detection scenarios, attackers can generate adversarial malware variants by applying carefully crafted micro-perturbations to the feature vectors of malware samples. These variants retain their original malicious functionality while successfully evading deep learning detectors, posing a security risk to deep learning-based malware detection technologies. To defend against adversarial attacks, adversarial training methods based on Generative Adversarial Networks (GANs) dynamically generate adversarial examples during training and inject them into the training set through a game between the generator and discriminator. This allows the detector to learn potential adversarial variants during the learning process, thereby improving its robustness against adversarial attacks.

[0005] However, existing adversarial training methods based on generative adversarial networks still have the following limitations: First, the diversity of adversarial examples generated by traditional generator networks is insufficient. Generators typically map random noise vectors to feature spaces. Due to the limited capacity of generator networks and the potential pattern collapse problem during training, the distribution of the generated samples often only covers the low-dimensional manifold of the real data distribution, making it difficult to generate sufficiently diverse highly adversarial variants. Second, the search for adversarial examples lacks global optimization capabilities. The training of generative adversarial networks is essentially a gradient-based local optimization process. The generator continuously adjusts its parameters through the feedback signal from the discriminator. The generation process of adversarial examples is limited by gradient information and is prone to getting trapped in local optima. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention provides a malware adversarial training and defense method based on simulated quantum annealing, employing the following technical solution, including the following steps: Structured discrete features are extracted from the original malware sample and binarized to generate a fixed-length original binary feature vector; Based on the original binary feature vector, a quadratic unconstrained binary optimization objective function containing adversarial terms, functional equivalence constraints, and format legality penalties is constructed, transforming the adversarial sample generation problem into a discrete optimization problem. The quadratic unconstrained binary optimization objective function is mapped to the standard form of the Ising model, and the transverse field is introduced through Trotter-Suzuki decomposition to simulate the quantum tunneling effect, thus constructing an effective classical Hamiltonian. Based on the effective classical Hamiltonian, simulated quantum annealing search is performed. Through multi-path parallel updates, inter-slice information exchange, and adaptive temperature adjustment, the optimal flip decision vector that minimizes the quadratic unconstrained binary optimization objective function is solved, and adversarial examples are generated based on the optimal flip decision vector. The WGAN-GP discriminator is pre-trained using benign samples and original malicious samples to enable it to have basic malware detection capabilities. After the discriminator pre-training is completed, the current discriminator parameters are fixed, and the simulated quantum annealing search is called to generate adversarial samples from the original malicious samples. The benign samples, the original malicious samples and the generated adversarial samples are mixed, and the enhancement loss function containing classification loss and gradient penalty is calculated and the discriminator parameters are updated. The process is iterated until training is completed, and the final malware detector is obtained.

[0007] Preferably, the step of extracting structured discrete features from the original malware sample and binarizing them to generate a fixed-length original binary feature vector specifically includes: Parse the PE structure of Windows executable files, extract the PE header flags, and treat each flag as a binary feature dimension. API call sequences are captured through static analysis or dynamic sandbox execution, and the occurrence of each API is counted based on the key API vocabulary to form a binary feature vector; A sliding window scan is performed on the contents of the malware's binary file to extract byte n-gram frequency features, which are then weighted by TF-IDF and binarized by threshold truncation. The PE header flag features, API call sequence features, and byte n-gram frequency features are concatenated and integrated to generate a fixed-length original binary feature vector. ,in, Represents the binary feature vector of the original malicious sample. This represents the total feature dimension.

[0008] Preferably, the step of constructing a quadratic unconstrained binary optimization objective function based on the original binary feature vector, which includes an adversarial term, a functional equivalence constraint term, and a format validity penalty term, and transforming the adversarial example generation problem into a discrete optimization problem, specifically includes: Construct adversarial terms by performing a second-order Taylor expansion of the WGAN-GP discriminator's output on the adversarial examples at the original sample points. This can be approximated as first-order and second-order terms in the form of flipped decision vectors: ,in, For binary flip decision vectors, The discriminator outputs the coefficient vector of the first-order terms at the original sample points. This is the coefficient matrix of the quadratic terms; Construct functionally equivalent constraint terms, encoding PE format validation, import table integrity, entry point validity, and section table alignment constraints into quadratic penalty terms with auxiliary variables using a Boolean function to quadratic polynomial conversion method: ,in, To include the original decision variables and auxiliary binary variables The extended vector, Let be the coefficient vector of the first-order terms. This is the coefficient matrix of the quadratic terms; Construct a format validity penalty term, applying linear and quadratic penalties for single feature flipping and simultaneous flipping of mutually exclusive features: ,in, A linear coefficient vector, It is an upper triangular quadratic coefficient matrix; By combining the adversarial terms, functional equivalence constraints, and format validity penalties, we obtain the complete quadratic unconstrained bivariate optimization objective function: ,in, This is the merged upper triangular quadratic coefficient matrix. This is the vector of coefficients for the combined linear terms.

[0009] Preferably, the step of mapping the quadratic unconstrained binary optimization objective function to the standard form of the Ising model and introducing a transverse field to simulate the quantum tunneling effect through Trotter-Suzuki decomposition to construct an effective classical Hamiltonian specifically includes: By transforming variables, the binary decision variables in the quadratic unconstrained binary optimization objective function are mapped to spin variables of the Ising model. The transformation relationship is as follows: ,in, The first eigenvector of the binary feature vector One portion, For the corresponding Ising spin variable; Transform the quadratic unconstrained bivariate optimization objective function into the standard form of the Ising model: ,in, For spin and The coupling coefficient between them For the first The external field coefficient of each spin; Introducing transverse field Hamiltonian Furthermore, the Trotter-Suzuki decomposition is used to map the quantum system to a classical system, yielding the effective classical Hamiltonian: ,in, For the number of Trotter slices, For the reverse effective temperature, For effective temperature, The transverse field intensity decays over time. For the first The first slice One spin.

[0010] Preferably, the step of performing simulated quantum annealing search based on the effective classical Hamiltonian, solving for the optimal flip decision vector that minimizes the quadratic unconstrained binary optimization objective function through multi-path parallel updates, inter-slice information exchange, and adaptive temperature adjustment, and generating adversarial examples based on the optimal flip decision vector specifically includes: The transverse field strength is updated according to the exponential decay scheduling strategy. Each bit of each Trotter slice is traversed sequentially to attempt to flip. The energy change before and after the flip is quickly calculated using the local energy difference formula. The Metropolis acceptance criterion is used to determine whether to accept the flip, thus realizing multi-path parallel updating. Every fixed number of steps, the complete spin configuration is swapped between adjacent Trotter slices, with the swap acceptance probability being: ,in, For the first Effective energy of the slice; and dynamically adjust the effective temperature based on the flipping acceptance rate: ,in, To achieve the acceptance rate of the flip, This is the gain coefficient; After completing all annealing steps, the configuration that minimizes the quadratic unconstrained binary optimization objective function value is selected from the final spin configurations of all Trotter slices as the optimal spin configuration, which is then converted into the optimal flip decision vector. Generate adversarial examples as follows: ,in, This indicates a bitwise XOR operation. The original binary feature vector, This is the feature vector of the generated adversarial sample.

[0011] Preferably, the step of pre-training the WGAN-GP discriminator using benign samples and original malicious samples to enable the discriminator to have basic malware detection capabilities specifically includes: A WGAN-GP discriminator network is constructed, which adopts a multilayer perceptron structure. The input layer accepts a fixed-length binary feature vector, the hidden layer is a fully connected layer with a LeakyReLU activation function, and the output layer has no activation function and directly outputs a real value malicious score. Calculate the pre-training loss function: ,in, For the discriminator, the parameters are: , For a benign sample distribution, The original distribution of malicious samples, For expectation operators; The discriminator parameters are updated by minimizing the pre-trained loss function through backpropagation. This enables the discriminator to have the basic detection capability to distinguish between benign samples and original malicious samples.

