Unbalanced malware detection enhancement method based on cwgan-gp data augmentation and textcnn-transformer fusion

Abstract

This invention discloses an imbalanced malware detection enhancement method based on the fusion of CWGAN-GP data augmentation and TEXTCNN–TRANSFORMER, comprising the following steps: S1, data acquisition and preprocessing: running an executable file in a controlled sandbox environment to dynamically capture its API call sequence, standardizing the API call sequence, and mapping it into a dense vector sequence; S2, data augmentation based on Conditional Wasserstein Generative Adversarial Network (CWGAN-GP) with gradient penalty mechanism: constructing a CWGAN-GP model conditioned on the category labels of minority malware classes, the model including a conditional generator G and a discriminator D with gradient penalty; inputting the minority malware samples obtained in step S1 and their corresponding category labels into the CWGAN-GP model for adversarial training until the model converges. The advantages of this invention are: high-quality data augmentation with semantic fidelity; comprehensive and complementary feature extraction; significant end-to-end performance improvement, especially in minority class identification; and strong model robustness and generalization ability.

Description

Technical Field

[0001] This invention relates to the field of malware detection technology, specifically to an imbalanced malware detection enhancement method based on the fusion of CWGAN-GP data augmentation and TEXTCNN–TRANSFORMER. Background Technology

[0002] In the field of behavior-based malware detection, existing technologies mainly rely on analyzing API call sequences generated during program runtime and combining them with machine learning or deep learning models for classification. Traditional methods such as Support Vector Machines (SVM) and Random Forests (RF) typically require manual feature extraction (e.g., n-gram statistical features), which easily leads to high-dimensional sparse feature spaces and limited generalization ability. In recent years, deep learning methods have been widely used: Convolutional Neural Networks (TextCNN) excel at capturing local API call patterns, but their receptive field is limited, making it difficult to model long-distance dependencies; Recurrent Neural Networks (such as BiLSTM and BiGRU) can handle temporal information, but they are insufficient in extracting fine-grained local features and are susceptible to the vanishing gradient problem. To balance local and global information, researchers have proposed hybrid models (such as TextCNN-BiLSTM), but they still lack the ability to effectively model global semantic dependencies between arbitrary positions in the API sequence. Existing technologies have the following shortcomings directly related to this invention: Incomplete feature extraction capabilities: Models using only CNN or RNN architectures cannot simultaneously and effectively capture both local discriminative patterns (such as combinations of atomic operations in specific attack phases) and global long-range dependencies (such as the logical connection between environmental reconnaissance and malicious payload execution separated by hundreds of calls) in malware API call sequences. Low semantic fidelity of data augmentation methods: For the class imbalance problem, existing data augmentation techniques (such as SMOTE, VAE, and traditional GAN) cannot effectively maintain the semantic structure and temporal logic of the original malicious behavior when generating API sequences. SMOTE's linear interpolation destroys the legitimacy of discrete symbol sequences; VAE tends to generate averaged and ambiguous samples due to KL divergence constraints; traditional GANs, due to training instability and pattern collapse, struggle to generate diverse and high-quality minority class samples. This results in augmented data not only failing to effectively improve the model's ability to identify the minority class but also potentially introducing noise. Generative models have insufficient ability to model long sequences: GAN architectures, which use CNNs or RNNs as the backbone of the generator, struggle to effectively capture long-range dependencies when dealing with API call sequences that can reach thousands of characters in length, thus limiting the semantic richness and behavioral realism of the synthesized samples. Therefore, a new method is proposed to address these issues. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides an imbalanced malware detection enhancement method based on the fusion of CWGAN-GP data augmentation and TEXTCNN–TRANSFORMER. This method has advantages such as high data augmentation quality, semantic fidelity, comprehensive feature extraction, strong complementarity, significant end-to-end performance improvement, especially improved minority class recognition, and strong model robustness and generalization ability, thus solving the problems existing in the background technologies.

[0004] To achieve the above objectives, the present invention provides the following technical solution: its core lies in the synergy of two innovative modules: a CWGAN-GP semantic data augmentation module for generating high-quality minority class samples, and a TextCNN-Transformer heterogeneous feature fusion module for extracting complementary features.

[0005] (I) CWGAN-GP Semantic Data Augmentation Module This module is used to generate synthetic API sequences that are highly similar to real minority class samples in terms of behavioral semantics and statistical distribution.

[0006] Model Structure: This module is based on the Wasserstein Generative Adversarial Network (WGAN) framework and introduces conditional generation and gradient penalty (GP) to form CWGAN-GP. It includes a conditional generator G and a discriminator D with gradient penalty.

[0007] Generator G: Takes as input a concatenation [z, c] of a random noise vector z and a specified minority malware category label c. The generator is typically composed of stacked fully connected layers and deconvolutional layers (or one-dimensional transposed convolutional layers), and finally outputs a synthetic high-dimensional vector sequence that simulates a vectorized representation of a real API call sequence.

[0008] Discriminator D: The input is the concatenation of the real API sequence vector x and its corresponding label c [x, c], or the concatenation of the generated sample G(z,c) and the same label c [G(z,c), c]. The discriminator consists of a series of one-dimensional convolutional layers or fully connected layers, and finally outputs a scalar (called the Wasserstein distance estimate) to evaluate the authenticity of the input sample; the larger the value, the more authentic the sample.

[0009] Gradient penalty mechanism: This is crucial for stable training. Traditional WGAN satisfies the 1-Lipschitz constraint of the discriminator through weight pruning, but this can lead to vanishing or exploding gradients. This invention explicitly adds a gradient penalty term to the discriminator's loss function. This penalty term calculates the gradient norm of the discriminator with respect to the randomly interpolated sample x^ on the line connecting the real and generated samples, and penalizes deviations from 1. The loss function is as follows: Discriminator loss: ; Generator loss: L_G = - E[D(G(z, c), c)]; Where E represents the expectation and λ is the gradient penalty coefficient. This mechanism effectively stabilizes adversarial training, avoids mode collapse, and enables the generator to produce diverse and high-quality minority class API sequences.

[0010] (ii) TextCNN-Transformer Heterogeneous Feature Fusion Module This module receives an enhanced balanced dataset and performs deep feature extraction on the input API sequence.

[0011] Multi-scale TextCNN Local Feature Extractor: This part is responsible for capturing short-range, local API combination patterns in the sequence (e.g., fixed combinations of several consecutive APIs in a specific attack phase). Specifically: The input is an API sequence matrix after the embedding layer has been processed.

[0012] The input is convolved in parallel using multiple one-dimensional convolutional kernels of different widths (e.g., 3, 4, 5). A convolutional kernel of width k can detect consecutive segments of length k in the sequence (i.e., k-gram patterns).

[0013] Each convolutional kernel produces a feature map, which is then subjected to max-over-time pooling to extract the most salient local features captured by that kernel.

[0014] The feature vectors pooled from convolutional kernels of all different scales are concatenated to form a feature representation that integrates multi-granularity local information. This representation is rich in "detailed fingerprints" of malicious behavior.

[0015] Transformer Global Context Modeler: This part is responsible for modeling long-range dependencies between any two positional features in the entire API call sequence. Specifically: Use the local feature sequence output by TextCNN as input.

[0016] The self-attention mechanism is at its core. It computes a "query" vector, a "key" vector, and a "value" vector for each position in the sequence. By calculating the similarity (dot product) between the query and all keys, a set of weights is obtained, which is used to perform a weighted summation of all values. This allows the output at any position in the sequence to focus on information from all positions in the sequence, thereby capturing the logical connections, such as between "environmental reconnaissance" and "final attack," even if separated by hundreds of calls.

[0017] Multi-head attention: The self-attention process is executed in parallel multiple times (i.e., multiple "heads"), each head learns the dependencies in different representation subspaces, and the results are finally merged, which enhances the expressive power of the model.

[0018] Feedforward network with residual connections: Each attention sublayer is followed by a feedforward neural network, and residual connections and layer normalization are used to accelerate training and alleviate gradient vanishing.

[0019] By stacking multiple such Transformer encoder layers, the model can construct complex, hierarchical global behavioral semantic representations.