[0012] Preferably, the steps of fixing the current discriminator parameters after the discriminator pre-training is completed, calling the simulated quantum annealing search to generate adversarial samples from the original malicious samples, mixing the benign samples, the original malicious samples, and the generated adversarial samples, calculating the enhancement loss function including classification loss and gradient penalty, updating the discriminator parameters, and iterating until training is completed to obtain the final malware detector specifically include: Fixed current discriminator parameters Original malicious samples are sampled from the malicious sample set. A quadratic unconstrained binary optimization objective function is constructed using the current discriminator. Simulated quantum annealing is then used to search for the optimal flip decision vector, generating batches of adversarial samples. ; Sampling batches from benign sample sets The batches of benign samples and the original malicious sample batches and adversarial sample batches Mix and calculate the enhanced loss function: , in, To counteract sample distribution, The gradient penalty coefficient is... , , The gradient of the discriminator on the interpolated samples; The discriminator parameters are updated by minimizing the enhancement loss function through backpropagation. The process is iterated until the maximum number of training rounds is reached, and the trained discriminator is saved as the final malware detector.

[0013] To address the aforementioned technical problems, this invention also provides a malware adversarial training and defense device based on simulated quantum annealing, employing the following technical solution, including: The extraction module is used to extract structured discrete features from the original malware sample and binarize them to generate a fixed-length original binary feature vector. The construction module is used to construct a quadratic unconstrained binary optimization objective function based on the original binary feature vector, which includes adversarial terms, functional equivalence constraints, and format legality penalties, thereby transforming the adversarial example generation problem into a discrete optimization problem. The mapping module is used to map the quadratic unconstrained binary optimization objective function to the standard form of the Ising model, and to introduce a transverse field through Trotter-Suzuki decomposition to simulate the quantum tunneling effect and construct an effective classical Hamiltonian. The solution module is used to perform simulated quantum annealing search based on the effective classical Hamiltonian. Through multi-path parallel updates, inter-slice information exchange and adaptive temperature adjustment, it solves for the optimal flip decision vector that minimizes the quadratic unconstrained binary optimization objective function, and generates adversarial examples based on the optimal flip decision vector. The pre-training module is used to pre-train the WGAN-GP discriminator using benign samples and original malicious samples, so that the discriminator has basic malware detection capabilities. The iterative module is used to fix the current discriminator parameters after the discriminator pre-training is completed, call the simulated quantum annealing search to generate adversarial samples from the original malicious samples, mix the benign samples, the original malicious samples and the generated adversarial samples, calculate the enhancement loss function including classification loss and gradient penalty and update the discriminator parameters, iterate until training is completed, and obtain the final malware detector.

[0014] To address the aforementioned technical problems, the present invention also provides a computer device that employs the technical solution described below, comprising a memory and a processor. The memory stores computer-readable instructions, and the processor, when executing the computer-readable instructions, implements the steps of the aforementioned malware adversarial training and defense method based on simulated quantum annealing.

[0015] To address the aforementioned technical problems, the present invention also provides a computer-readable storage medium, which employs the technical solution described below. The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the aforementioned malware adversarial training and defense method based on simulated quantum annealing.

[0016] Compared with the prior art, the present invention has the following main advantages: (1) Global optimization capability: Simulated quantum annealing is used to replace the traditional generator network. The quantum tunneling effect is simulated through the transverse field, enabling the search process to traverse narrow and high potential barriers in the high-dimensional discrete feature space, thus avoiding getting trapped in local optima. Compared with the local optimization method of traditional generative adversarial networks that rely on gradient information, this invention can achieve the optimal perturbation combination search in the global range without relying on gradient information. This helps to overcome the defects of traditional generative adversarial networks that are prone to getting trapped in local optima and pattern collapse, and improves the diversity of adversarial examples and the effectiveness of attacks.

[0017] (2) Highly Usable Adversarial Samples: The adversarial, functional equivalence, and format validity constraints are uniformly modeled using the QUBO objective function. Constraints such as the malicious score output by the WGAN-GP discriminator, the integrity of the PE file format, and the validity of the import table are uniformly encoded into a quadratic unconstrained binary optimization objective function. These three constraints are jointly optimized within the QUBO framework, ensuring that the generated adversarial samples reduce the discriminator's malicious score while strictly maintaining the functional equivalence and format validity of the executable file. This mechanism helps address the problem of existing methods focusing only on adversarial aspects while neglecting sample usability, ensuring that the generated adversarial samples are actually executable, possess complete malicious functionality, and represent real threat samples, thus enhancing the practical defensive value of adversarial training.

[0018] (3) Robust detector: Simulated quantum annealing is used to replace the traditional generator network and is trained in conjunction with the WGAN-GP discriminator. In each round of training, globally optimal adversarial samples are dynamically generated and injected into the training set. During the training process, the discriminator learns both the original malicious samples and the diverse highly adversarial samples generated by quantum annealing search, enabling it to adapt to a wider distribution of adversarial strategies and exhibiting stronger generalization ability and defensive robustness when facing various unknown adversarial evasion attacks. Attached Figure Description

[0019] To more clearly illustrate the solutions in this invention, the accompanying drawings used in the description of the embodiments of this invention will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a flowchart of an embodiment of the malware adversarial training and defense method based on simulated quantum annealing of the present invention; Figure 2 This is an exemplary system architecture diagram in which the present invention can be applied; Figure 3This is a schematic diagram of the structure of an embodiment of the malware adversarial training and defense device based on simulated quantum annealing of the present invention; Figure 4 This is a schematic diagram of another embodiment of the malware adversarial training and defense device based on simulated quantum annealing of the present invention; Figure 5 This is a schematic diagram of the framework of another embodiment of the malware adversarial training and defense device based on simulated quantum annealing of the present invention; Figure 6 This is a schematic diagram of the structure of an embodiment of the computer device of the present invention. Detailed Implementation

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains; the terminology used herein in the specification is for the purpose of describing particular embodiments only and is not intended to limit the invention; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings are used to distinguish different objects and not to describe a particular order.

[0022] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0023] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0024] It should be noted that the malware adversarial training and defense method based on simulated quantum annealing provided in the embodiments of the present invention is generally executed by a server / terminal device, and correspondingly, the malware adversarial training and defense device based on simulated quantum annealing is generally set in the server / terminal device.

[0025] It should be understood that the number of terminal devices, networks, and servers is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be used.

[0026] Example 1 Please refer to Figure 1The diagram shows a flowchart of an embodiment of the malware adversarial training defense method based on simulated quantum annealing of the present invention. Figure 2 This is an exemplary system architecture diagram in which the present invention can be applied. For example... Figure 1 , Figure 2 As shown, the malware adversarial training and defense method based on simulated quantum annealing includes the following steps: Step S1: Extract structured discrete features from the original malware sample and binarize them to generate a fixed-length original binary feature vector.

[0027] In this embodiment, the electronic device (e.g., a server / terminal device) on which the simulated quantum annealing-based malware adversarial training and defense method runs can receive malware adversarial training and defense requests based on simulated quantum annealing via wired or wireless connections. It should be noted that the aforementioned wireless connection methods may include, but are not limited to, 3G / 4G / 5G connections, WiFi connections, Bluetooth connections, WiMAX connections, Zigbee connections, UWB (ultra wideband) connections, and other currently known or future-developed wireless connection methods.

[0028] In this embodiment, step S1 may specifically include the following steps: S11 parses the PE structure of a Windows executable file, extracts the PE header flags, and treats each flag as a binary feature dimension.

[0029] Parse the PE structure of a Windows executable file, and read the DOS header (IMAGE_DOS_HEADER), NT header (IMAGE_NT_HEADERS), file header (IMAGE_FILE_HEADER), and optional header (IMAGE_OPTIONAL_HEADER) in sequence.

[0030] Extract key flag fields, for example: IMAGE_FILE_DLL (0x2000): Indicates whether it is a DLL file.

[0031] IMAGE_FILE_EXECUTABLE_IMAGE (0x0002): Indicates whether it is an executable file.

[0032] Each bit in the Characteristics field (such as IMAGE_FILE_RELOCS_STRIPPED, IMAGE_FILE_SYSTEM, etc.).

[0033] Each flag bit is directly used as a binary feature dimension: if the flag bit is 1, the corresponding feature value is 1, otherwise it is 0.

[0034] The purpose of step S11 is to capture the structural attributes of the PE file, which have a significant impact on the file's executableness (such as whether it is a DLL or an executable image) and malicious behavior (such as relocation information and section permissions).

[0035] S12 captures API call sequences through static analysis or dynamic sandbox execution, and statistically analyzes the occurrence of each API based on the key API vocabulary to form a binary feature vector.

[0036] Capture Windows API functions called by the sample through static analysis (parsing the PE import table) or dynamic sandbox execution (running the sample in an isolated environment and monitoring API calls).

[0037] Pre-build a key API vocabulary that includes APIs related to common malicious behaviors, such as: CreateRemoteThread (remote thread creation); VirtualAllocEx (remote memory allocation); WriteProcessMemory (Cross-process memory write); RegSetValueEx (Registry Modification).

[0038] For each API, count whether it appears in the sample or whether its frequency of occurrence exceeds a preset threshold (e.g., the threshold is set to 5).

[0039] Forming a binary feature vector: if the occurrence or frequency exceeds the threshold, the corresponding feature value is 1; otherwise, it is 0.

[0040] The purpose of step S12 is to capture the behavior patterns of malware during runtime, especially the calls to sensitive APIs, in order to distinguish between malicious and normal behavior.

[0041] S13 performs a sliding window scan on the binary file content of the malware, extracts the byte n-gram frequency features, and performs binarization by threshold truncation after TF-IDF weighting.

[0042] The purpose of step S13 is to capture statistical patterns of the binary content of malware, which are used to detect hidden malicious code fragments, encryption shells, or obfuscated malicious payloads.

[0043] Perform a sliding window scan on the contents of the malware's binary file to extract byte-level n-gram patterns (typically n=2 or n=4).

[0044] Pre-construct a vocabulary of frequent n-grams (e.g., identify the top 2000 most frequent 2-grams from a large number of benign and malicious software).

[0045] TF-IDF weighting is used: for each n-gram, the product of its frequency (TF) in the current sample and its inverse document frequency (IDF) in all samples is calculated.

[0046] Binarization is performed by threshold truncation: if the weighted value is greater than a preset threshold (such as 0.3), the corresponding feature value is 1; otherwise, it is 0.

[0047] S14, the PE header flag features, API call sequence features, and byte n-gram frequency features are concatenated and integrated to generate a fixed-length original binary feature vector. ,in, Represents the binary feature vector of the original malicious sample. This represents the total feature dimension.

[0048] Step S14 is the output vector, which retains the structure, behavior and statistical information of the original sample and is in binary form, which can be directly used for subsequent QUBO modeling and spin mapping.

[0049] The purpose of step S1 is to transform the original malware binary file (Windows PE executable file) into a fixed-length binary feature vector, so that subsequent QUBO modeling and quantum annealing search can be performed in a discrete, structured, low-dimensional feature space.

[0050] Step S2: Based on the original binary feature vector, construct a quadratic unconstrained binary optimization objective function that includes adversarial terms, functional equivalence constraints, and format legality penalties, thus transforming the adversarial example generation problem into a discrete optimization problem.

[0051] In this embodiment, step S2 may specifically include the following steps: S21, Construct the adversarial term by performing a second-order Taylor expansion of the WGAN-GP discriminator's output on the adversarial examples at the original sample points. This is approximately represented as first-order and second-order terms in the form of flipped decision vectors: ,in, For binary flip decision vectors, The discriminator outputs the coefficient vector of the first-order terms at the original sample points. It is the coefficient matrix of the quadratic terms.

[0052] Let the WGAN-GP discriminator be... Its network parameters are The output is a real-valued maliciousness score. The closer the value is to 0, the more benign the sample is judged; the larger the value, the more malicious it is.

[0053] Discriminator parameters during adversarial example generation Keep it fixed.

[0054] The adversarial term is directly defined as the discriminator's output value for the adversarial sample: .

[0055] To achieve solvability of the QUBO form, a local quadratic approximation strategy is adopted: at the current original sample point At (zero flip), for Perform a second-order Taylor expansion:

[0056] Discard the constant term Then, the adversarial term is approximately expressed as:

[0057] in: Binary flip decision vector Indicates flipping the first Position features This indicates that the original value should be retained.

[0058] The discriminator outputs the gradient at the original sample points, which is... A dimensional vector, denoted as the vector of coefficients of the first-order terms. .

[0059] : Hessian matrix, is matrix, Let be the upper triangular quadratic coefficient matrix of the anti-term.

[0060] The output of the nonlinear neural network is approximated as about The quadratic function allows the adversarial example generation problem to be incorporated into the QUBO framework, thereby enabling global optimization using quantum heuristics.

[0061] The purpose of step S21 is to drive the generated adversarial examples to reduce the malicious score output by the WGAN-GP discriminator, making it easier for the discriminator to misjudge it as benign.

[0062] S22, construct functionally equivalent constraint terms, and encode PE format verification, import table integrity, entry point validity, and section table alignment constraints into quadratic penalty terms with auxiliary variables through a Boolean function to quadratic polynomial conversion method: ,in, To include the original decision variables and auxiliary binary variables The extended vector, Let be the coefficient vector of the first-order terms. It is the coefficient matrix of the quadratic terms.

[0063] Define the following four functional equivalence constraints that must be satisfied, each constraint corresponding to an indicator function. A value of 1 indicates that the condition is satisfied. There are 1 constraint, where 0 indicates a violation: PE format verification constraints: the e_magic field must be 0x5A4D, the e_lfanew field must point to a valid NT header, and the Signature field of the NT header must be 0x00004550.

[0064] Import table integrity constraints: All imported DLL names and API function names must point to valid strings, and the import table must be properly terminated with an empty entry.

[0065] Entry point validity constraints: The entry point address must be within the executable section, and the starting instruction cannot be an illegal instruction sequence.

[0066] Section alignment constraints: The virtual address and raw data address of each section must meet the specifications for file alignment and memory alignment.

[0067] For each constraint Pre-set penalty weights The functional equivalence constraint is defined as the weighted sum of penalties for all constraint violations:

[0068] To be Expressed as about The QUBO form will specify each constraint indicator function. Transform it into a quadratic polynomial. Follow the standard transformation steps below: Flip the state of each original feature bit Treat it as a Boolean variable.

[0069] Logical operations in the constraints ( Replace them sequentially with algebraic expressions: , , .

[0070] If the degree of the transformed polynomial is higher than the second degree, a new auxiliary binary variable is introduced to replace the higher-degree product term, and a penalty term is added to constrain its equivalence relation.

[0071] After transformation, each constraint violation can be written as a statement about the extended variable. The quadratic form, in which For all introduced auxiliary binary variables, Let be the total number of auxiliary variables. Then:

[0072] in: : Extend the decision vector, with dimension .

[0073] : The vector of coefficients of the first-order terms of the functional equivalence constraint.

[0074] : The upper triangular quadratic coefficient matrix of the functional equivalence constraint terms.

[0075] Ensure that the generated adversarial samples reduce the malicious rating of the discriminator while strictly maintaining the functional integrity and executability of the PE file, and avoid generating "invalid" adversarial samples.

[0076] The purpose of step S22 is to ensure that the feature flipping operation does not destroy the executable function of the malware, and to ensure that the generated adversarial sample can run normally in the real environment and retain its original malicious function.

[0077] S23, constructs a format validity penalty term, applying linear and quadratic penalties for single feature flipping and simultaneous flipping of mutually exclusive features: ,in, A linear coefficient vector, It is an upper triangular quadratic coefficient matrix.

[0078] There are two main types of punishments: Mutual exclusion flags should be toggled simultaneously: for example, IMAGE_FILE_DLL and IMAGE_FILE_EXECUTABLE_IMAGE should not both be 1.

[0079] The simultaneous occurrence of rare n-gram combinations: Some n-gram combinations rarely occur simultaneously in benign samples. If they occur simultaneously in adversarial samples, they are easily detected as anomalies.

[0080] The format validity penalty term is defined as a combination of a linear penalty for single features and a quadratic penalty for coupling between features:

[0081] in: Linear coefficient, measuring the number of individual flips. The degree of illegitimacy of a feature. The value can be based on the frequency of the feature's occurrence in a set of benign samples; the lower the frequency, the less illegitimacy it represents. The larger.

[0082] : Quadratic coefficient, measuring the simultaneous flipping feature and characteristics The coupling is illegal. Regarding the mutex flag, Set to a large positive number (e.g., 100); for rare n-gram combinations, Set according to the reciprocal of the co-occurrence frequency.