[0020] Feature fusion and classification: Finally, the feature representation output from the Transformer encoder, which incorporates local and global information, is fed into a fully connected classification layer, and the final malware category probability distribution is output through the Softmax function.

[0021] Compared with existing technologies, this invention provides an imbalanced malware detection enhancement method based on the fusion of CWGAN-GP data augmentation and TEXTCNN–TRANSFORMER, which has the following beneficial effects: This invention presents an imbalanced malware detection augmentation method based on the fusion of CWGAN-GP data augmentation and TEXTCNN–TRANSFORMER, achieving high-quality data augmentation and semantic fidelity. The proposed CWGAN-GP semantic data augmentation method ensures controllable sample categories by introducing conditional generation and stabilizes training through a gradient penalty mechanism, fundamentally overcoming the pattern collapse problems of traditional GANs and the ambiguous generation problems of VAEs. It can generate high-quality synthetic samples that conform to the minority class data distribution while maintaining the consistency of the original API sequence's behavioral logic and semantics, effectively mitigating model bias caused by class imbalance from the data source.

[0022] Comprehensive and complementary feature extraction: The TextCNN-Transformer heterogeneous feature fusion architecture created in this invention fully leverages the advantages of both models. The TextCNN branch acts like a "microscope," accurately capturing short-range, discriminative local attack patterns (combinations of atomic operations) in the sequence. The Transformer branch acts like a "wide-angle lens," dynamically establishing logical connections between long-distance API calls throughout the entire behavior chain through a self-attention mechanism. The cascading of the two achieves a comprehensive and thorough characterization of malware behavior, from microscopic local patterns to macroscopic execution logic, with feature representation capabilities far exceeding those of single or simple hybrid models.

[0023] Significant end-to-end performance improvements, particularly in minority class identification: By combining high-quality data augmentation with a powerful feature extraction model, this invention forms an optimized systems engineering solution. Experiments show that on the real Alibaba Cloud security dataset, this solution significantly improves the overall performance of the model. More importantly, it achieves a breakthrough improvement in its ability to detect minority malware classes (such as worms and backdoors) that were previously difficult to identify. For example, the F1 score for the "worm" category increased from near 0 to 0.3846, and the macro-average F1 score increased from 0.7068 to 0.8273, demonstrating the great value of this invention in achieving more balanced and reliable malware classification.

[0024] The model exhibits strong robustness and generalization ability: Due to the high-quality expansion of training data and the powerful feature learning capability of the model itself, the final trained classifier has better robustness and generalization ability against unseen malware variants and adversarial samples, adapting to the actual needs of the dynamic evolution of current network security attack and defense. Attached Figure Description

[0025] Figure 1 This diagram illustrates the steps of the imbalanced malware detection enhancement method proposed in this invention, which is based on the fusion of CWGAN-GP data augmentation and TEXTCNN–TRANSFORMER. Figure 2 This is a schematic diagram of the model structure of the CWGAN-GP data augmentation module used in the imbalanced malware detection enhancement method based on the fusion of CWGAN-GP data augmentation and TEXTCNN–TRANSFORMER proposed in this invention. Figure 3 This is a flowchart illustrating the execution of the imbalanced malware detection enhancement method proposed in this invention, which is based on the fusion of CWGAN-GP data augmentation and TEXTCNN–TRANSFORMER. Detailed Implementation