[0083] : Linear coefficient vector.

[0084] : Upper triangular quadratic coefficient matrix.

[0085] To prevent anomalous combinations that clearly violate statistical distributions from being generated when generating adversarial examples, the goal is to make adversarial examples more statistically similar to benign examples, thereby improving their ability to evade detection.

[0086] The purpose of step S23 is to further punish feature combinations that, although they do not constitute direct functional damage at the strict PE specification level, will cause the generated adversarial samples to deviate significantly from the statistical distribution of normal executable files, thereby improving the stealth of adversarial samples.

[0087] S24, combining the adversarial terms, functional equivalence constraints, and format validity penalties, yields the complete quadratic unconstrained bivariate optimization objective function: ,in, This is the merged upper triangular quadratic coefficient matrix. This is the vector of coefficients for the combined linear terms.

[0088] Combining the adversarial terms, functional equivalence constraints, and format validity penalties, the complete QUBO objective function is: .

[0089] After combining like terms, we can obtain information about the original decision variables. The expression for a single QUBO matrix: .

[0090] in: The weighting parameters for balancing various objectives can be adjusted by the user according to the application scenario.

[0091] The merged upper triangular quadratic coefficient matrix contains , and . contributions.

[0092] The combined vector of linear term coefficients contains... , and . contributions.

[0093] By unifying the three constraints of adversarialness, functional equivalence, and format legality into a quadratic unconstrained binary optimization function, the adversarial example generation problem can be globally and jointly optimized using quantum heuristic algorithms.

[0094] The purpose of step S2 is to formalize the adversarial example generation problem into a quadratic unconstrained binary optimization problem that can be efficiently solved by quantum heuristic algorithms, and to uniformly model the adversarial, functional equivalence and format legality constraints.

[0095] Step S3: The quadratic unconstrained binary optimization objective function is mapped to the standard form of the Ising model, and the transverse field is introduced through Trotter-Suzuki decomposition to simulate the quantum tunneling effect, thereby constructing an effective classical Hamiltonian.

[0096] In this embodiment, step S3 may specifically include the following steps: S31, through variable transformation, the binary decision variables in the quadratic unconstrained binary optimization objective function are mapped to the spin variables of the Ising model. The transformation relationship is as follows: ,in, The first eigenvector of the binary feature vector One portion, For the corresponding Ising spin variable.

[0097] : The corresponding Ising spin variable, -1 corresponds to 0, +1 corresponds to 1.

[0098] For flipping the decision vector The corresponding spin transformation is equivalent to: ,in This represents the spin of the original sample.

[0099] The purpose of step S31 is to: convert the binary decision variables Convert to quantum spin variable To adapt to the quantum annealing framework.

[0100] S32, converting the quadratic unconstrained bivariate optimization objective function into the standard form of the Ising model: ,in, For spin and The coupling coefficient between them For the first The external field coefficient of each spin.

[0101] Through transformation Substitute into QUBO expression After algebraic simplification, the standard form of the Ising model is obtained. .

[0102] Coupling coefficient, representing spin and The strength of the interaction between them.

[0103] External field coefficient, representing the effect of the external magnetic field on the spin. Its function.

[0104] QUBO quadratic coefficient matrix The Line 1 Column elements.

[0105] : QUBO linear term coefficient vector The Each component.

[0106] The Ising model is the standard input form for the quantum annealing algorithm, and its ground state corresponds to the optimal solution of the original QUBO problem.

[0107] S33, introducing the transverse field Hamiltonian Furthermore, the Trotter-Suzuki decomposition is used to map the quantum system to a classical system, yielding the effective classical Hamiltonian: ,in, For the number of Trotter slices, For the reverse effective temperature, For effective temperature, The transverse field intensity decays over time. For the first The first slice One spin.

[0108] The effective Hamiltonian of the system is represented as: .

[0109] in: : Transverse field Hamiltonian It is the first Pauli-X operator with 100 qubits.

[0110] The transverse field intensity decays over time, gradually decreasing from a large value to 0 during annealing.

[0111] Trotter-Suzuki decomposition was used to separate the original 3D quantum system mapping as Classical system, in which For the number of Trotter slices (also known as the Trotter number). For each spin variable. copied as copy, record number The first slice Each spin is , The path integral Monte Carlo method uses this... Parallel classical paths are used to simulate the superposition state of a quantum system.

[0112] After Trotter-Suzuki decomposition, the effective classical Hamiltonian is: .

[0113] in: Inverse effective temperature, The effective temperature.

[0114] Trotter slice count controls the precision of the quantum simulation, typically ranging from 10 to 50.

[0115] : Hyperbolic cotangent function.

[0116] Set periodic boundary conditions .

[0117] The first term represents the average classical energy within each slice, and the second term represents the ferromagnetic coupling between adjacent slices, and the coupling strength. With transverse field strength The increase weakens it.

[0118] When the transverse field strength is large, the coupling strength between slices is weak, the quantum fluctuation effect is strong, and the system tunnels rapidly between multiple states. As the annealing process progresses, the transverse field strength gradually decreases, and the coupling strength increases accordingly, forcing the spin configurations of each slice to tend to be consistent. The system gradually degenerates into the classical Ising model and eventually converges to a stable classical solution. This mechanism effectively avoids the problem of classical simulated annealing easily getting trapped in local optima.

[0119] The purpose of step S3 is to map the QUBO problem into a quantum annealing solvable Ising model, and to introduce a transverse field through Trotter-Suzuki decomposition to simulate the quantum tunneling effect, thus laying a physical foundation for breaking through the limitations of classical local optima.

[0120] Step S4: Perform simulated quantum annealing search based on the effective classical Hamiltonian. Through multi-path parallel updates, inter-slice information exchange, and adaptive temperature adjustment, solve for the optimal flip decision vector that minimizes the quadratic unconstrained binary optimization objective function, and generate adversarial examples based on the optimal flip decision vector.

[0121] In this embodiment, step S4 may specifically include the following steps: S41 updates the transverse field strength according to the exponential decay scheduling strategy. It iterates through each bit of each Trotter slice and attempts to flip it. It uses the local energy difference formula to quickly calculate the energy change before and after the flip. It uses the Metropolis acceptance criterion to determine whether to accept the flip, thus realizing multi-path parallel update.

[0122] Update the transverse field strength according to the exponential decay scheduling strategy: .

[0123] in: : No. The transverse field intensity of the step.

[0124] Initial transverse field strength (relatively large, such as 5.0).

[0125] Termination transverse field strength (small, such as 0.01).

[0126] Current annealing steps .

[0127] Total number of annealing steps, typically 1000~10000.

[0128] Multi-path parallel update: for each Trotter slice In the current spin configuration Perform a full Metropolis scan on top of this: Iterate through each bit in sequence Try to flip each bit.

[0129] Calculate the candidate configuration after flipping ,in , .

[0130] Calculate the energy change caused by the flip: .

[0131] in: The use of local update properties only involves the first... Bit-related items avoid global redundant calculations.

[0132] .

[0133] ,in superscript Indicates the index of adjacent slices.

[0134] With probability Accept the flip and update the current spin configuration. .

[0135] The computational complexity is significantly reduced by using a fast calculation formula based on local energy difference; parallel exploration across multiple slices increases the diversity of the search.

[0136] The purpose of step S41 is to achieve a smooth annealing process from quantum-dominated to classical-dominated, and to explore different regions in parallel using multiple Trotter slices to enhance global search capabilities.

[0137] S42, every fixed number of steps, the complete spin configuration is swapped between adjacent Trotter slices, with the swap acceptance probability being: ,in, For the first Effective energy of the slice; and dynamically adjust the effective temperature based on the flipping acceptance rate: ,in, To achieve the acceptance rate of the flip, This is the gain coefficient.

[0138] Information exchange between slices: every fixed interval The number of annealing steps swaps the complete spin configuration between adjacent Trotter slices. For adjacent slices and The probability of accepting the exchange is: .

[0139] in: :slice Effective energy.

[0140] Adaptive temperature adjustment: Every 100 annealing steps, the flip acceptance rate within that interval is calculated. (The percentage of accepted flip attempts out of the total number of attempts). Adjust the effective temperature according to the update rules: .