[0026] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] Please see Figure 1An imbalanced malware detection enhancement method based on the fusion of CWGAN-GP data augmentation and TEXTCNN–TRANSFORMER is characterized by the following steps: S1, data acquisition and preprocessing: running an executable file in a controlled sandbox environment, dynamically capturing its API call sequence, standardizing the API call sequence, and mapping it into a dense vector sequence; S2. Data Augmentation Based on Conditional Wasserstein Generative Adversarial Network (CWGAN-GP) with Gradient Penalty Mechanism: Construct a CWGAN-GP model conditioned on the category labels of minority malware classes. The model includes a conditional generator G and a discriminator D with gradient penalty. Input the minority malware samples and their corresponding category labels obtained in step S1 into the CWGAN-GP model for adversarial training until the model converges. The loss function of the discriminator D includes a gradient penalty term for enforcing 1-Lipschitz constraints. Use the trained conditional generator G to generate synthetic high-fidelity, diverse minority malware API sequences. S3. Hybrid Feature Extraction and Classification: Construct a hybrid feature extraction network consisting of a cascaded TextCNN module and a Transformer encoder module; S31. The input sequence is processed using the TextCNN module: multiple convolution kernels of different scales are used to perform parallel convolution operations on the input API sequence vector to extract local features at different n-gram levels. Max pooling is performed on the feature map generated by each convolution kernel, and all pooled local feature vectors are concatenated to form a semantic representation that integrates multi-scale local features. S32. Using the Transformer encoder module to perform global modeling of local features: Input the local feature sequence obtained in step S31 into the Transformer encoder, and dynamically calculate the correlation weight between any two position features in the sequence through its self-attention mechanism, thereby capturing the long-distance semantic dependency in the entire API call sequence, and outputting the final feature representation that integrates local discriminative patterns and global semantic dependencies. S33. Classification: Input the final feature representation obtained in step S32 into the fully connected classification layer to obtain the malware classification result.

[0028] In step S2, the conditional generator G takes as input a concatenated vector [z, c] of random noise vector z and class label c of minority malware, and outputs a synthesized API sequence vector. The discriminator D takes as input a concatenated vector [x, c] of real samples and class labels or a concatenated vector [G(z,c), c] of generated samples and the same class label, and outputs a scalar to evaluate the authenticity of the input. The gradient penalty term is calculated based on the gradient norm of the discriminator D with respect to the randomly interpolated samples, which are obtained by linear interpolation of real samples and generated samples in the feature space. This defines the specific input and output forms of the generator G and discriminator D in the CWGAN-GP module, as well as the calculation method of the key gradient penalty term. This clarifies the specific technical means to achieve stable and high-quality generative adversarial training.

[0029] In step S2, the loss function L_D of the discriminator D is specifically as follows: , Where E[·] represents the expectation, x is the real sample, z is random noise, c is the class label, x^ is the interpolated sample randomly sampled from the line connecting the real sample x and the generated sample G(z, c), and λ is the gradient penalty coefficient. This formula clarifies the combination of Wasserstein distance estimation, real / generated sample difference, and gradient penalty term, and is the core formula for achieving training stability in this invention.

[0030] In step S3, the TextCNN module employs three different scales of one-dimensional convolutional kernels with window sizes of 3, 4, and 5, respectively. The number of kernels at each scale is the same to extract local continuous patterns of different lengths in the API sequence in parallel. This is a typical and effective configuration for capturing local combination patterns of different lengths (such as 3-gram, 4-gram, and 5-gram patterns) in API call sequences, clearly defining the granularity of local feature extraction.

[0031] In step S3, the Transformer encoder consists of L identical encoder layers stacked together. Each encoder layer contains a multi-head self-attention sublayer and a feedforward neural network sublayer, with residual connections and layer normalization operations following each sublayer. The standard component structure inside the Transformer encoder is described, including multi-head self-attention, feedforward network, residual connections, and layer normalization. This defines the specific, advanced neural network architecture used to achieve global dependency modeling.

[0032] In step S3, before inputting the local feature sequence into the Transformer encoder, a learnable classification flag vector is added at the beginning of the sequence. The vector at the corresponding position output by the Transformer encoder is used as the final feature representation. This is an efficient sequence aggregation technique, where the output at the corresponding position can aggregate the information of the entire sequence. It is commonly used in classification tasks and clarifies the specific method for obtaining the final global feature representation.

[0033] Devices for detecting imbalanced malware include: The data preprocessing module is used to capture the API call sequence of executable files in the sandbox and perform normalization and vectorization; A semantic data augmentation module, including a CWGAN-GP model based on claim 2 or 3, for generating high-fidelity minority malware API sequences to balance the training dataset; The feature extraction and classification module includes a TextCNN–Transformer hybrid network based on claim 4 or 5, used to extract features from the API sequence and output classification results. The method steps are mapped to specific functional modules such as data preprocessing, semantic data augmentation, feature extraction, and classification.

[0034] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the steps of the method as described in any one of claims 1 to 6. A computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the steps of the method described in this invention.

[0035] Example 1: Implementation of a complete malware detection system based on the method of the present invention This embodiment demonstrates the construction and workflow of a complete malware detection system based on the present invention.

[0036] Step 1: Data Collection and Preprocessing Collect runtime behavior logs from a large number of Windows executable files (.exe, .dll) from public datasets (such as BODMAS, EMBER) or internal sandboxes. Execute samples in the Cuckoo Sandbox or any behavior monitoring sandbox, capturing all API call sequences and parameters generated. Clean the raw API sequences: remove API calls that are strongly correlated with the system environment and lack discriminative power (such as GetTickCount), and truncate or pad the sequences to normalize all sequences to a fixed length L (e.g., L=1024). Subsequently, use Word2Vec or train an embedding layer to map each discrete API name to a d-dimensional dense vector (e.g., d=128). Finally, each sample is represented as an L×d matrix.

[0037] Step 2: CWGAN-GP Model Construction and Training for Data Augmentation Construction: Define a generator G and a discriminator D. Generator G: Input is a 100-dimensional random noise z and one-hot encoded class labels c (assuming C classes). After concatenation, it is projected through a fully connected layer to reshape it into a 2D tensor, then passed through three 1D transposed convolutional layers with strides of 1 (512, 256, and 128 channels respectively), and finally outputs an L×d synthesized sequence through a convolutional layer with a kernel of 1. Discriminator D: Input is an L×(d+C) matrix (the sequence is broadcast concatenated with the class labels concatenated at the end). It passes through four 1D convolutional layers (128, 256, 512, and 1024 channels respectively), each convolution followed by LeakyReLU activation and Dropout. Finally, after global average pooling, it outputs a scalar through a fully connected layer.

[0038] Training: Separate minority class samples from the preprocessed dataset. Set the gradient penalty coefficient λ=10. Train D and G alternately using the Adam optimizer (β1=0.5, β2=0.9). First, update D 5 times, then update G once. In each training batch, sample a batch (x, c) from the real minority class data, sample noise z from the standard normal distribution, and compute the gradient penalty term at the linear interpolation point x^. Train until the discriminator loss and generator loss converge.

[0039] Generation: Using a trained generator G, input labels c of different categories and random noise z, generate synthetic API sequence vectors of the specified categories, and add them to the original training set to balance the number of samples in each category.

[0040] Step 3: Build and train the TextCNN-Transformer classification model The TextCNN part uses three types of one-dimensional convolutional kernels with sizes of 3, 4, and 5, totaling 256 kernels each. After convolution and ReLU activation of the input sequence, max pooling is performed on each feature map to obtain three 256-dimensional vectors, which are then concatenated into a 768-dimensional local feature vector. To adapt to the Transformer, this vector sequence is treated as a "sequence" of length 1, or it is extended into a longer sequence representation through a linear projection layer.

[0041] Transformer Part: The Transformer encoder layers are set to N=4, the attention heads to h=8, and the hidden layer dimension of the feedforward network is 2048. A learnable [CLS] flag vector is added before the input sequence. After Transformer encoding, the output vector corresponding to the [CLS] position is taken as the global feature representation of the entire sequence.

[0042] Classification Head: The above global feature representation is input into a two-layer fully connected network (with Dropout and ReLU activation in between), and finally the class probability is output through the Softmax layer.

[0043] Model Training: Train the classification model using the augmented balanced dataset from step 2. Use cross-entropy loss as the loss function and Adam as the optimizer. Monitor performance on the validation set during training and use early stopping to prevent overfitting.

[0044] Step 4: Malware Detection For new, unknown executables, their API sequences are first executed in a sandbox and captured, undergoing preprocessing and vectorization steps similar to those used during training. The processed sequences are then input into a pre-trained TextCNN-Transformer classification model, and the model's output probability distribution represents the prediction of which malware family it belongs to.

[0045] Example 2: Model configuration optimization for long sequence processing This embodiment focuses on illustrating an optimized implementation of the method of the present invention when dealing with particularly long API call sequences (such as L=2048 or longer).