[0141] in: Acceptance rate, typically ranging from 0.1 to 0.9.

[0142] Gain coefficient, typically taken as 0.5 to 1.0.

[0143] 0.35: Target acceptance rate (empirical value). If... This indicates the effective temperature. Too high, too exploratory; should be appropriately reduced. ;like This indicates that the temperature is too low, making it prone to getting stuck in a local optimum; a proper increase in temperature is recommended. .

[0144] The slice exchange mechanism promotes collaborative search and avoids multiple paths from getting stuck in different local optima; adaptive temperature adjustment keeps the acceptance rate within the target range, maintaining the robustness of the algorithm.

[0145] The purpose of step S42 is to promote collaborative searching among different annealing paths, avoid each slice from getting trapped in different local optima, and dynamically adjust the effective temperature to balance exploration and utilization.

[0146] S43, after completing all annealing steps, select the configuration that minimizes the quadratic unconstrained binary optimization objective function value from the final spin configurations of all Trotter slices as the optimal spin configuration, and convert it into the optimal flip decision vector. Generate adversarial examples as follows: ,in, This indicates a bitwise XOR operation. The original binary feature vector, This is the feature vector of the generated adversarial sample.

[0147] Complete all After step annealing, for each Trotter slice to configure its final spin Through transformation Transform into the corresponding decision vector .

[0148] Calculate the QUBO objective function value for each slice. .

[0149] From all Selecting from slices The smallest slice spin configuration is considered the optimal spin configuration. And denote its corresponding optimal flip decision vector as : .

[0150] Based on the optimal flip decision vector Generate adversarial example feature vectors: .

[0151] in This represents the bitwise XOR operation, i.e. .

[0152] Output a highly adversarial sample that is functionally equivalent to the original malware, has a valid format, and has a low maliciousness score from the discriminator's perspective, which can be directly used for subsequent adversarial training.

[0153] The purpose of step S43 is to select the optimal solution that minimizes the QUBO objective function value from the final spin configurations of all Trotter slices and convert it into an adversarial example feature vector.

[0154] The purpose of step S4 is to perform a specific simulated quantum annealing search process on the quantum system constructed in step S3, find the optimal spin configuration that minimizes energy, and generate highly adversarial and functionally equivalent adversarial malware samples.

[0155] Step S5: Pre-train the WGAN-GP discriminator using benign samples and original malicious samples to enable the discriminator to have basic malware detection capabilities.

[0156] In this embodiment, step S5 may specifically include the following steps: S51 constructs a WGAN-GP discriminator network, which adopts a multilayer perceptron structure. The input layer accepts a fixed-length binary feature vector, the hidden layer is a fully connected layer with a LeakyReLU activation function, and the output layer has no activation function and directly outputs a real value malicious score.

[0157] Discriminator It adopts a multilayer perceptron (MLP) structure.

[0158] Input layer: Acceptance dimension is binary eigenvectors .

[0159] Hidden layers: Multiple fully connected layers (e.g., 3-5 layers), with the number of neurons in each layer gradually decreasing (e.g., 1024 → 512 → 256 → 128). Each layer is followed by a LeakyReLU activation function, with a negative slope typically set to 0.2.

[0160] Output layer: No activation function, directly outputs a real-valued maliciousness score. The smaller the output value, the more benign the sample is judged (low degree of malice), and the larger the output value, the more malicious the sample is judged (high degree of malice).

[0161] The discriminator also functions as a malware detector.

[0162] The purpose of step S51 is to define the neural network structure of the malware detector.

[0163] S52, Calculate the pre-training loss function: ,in, For the discriminator, the parameters are: , For a benign sample distribution, The original distribution of malicious samples, For expectation operators.

[0164] The pre-training loss function is defined as: .

[0165] in: In the implementation, an approximation is made by averaging within batches.

[0166] Minimizing this loss function results in the output value of benign samples becoming smaller (close to negative values) and the output value of malicious samples becoming larger (close to positive values).

[0167] This loss function is the standard form of the WGAN framework, which can effectively widen the distance between the two classes of samples in the discriminator output space, providing a good initial discrimination boundary for subsequent adversarial training.

[0168] The purpose of step S52 is to drive the discriminator to increase the output difference between benign and malicious samples.

[0169] S53, minimize the pre-trained loss function through backpropagation and update the discriminator parameters. This enables the discriminator to have the basic detection capability to distinguish between benign samples and original malicious samples.

[0170] From benign sample set and malicious sample sets Data from different batches were sampled. and .

[0171] Calculate pre-training loss .

[0172] Calculate the loss against the parameters The gradient is used to update the parameters using the Adam optimizer (the learning rate is usually set to 0.0001~0.001).

[0173] Repeated pre-training rounds Repeat this process (typically 5-20 times) until the loss converges.

[0174] The pre-trained discriminator is already able to distinguish between benign and malicious samples with high accuracy, providing a foundation for generating more challenging adversarial samples in subsequent adversarial training.

[0175] The purpose of step S53 is to optimize the discriminator parameters through backpropagation. .

[0176] The purpose of step S5 is to pre-train the discriminator using benign samples and original malicious samples before generating adversarial samples, so that it has basic malware detection capabilities and provides a stable initial detector for subsequent adversarial training.

[0177] Step S6: After the discriminator pre-training is completed, fix the current discriminator parameters, call simulated quantum annealing search to generate adversarial samples from the original malicious samples, mix the benign samples, the original malicious samples and the generated adversarial samples, calculate the enhancement loss function including classification loss and gradient penalty and update the discriminator parameters, iterate until training is completed, and obtain the final malware detector.

[0178] In this embodiment, step S6 may specifically include the following steps: S61, Fix the current discriminator parameters Original malicious samples are sampled from the malicious sample set. A quadratic unconstrained binary optimization objective function is constructed using the current discriminator. Simulated quantum annealing is then used to search for the optimal flip decision vector, generating batches of adversarial samples. .

[0179] Fixed current discriminator parameters .

[0180] From malicious sample set A batch of original malicious samples were sampled. .

[0181] For each sample , with the current Construct the QUBO objective function:

[0182] Calling the SQA algorithm (i.e., the complete process of steps S3 and S4) to solve the problem makes... Minimize the optimal flip decision vector .

[0183] Generate adversarial examples: .

[0184] Obtain adversarial sample batches .

[0185] The SQA algorithm does not rely on gradient information and can achieve global optimal search in high-dimensional discrete space, generating more diverse and aggressive adversarial examples than traditional generator networks.

[0186] The function of step S61 is to: adjust the current discriminator parameters. The SQA algorithm is then invoked to generate high-quality adversarial samples from the original malicious samples.

[0187] S62, sampling batches from a benign sample set. The batches of benign samples and the original malicious sample batches and adversarial sample batches Mix and calculate the enhanced loss function: , in, To counteract sample distribution, The gradient penalty coefficient is... , , This is the gradient of the discriminator on the interpolated samples.

[0188] The first part is the classification loss, which aims to increase the difference between the discriminator output and the two types of malicious samples (original malicious samples + adversarial samples), making the output value of benign samples smaller and the output value of malicious samples larger. Taking the average of the two types of malicious samples is to balance the contribution of the original malicious samples and adversarial samples to the loss, and to avoid one type of sample dominating the gradient direction.

[0189] The latter part is gradient penalty, which forces the discriminator to satisfy the 1-Lipschitz constraint to ensure training stability.

[0190] This loss function enables the discriminator to learn both the original malicious samples and the diverse highly adversarial samples generated by quantum annealing search during training, thus adapting to a wider distribution of adversarial strategies.

[0191] The purpose of step S62 is to simultaneously optimize the discriminator's ability to detect both the original malicious samples and adversarial samples, and to ensure training stability through gradient penalty.

[0192] S63, minimize the enhancement loss function through backpropagation and update the discriminator parameters. The process is iterated until the maximum number of training rounds is reached, and the trained discriminator is saved as the final malware detector.

[0193] From benign sample set Medium sampling batch .

[0194] Batch of benign samples Original malicious sample batches and adversarial sample batches mix.

[0195] Calculate the enhancement loss .

[0196] Minimize via backpropagation Update discriminator parameters using the Adam optimizer .

[0197] Repeated rounds of adversarial training (Typical value 50~200).