[0046] Step 1: Sequence Segmentation and Embedding Optimization For extremely long sequences, direct processing may exceed computational resource limitations. A segmentation strategy can be adopted: divide the sequence of length L into K non-overlapping segments, each segment having a length of L / K. Each segment independently extracts local features using a lightweight TextCNN (the number of convolutional kernels can be reduced, for example, 64 kernels per scale), outputting a local feature vector for each segment. Then, these K local feature vectors are concatenated sequentially to form a new sequence of length K, which serves as the input to the subsequent Transformer. This is equivalent to first using a downsampled TextCNN to extract and compress local features from the original sequence.

[0047] Step 2: Depth and Sparse Attention in Transformer Encoders To effectively model dependencies between segments in long sequences, the number of layers in the Transformer encoder can be increased (e.g., N=6 or 8). Meanwhile, to reduce computational complexity, sparse attention mechanisms can be introduced in some attention layers, such as restricting attention to segments within a certain window before and after each position, or employing a random attention pattern. This can significantly improve training and inference efficiency while ensuring the model captures the main long-range dependencies.

[0048] Step 3: Adapting the CWGAN-GP generator During the data augmentation phase, the final output dimension of the generator G needs to match the structure of the segmented sequence. For example, to generate a sequence of K segments, the generator will ultimately output a K × d_f matrix, where d_f is the dimension of the local feature vectors. The architecture of the discriminator D is also adjusted accordingly to receive input in this format.

[0049] Step 4: Hierarchical Classification Before the classification head, in addition to utilizing the [CLS] vector output by the Transformer, the features encoded by the Transformer for each segment can also be subjected to average pooling or max pooling. The pooled features are then concatenated with the [CLS] vector before being fed into the fully connected layer for classification. This helps the model utilize both global semantic information and segment-level detailed information simultaneously.

[0050] Through the above optimizations, the method of the present invention can effectively handle longer behavioral sequences and is suitable for detecting malware with complex and long-cycle behaviors, such as persistent attacks and advanced persistent threats (APTs).

[0051] In summary, this imbalanced malware detection augmentation method based on the fusion of CWGAN-GP data augmentation and TEXTCNN–TRANSFORMER achieves high-quality data augmentation and semantic fidelity. The proposed CWGAN-GP semantic data augmentation method ensures controllable sample categories by introducing conditional generation and stabilizes training through a gradient penalty mechanism, fundamentally overcoming the pattern collapse problem of traditional GANs and the ambiguous generation problem of VAEs. It can generate high-quality synthetic samples that conform to the minority class data distribution while maintaining the consistency of the original API sequence's behavioral logic and semantics, effectively mitigating model bias caused by class imbalance from the data source.

[0052] Comprehensive and complementary feature extraction: The TextCNN-Transformer heterogeneous feature fusion architecture created in this invention fully leverages the advantages of both models. The TextCNN branch acts like a "microscope," accurately capturing short-range, discriminative local attack patterns (combinations of atomic operations) in the sequence. The Transformer branch acts like a "wide-angle lens," dynamically establishing logical connections between long-distance API calls throughout the entire behavior chain through a self-attention mechanism. The cascading of the two achieves a comprehensive and thorough characterization of malware behavior, from microscopic local patterns to macroscopic execution logic, with feature representation capabilities far exceeding those of single or simple hybrid models.

[0053] Significant end-to-end performance improvements, particularly in minority class identification: By combining high-quality data augmentation with a powerful feature extraction model, this invention forms an optimized systems engineering solution. Experiments show that on the real Alibaba Cloud security dataset, this solution significantly improves the overall performance of the model. More importantly, it achieves a breakthrough improvement in its ability to detect minority malware classes (such as worms and backdoors) that were previously difficult to identify. For example, the F1 score for the "worm" category increased from near 0 to 0.3846, and the macro-average F1 score increased from 0.7068 to 0.8273, demonstrating the great value of this invention in achieving more balanced and reliable malware classification.

[0054] The model exhibits strong robustness and generalization ability: Due to the high-quality expansion of training data and the powerful feature learning capability of the model itself, the final trained classifier has better robustness and generalization ability against unseen malware variants and adversarial samples, adapting to the actual needs of the dynamic evolution of current network security attack and defense.

[0055] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0056] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An imbalanced malware detection enhancement method based on CWGAN-GP data augmentation and TEXTCNN-TRANSFORMER fusion, characterized in that, Includes the following steps, S1. Data Acquisition and Preprocessing: Run the executable file in a controlled sandbox environment, dynamically capture its API call sequence, standardize the API call sequence, and map it into a dense vector sequence; S2. Data Augmentation Based on Conditional Wasserstein Generative Adversarial Network (CWGAN-GP) with Gradient Penalty Mechanism: Construct a CWGAN-GP model conditioned on the category labels of minority malware classes. The model includes a conditional generator G and a discriminator D with gradient penalty. Input the minority malware samples and their corresponding category labels obtained in step S1 into the CWGAN-GP model for adversarial training until the model converges. The loss function of the discriminator D includes a gradient penalty term for enforcing 1-Lipschitz constraints. Use the trained conditional generator G to generate synthetic high-fidelity, diverse minority malware API sequences. S3. Hybrid Feature Extraction and Classification: Construct a hybrid feature extraction network consisting of a cascaded TextCNN module and a Transformer encoder module; S31. The input sequence is processed using the TextCNN module: multiple convolution kernels of different scales are used to perform parallel convolution operations on the input API sequence vector to extract local features at different n-gram levels. Max pooling is performed on the feature map generated by each convolution kernel, and all pooled local feature vectors are concatenated to form a semantic representation that integrates multi-scale local features. S32. Using the Transformer encoder module to perform global modeling of local features: Input the local feature sequence obtained in step S31 into the Transformer encoder, and dynamically calculate the correlation weight between any two position features in the sequence through its self-attention mechanism, thereby capturing the long-distance semantic dependency in the entire API call sequence, and outputting the final feature representation that integrates local discriminative patterns and global semantic dependencies. S33. Classification: Input the final feature representation obtained in step S32 into the fully connected classification layer to obtain the malware classification result.

2. The method of claim 1, wherein: In step S2, the input to the condition generator G is a concatenated vector [z, c] of random noise vector z and class label c of minority malware, and the output is a synthesized API sequence vector; the input to the discriminator D is a concatenated vector [x, c] of real sample and class label or a concatenated vector [G(z, c), c] of generated sample and the same class label, and the output is a scalar to evaluate the authenticity of the input; the gradient penalty term is calculated based on the gradient norm of the discriminator D on the randomly interpolated sample, which is obtained by linear interpolation of real sample and generated sample in feature space.

3. The method of claim 1, wherein: In step S2, the loss function L_D of the discriminator D is specifically: wherein E[·] represents expectation, x is a real sample, z is random noise, c is a class label, x^ is an interpolation sample randomly sampled on the line connecting the real sample x and the generated sample G(z, c), and λ is a gradient penalty coefficient.

4. The method of claim 1, wherein: In step S3, the TextCNN module uses three different scales of one-dimensional convolutional kernels with window sizes of 3, 4, and 5 respectively. The number of convolutional kernels at each scale is the same to extract local continuous patterns of different lengths in the API sequence in parallel.

5. The method of claim 1, wherein: In step S3, the Transformer encoder is composed of L identical encoder layers stacked together. Each encoder layer contains a multi-head self-attention sublayer and a feedforward neural network sublayer. Each sublayer is followed by a residual connection and a layer normalization operation.

6. The method according to any one of claims 1 to 5, characterized in that: In step S3, before inputting the local feature sequence into the Transformer encoder, a learnable classification flag vector is added at the beginning of the sequence, and the vector at the corresponding position output by the Transformer encoder is used as the final feature representation.

7. An apparatus for unbalanced malware detection, the apparatus comprising: include: The data preprocessing module is used to capture the API call sequence of executable files in the sandbox and perform normalization and vectorization; A semantic data augmentation module, including a CWGAN-GP model based on claim 2 or 3, for generating high-fidelity minority malware API sequences to balance the training dataset; The feature extraction and classification module includes a TextCNN–Transformer hybrid network based on claim 4 or 5, used to extract features from the API sequence and output classification results.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, When the program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 6.

Images