[0198] During training, the discriminator accuracy is evaluated on the validation set every few rounds, and the model parameters with the highest validation accuracy are saved as the final detector.

[0199] Final output: After training, discard the SQA search module during online deployment, and only retain the trained discriminator. As a lightweight malware detector.

[0200] The purpose of step S63 is to update the discriminator parameters so that it learns to recognize the high-difficulty adversarial variants generated by SQA and save the optimal model.

[0201] The purpose of step S6 is to inject the adversarial samples generated in step S4 into the discriminator pre-trained in step S5, forming a closed loop of "generation-detection-update". This allows the discriminator to fully learn the high-difficulty adversarial variants generated by quantum heuristic search, and finally output a robust malware detector.

[0202] This invention can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This invention can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0203] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware through computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0204] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0205] Example 2 Further reference Figure 3 As a response to the above Figure 1 The present invention provides an embodiment of a malware adversarial training defense device based on simulated quantum annealing, which is implemented in accordance with the method shown. Figure 1 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0206] like Figure 3 As shown, the malware adversarial training and defense device 70 based on simulated quantum annealing in this embodiment includes: an extraction module 71, a construction module 72, a mapping module 73, a solution module 74, a pre-training module 75, and an iteration module 76. Wherein: Extraction module 71 is used to extract structured discrete features from the original malware sample and binarize them to generate a fixed-length original binary feature vector. Module 72 is used to construct a quadratic unconstrained binary optimization objective function based on the original binary feature vector, which includes adversarial terms, functional equivalence constraints and format legality penalties, thus transforming the adversarial example generation problem into a discrete optimization problem. Mapping module 73 is used to map the quadratic unconstrained binary optimization objective function to the standard form of the Ising model, and to introduce a transverse field through Trotter-Suzuki decomposition to simulate the quantum tunneling effect and construct an effective classical Hamiltonian. The solver module 74 is used to perform simulated quantum annealing search based on the effective classical Hamiltonian. Through multi-path parallel updates, inter-slice information exchange and adaptive temperature adjustment, it solves for the optimal flip decision vector that minimizes the quadratic unconstrained binary optimization objective function and generates adversarial examples based on the optimal flip decision vector. The pre-training module 75 is used to pre-train the WGAN-GP discriminator using benign samples and original malicious samples, so that the discriminator has basic malware detection capabilities. The iteration module 76 is used to fix the current discriminator parameters after the discriminator pre-training is completed, call simulated quantum annealing search to generate adversarial samples from the original malicious samples, mix benign samples, original malicious samples and generated adversarial samples, calculate the enhancement loss function including classification loss and gradient penalty and update the discriminator parameters, iterate until training is completed, and obtain the final malware detector.

[0207] Example 3 As a response to the above Figure 1 The present invention provides another embodiment of a malware adversarial training defense device based on simulated quantum annealing, which is similar to the method shown. Figure 1 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0208] Figure 4 This is a schematic diagram of another embodiment of the malware adversarial training and defense device based on simulated quantum annealing of the present invention; Figure 5 This is a schematic diagram of another embodiment of the malware adversarial training and defense device based on simulated quantum annealing of the present invention. Figure 4 , Figure 5 As shown, this embodiment comprises four subsystems: a feature processing and QUBO construction subsystem, a simulated quantum annealing adversarial example generation subsystem, an adversarial training and detection subsystem, and a system management subsystem. The feature processing and QUBO construction subsystem extracts structured discrete features from the original malware samples and constructs a QUBO objective function that includes constraints on adversarialness, functional equivalence, and format legality. The simulated quantum annealing adversarial example generation subsystem serves as the core search engine, introducing a transverse field based on the path integral Monte Carlo method to simulate the quantum tunneling effect, and globally optimizes the QUBO objective function to generate highly adversarial and functionally equivalent malware adversarial examples. The adversarial training and detection subsystem, based on the WGAN-GP framework, replaces the traditional generator network with a simulated quantum annealing process, injecting the generated adversarial examples into the training process for dynamic adversarial training of the discriminator. The system management subsystem is responsible for system management and human-computer interaction.

[0209] The feature processing and QUBO construction subsystem includes: a data acquisition module, a feature extraction module, and a QUBO objective function construction module.

[0210] The data acquisition module collects Windows executable file samples through various methods, including file system monitoring, network traffic reconstruction, and security event response interfaces. The module supports both batch import and real-time streaming modes, and features sample deduplication, format validation, and preliminary malware screening. It also maintains an original sample library to provide a data foundation for subsequent feature extraction and training.

[0211] The feature extraction module receives PE file samples from the acquisition module and performs parallel extraction of three types of structured discrete features. The PE header field parsing submodule parses key flag fields in the DOS header, NT header, file header, and optional header, treating each flag directly as a binary feature dimension. The API call sequence analysis submodule captures Windows API functions called by the sample through static analysis or dynamic sandbox execution, and statistically analyzes whether each API appears or whether its frequency exceeds a preset threshold based on a pre-built key API vocabulary, forming a binary feature vector. The byte n-gram frequency calculation submodule performs a sliding window scan on the binary content of the sample, extracts n-gram patterns, and performs TF-IDF weighting based on a frequent n-gram vocabulary, followed by threshold truncation for binarization. Finally, the module concatenates and integrates all the above feature dimensions, outputting a fixed-length original binary feature vector.

[0212] The QUBO objective function construction module, based on the extracted original binary feature vectors, formalizes the adversarial example generation problem into a QUBO optimization problem. The module uses the malicious score output by the WGAN-GP discriminator as the optimization objective. At the current sample point, it performs a second-order Taylor expansion, approximating it as a linear and quadratic term in relation to the flip decision vector. PE format verification, import table integrity, entry point validity, and section alignment constraints are encoded as quadratic penalty terms with auxiliary variables through a Boolean-to-polynomial transformation. Linear and quadratic penalties are applied to illegal feature combinations such as simultaneous flipping of mutual exclusion flags and the simultaneous occurrence of rare n-gram combinations. Finally, the module merges the adversarial terms, functional equivalence constraints, and format legality penalty terms, outputting a unified QUBO matrix expression, and supports dynamic configuration of weight parameters.

[0213] The simulated quantum annealing adversarial example generation subsystem includes: the Ising model conversion module, the simulated quantum annealing search module, and the adversarial example output module.

[0214] The Ising model conversion module receives the matrix representation of the QUBO objective function, transforms the binary decision variables into spin variables of the Ising model through variable transformation, calculates the corresponding coupling coefficient matrix and external field coefficient vector, and outputs the standard form of the Ising model, providing a unified energy function interface for the subsequent annealing process.

[0215] The simulated quantum annealing search module implements the core computational logic of the simulated quantum annealing algorithm. The module uses Trotter-Suzuki decomposition to map the original D-dimensional quantum system to a D×P-dimensional classical system, where P is the number of Trotter slices. It dynamically updates the transverse field intensity according to an exponential decay strategy to achieve a smooth annealing process. Each bit in each Trotter slice is sequentially attempted to be flipped, and combined with a fast local energy difference calculation formula, the Metropolis acceptance criterion is used to determine whether to accept the flip, avoiding global repetitive calculation of the energy of the entire configuration space. The module periodically exchanges complete spin configurations between adjacent Trotter slices to promote cooperative searching between different annealing paths and prevent each slice from getting trapped in different local optima. The effective temperature is dynamically adjusted according to the flip acceptance rate to maintain the acceptance rate within the target range, balancing the exploratory nature and convergence of the algorithm.

[0216] After all annealing steps have been completed for all Trotter slices, the adversarial example output module selects the configuration that minimizes the QUBO objective function value from the final spin configurations of each slice as the optimal solution. The optimal spin configuration is inversely converted into an optimal flip decision vector, and then XORed bitwise with the original binary feature vector to generate the adversarial example feature vector. The module outputs the adversarial examples and their corresponding QUBO energy values ​​for use by the adversarial training subsystem.

[0217] The adversarial training and detection subsystem includes: the WGAN-GP discriminator module, the adversarial training scheduling module, and the model management module.

[0218] The WGAN-GP discriminator module implements a discriminator network based on a deep learning framework. The input layer accepts a fixed-length binary feature vector, the hidden layers contain multiple fully connected layers, each followed by a LeakyReLU activation function, and the output layer has no activation function, directly outputting a real-valued maliciousness score. The discriminator also functions as a malware detector; smaller values ​​indicate a more benign sample, while larger values ​​indicate a more malicious sample. The module supports forward inference, loss calculation, and parameter updates for the discriminator.

[0219] The adversarial training scheduling module manages the entire lifecycle of adversarial training. First, the module pre-trains the discriminator using benign samples and original malicious samples, giving it basic malware detection capabilities. In each iteration, the current discriminator parameters are fixed, and the simulated quantum annealing adversarial sample generation subsystem is invoked to generate adversarial samples from the original malicious samples. Then, the benign samples, original malicious samples, and generated adversarial samples are mixed, and an augmentation loss function containing classification loss and gradient penalty is calculated to update the discriminator parameters. The module supports configuration of hyperparameters such as maximum number of iterations, batch size, and gradient penalty coefficient.

[0220] The model management module, based on a model repository, is responsible for storing, versioning, and selecting the optimal model for the discriminator parameters during training. After training, the module retains only the trained discriminator and its parameters, generating a lightweight detection model. During online deployment, this module loads the lightweight model and performs real-time malicious scoring and judgment output on the test samples.

[0221] The system control subsystem includes: the system management module and the human-computer interaction module.

[0222] The system management module provides a web-based management interface for system administrators to perform global configurations, including setting key parameters such as data source management, QUBO weight parameters, simulated quantum annealing hyperparameters (number of trotter slices, number of annealing steps, temperature scheduling strategy, etc.), adversarial training hyperparameters (learning rate, gradient penalty coefficient, etc.), and decision thresholds. Simultaneously, this module collects and displays the system's operational status in real time, including key indicators such as resource utilization (CPU, GPU, memory usage), discriminator inference latency, and detection accuracy, enabling global system control.

[0223] The human-computer interaction module provides a real-time alarm dashboard, displaying detected malware events in list and detail page formats. For samples determined to be malicious by the discriminator, the interface can display information such as its malware score, the feature dimensions that triggered the alarm, and the corresponding adversarial sample generation record. Operations and maintenance personnel can use the interface to manually review the detection results, mark false positives / false negatives, and add handling opinions, realizing a human-machine collaborative malware defense and handling process.

[0224] Example 4 To address the aforementioned technical problems, embodiments of the present invention also provide a computer device. Please refer to [link / reference needed]. Figure 6 , Figure 6 This is a basic structural block diagram of the computer device in this embodiment.

[0225] The aforementioned computer device 8 includes a memory 81, a processor 82, and a network interface 83 that are interconnected via a system bus. It should be noted that only the computer device 8 with components 81, 82, and 83 is shown in the figure; however, it should be understood that it is not required to implement all the shown components, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described herein is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0226] The aforementioned computer devices can be desktop computers, laptops, handheld computers, and cloud servers, among other computing devices. These devices can facilitate human-computer interaction with users through keyboards, mice, remote controls, touchpads, or voice-activated devices.

[0227] The aforementioned memory 81 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the aforementioned memory 81 may be an internal storage unit of the aforementioned computer device 8, such as the hard disk or memory of the computer device 8. In other embodiments, the aforementioned memory 81 may also be an external storage device of the aforementioned computer device 8, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 8. Of course, the aforementioned memory 81 may also include both the internal storage unit and its external storage device of the aforementioned computer device 8. In this embodiment, the aforementioned memory 81 is typically used to store the operating system and various application software installed on the aforementioned computer device 8, such as computer-readable instructions based on the simulated quantum annealing malware adversarial training defense method. In addition, the aforementioned memory 81 can also be used to temporarily store various types of data that have been output or will be output.

[0228] In some embodiments, the processor 82 described above may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 82 is typically used to control the overall operation of the computer device 8. In this embodiment, the processor 82 is used to execute computer-readable instructions stored in the memory 81 or to process data, for example, to execute the computer-readable instructions of the malware adversarial training defense method based on simulated quantum annealing.

[0229] The network interface 83 may include a wireless network interface or a wired network interface, which is typically used to establish a communication connection between the computer device 8 and other electronic devices.

[0230] Example 5 The present invention also provides another embodiment, namely, providing a computer-readable storage medium storing computer-readable instructions that can be executed by at least one processor to cause the at least one processor to perform the steps of the malware adversarial training defense method based on simulated quantum annealing as described above.

[0231] The beneficial effects of implementing the above embodiments are as follows: (1) Global optimization capability: Simulated quantum annealing is used to replace the traditional generator network. The quantum tunneling effect is simulated through the transverse field, enabling the search process to traverse narrow and high potential barriers in the high-dimensional discrete feature space, thus avoiding getting trapped in local optima. Compared with the local optimization method of traditional generative adversarial networks that rely on gradient information, this invention can achieve the optimal perturbation combination search in the global range without relying on gradient information. This helps to overcome the defects of traditional generative adversarial networks that are prone to getting trapped in local optima and pattern collapse, and improves the diversity of adversarial examples and the effectiveness of attacks.

[0232] (2) Highly Usable Adversarial Samples: The adversarial, functional equivalence, and format validity constraints are uniformly modeled using the QUBO objective function. Constraints such as the malicious score output by the WGAN-GP discriminator, the integrity of the PE file format, and the validity of the import table are uniformly encoded into a quadratic unconstrained binary optimization objective function. These three constraints are jointly optimized within the QUBO framework, ensuring that the generated adversarial samples reduce the discriminator's malicious score while strictly maintaining the functional equivalence and format validity of the executable file. This mechanism helps address the problem of existing methods focusing only on adversarial aspects while neglecting sample usability, ensuring that the generated adversarial samples are actually executable, possess complete malicious functionality, and represent real threat samples, thus enhancing the practical defensive value of adversarial training.

[0233] (3) Robust detector: Simulated quantum annealing is used to replace the traditional generator network and is trained in conjunction with the WGAN-GP discriminator. In each round of training, globally optimal adversarial samples are dynamically generated and injected into the training set. During the training process, the discriminator learns both the original malicious samples and the diverse highly adversarial samples generated by quantum annealing search, enabling it to adapt to a wider distribution of adversarial strategies and exhibiting stronger generalization ability and defensive robustness when facing various unknown adversarial evasion attacks.

[0234] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0235] Obviously, the embodiments described above are merely some embodiments of the present invention, not all embodiments. The accompanying drawings show preferred embodiments of the present invention, but do not limit the patent scope of the present invention. The present invention can be implemented in many different forms; rather, these embodiments are provided to provide a more thorough and complete understanding of the disclosure of the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the patent protection scope of this invention.

Claims

1. A malware adversarial training and defense method based on simulated quantum annealing, characterized in that, Includes the following steps: Structured discrete features are extracted from the original malware sample and binarized to generate a fixed-length original binary feature vector; Based on the original binary feature vector, a quadratic unconstrained binary optimization objective function containing adversarial terms, functional equivalence constraints, and format legality penalties is constructed, transforming the adversarial sample generation problem into a discrete optimization problem. The quadratic unconstrained binary optimization objective function is mapped to the standard form of the Ising model, and the transverse field is introduced through Trotter-Suzuki decomposition to simulate the quantum tunneling effect, thus constructing an effective classical Hamiltonian. Based on the effective classical Hamiltonian, simulated quantum annealing search is performed. Through multi-path parallel updates, inter-slice information exchange, and adaptive temperature adjustment, the optimal flip decision vector that minimizes the quadratic unconstrained binary optimization objective function is solved, and adversarial examples are generated based on the optimal flip decision vector. The WGAN-GP discriminator is pre-trained using benign samples and original malicious samples to enable it to have basic malware detection capabilities. After the discriminator pre-training is completed, the current discriminator parameters are fixed, and the simulated quantum annealing search is called to generate adversarial samples from the original malicious samples. The benign samples, the original malicious samples and the generated adversarial samples are mixed, and the enhancement loss function containing classification loss and gradient penalty is calculated and the discriminator parameters are updated. The process is iterated until training is completed, and the final malware detector is obtained.

2. The malware adversarial training and defense method based on simulated quantum annealing according to claim 1, characterized in that, The steps of extracting structured discrete features from the original malware sample and binarizing them to generate a fixed-length original binary feature vector specifically include: Parse the PE structure of Windows executable files, extract the PE header flags, and treat each flag as a binary feature dimension. API call sequences are captured through static analysis or dynamic sandbox execution, and the occurrence of each API is counted based on the key API vocabulary to form a binary feature vector; A sliding window scan is performed on the contents of the malware's binary file to extract byte n-gram frequency features, which are then weighted by TF-IDF and binarized by threshold truncation. The PE header flag features, API call sequence features, and byte n-gram frequency features are concatenated and integrated to generate a fixed-length original binary feature vector. ,in, Represents the binary feature vector of the original malicious sample. This represents the total feature dimension.

3. The malware adversarial training and defense method based on simulated quantum annealing according to claim 1, characterized in that, The step of constructing a quadratic unconstrained binary optimization objective function based on the original binary feature vector, which includes an adversarial term, a functional equivalence constraint term, and a format validity penalty term, and transforming the adversarial example generation problem into a discrete optimization problem, specifically includes: Construct adversarial terms by performing a second-order Taylor expansion of the WGAN-GP discriminator's output on the adversarial examples at the original sample points. This can be approximated as first-order and second-order terms in the form of flipped decision vectors: ,in, For binary flip decision vectors, The discriminator outputs the coefficient vector of the first-order terms at the original sample points. This is the coefficient matrix of the quadratic terms; Construct functionally equivalent constraint terms, encoding PE format validation, import table integrity, entry point validity, and section table alignment constraints into quadratic penalty terms with auxiliary variables using a Boolean function to quadratic polynomial conversion method: ,in, To include the original decision variables and auxiliary binary variables The extended vector, Let be the coefficient vector of the first-order terms. This is the coefficient matrix of the quadratic terms; Construct a format validity penalty term, applying linear and quadratic penalties for single feature flipping and simultaneous flipping of mutually exclusive features: ,in, A linear coefficient vector, It is an upper triangular quadratic coefficient matrix; By combining the adversarial terms, functional equivalence constraints, and format validity penalties, we obtain the complete quadratic unconstrained bivariate optimization objective function: ,in, This is the merged upper triangular quadratic coefficient matrix. This is the vector of coefficients for the combined linear terms.

4. The malware adversarial training and defense method based on simulated quantum annealing according to claim 1, characterized in that, The steps of mapping the quadratic unconstrained binary optimization objective function to the standard form of the Ising model and constructing an effective classical Hamiltonian by introducing a transverse field through Trotter-Suzuki decomposition to simulate the quantum tunneling effect specifically include: By transforming variables, the binary decision variables in the quadratic unconstrained binary optimization objective function are mapped to spin variables of the Ising model. The transformation relationship is as follows: ,in, The first eigenvector of the binary feature vector One portion, For the corresponding Ising spin variable; Transform the quadratic unconstrained bivariate optimization objective function into the standard form of the Ising model: ,in, For spin and The coupling coefficient between them For the first The external field coefficient of each spin; Introducing transverse field Hamiltonian Furthermore, the Trotter-Suzuki decomposition is used to map the quantum system to a classical system, yielding the effective classical Hamiltonian: ,in, For the number of Trotter slices, For the reverse effective temperature, For effective temperature, The transverse field intensity decays over time. For the first The first slice One spin.

5. The malware adversarial training and defense method based on simulated quantum annealing according to claim 1, characterized in that, The steps of performing simulated quantum annealing search based on the effective classical Hamiltonian, solving for the optimal flip decision vector that minimizes the quadratic unconstrained binary optimization objective function through multi-path parallel updates, inter-slice information exchange, and adaptive temperature adjustment, and generating adversarial examples based on the optimal flip decision vector specifically include: The transverse field strength is updated according to the exponential decay scheduling strategy. Each bit of each Trotter slice is traversed sequentially to attempt to flip. The energy change before and after the flip is quickly calculated using the local energy difference formula. The Metropolis acceptance criterion is used to determine whether to accept the flip, thus realizing multi-path parallel updating. Every fixed number of steps, the complete spin configuration is swapped between adjacent Trotter slices, with the swap acceptance probability being: ,in, For the first Effective energy of the slice; and dynamically adjust the effective temperature based on the flipping acceptance rate: ,in, To achieve the acceptance rate of the flip, This is the gain coefficient; After completing all annealing steps, the configuration that minimizes the quadratic unconstrained binary optimization objective function value is selected from the final spin configurations of all Trotter slices as the optimal spin configuration, which is then converted into the optimal flip decision vector. Generate adversarial examples as follows: ,in, This indicates a bitwise XOR operation. The original binary feature vector, This is the feature vector of the generated adversarial sample.

6. The malware adversarial training and defense method based on simulated quantum annealing according to claim 1, characterized in that, The step of pre-training the WGAN-GP discriminator using benign samples and original malicious samples to enable the discriminator to have basic malware detection capabilities specifically includes: A WGAN-GP discriminator network is constructed, which adopts a multilayer perceptron structure. The input layer accepts a fixed-length binary feature vector, the hidden layer is a fully connected layer with a LeakyReLU activation function, and the output layer has no activation function and directly outputs a real value malicious score. Calculate the pre-training loss function: ,in, For the discriminator, the parameters are: , For a benign sample distribution, The original distribution of malicious samples, For expectation operators; The discriminator parameters are updated by minimizing the pre-trained loss function through backpropagation. This enables the discriminator to have the basic detection capability to distinguish between benign samples and original malicious samples.

7. The malware adversarial training and defense method based on simulated quantum annealing according to any one of claims 1 to 6, characterized in that, The steps of pre-training the discriminator, fixing the current discriminator parameters, calling the simulated quantum annealing search to generate adversarial samples from the original malicious samples, mixing the benign samples, the original malicious samples, and the generated adversarial samples, calculating the enhancement loss function including classification loss and gradient penalty, updating the discriminator parameters, and iterating until training is complete to obtain the final malware detector specifically include: Fixed current discriminator parameters Original malicious samples are sampled from the malicious sample set. A quadratic unconstrained binary optimization objective function is constructed using the current discriminator. Simulated quantum annealing is then used to search for the optimal flip decision vector, generating batches of adversarial samples. ; Sampling batches from benign sample sets The batches of benign samples and the original malicious sample batches and adversarial sample batches Mix and calculate the enhanced loss function: ,in, To counteract sample distribution, The gradient penalty coefficient is... , , The gradient of the discriminator on the interpolated samples; The discriminator parameters are updated by minimizing the enhancement loss function through backpropagation. The process is iterated until the maximum number of training rounds is reached, and the trained discriminator is saved as the final malware detector.

8. A malware adversarial training and defense device based on simulated quantum annealing, characterized in that, include: The extraction module is used to extract structured discrete features from the original malware sample and binarize them to generate a fixed-length original binary feature vector. The construction module is used to construct a quadratic unconstrained binary optimization objective function based on the original binary feature vector, which includes adversarial terms, functional equivalence constraints, and format legality penalties, thereby transforming the adversarial example generation problem into a discrete optimization problem. The mapping module is used to map the quadratic unconstrained binary optimization objective function to the standard form of the Ising model, and to introduce a transverse field through Trotter-Suzuki decomposition to simulate the quantum tunneling effect and construct an effective classical Hamiltonian. The solution module is used to perform simulated quantum annealing search based on the effective classical Hamiltonian. Through multi-path parallel updates, inter-slice information exchange and adaptive temperature adjustment, it solves for the optimal flip decision vector that minimizes the quadratic unconstrained binary optimization objective function, and generates adversarial examples based on the optimal flip decision vector. The pre-training module is used to pre-train the WGAN-GP discriminator using benign samples and original malicious samples, so that the discriminator has basic malware detection capabilities. The iterative module is used to fix the current discriminator parameters after the discriminator pre-training is completed, call the simulated quantum annealing search to generate adversarial samples from the original malicious samples, mix the benign samples, the original malicious samples and the generated adversarial samples, calculate the enhancement loss function including classification loss and gradient penalty and update the discriminator parameters, iterate until training is completed, and obtain the final malware detector.

9. A computer device, characterized in that, The method includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the malware adversarial training and defense method based on simulated quantum annealing as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the malware adversarial training and defense method based on simulated quantum annealing as described in any one of claims 1 to 7.

Images