Software clustering method, device and storage medium

Abstract

The application discloses a software clustering method and device and a storage medium, relates to the technical field of computer security, and comprises the following steps: extracting an operation code sequence corresponding to a public data set from a public data set containing disassembly files of a plurality of software; performing one-hot encoding on operation codes in the operation code sequence according to frequency to obtain a general one-hot encoding mapping table corresponding to the operation codes; determining a target operation code sequence corresponding to a software to be clustered, generating a vectorized document corresponding to the software to be clustered according to the general one-hot encoding mapping table and the target operation code sequence; remodeling the vectorized document into an initial grayscale image, and constructing a software feature map corresponding to the software to be clustered based on the initial grayscale image; and performing clustering analysis on each software feature map by using a clustering algorithm to obtain a category label of each software to be clustered, so that the technical problem of low clustering precision caused by sparse data of an existing malicious software clustering method on a small-scale sample data set is solved, and high-precision clustering division is realized.

Description

Technical Field

[0001] This application relates to the field of computer security technology, and in particular to a software clustering method, device and storage medium. Background Technology

[0002] In the field of malware analysis, the malware to be analyzed is typically treated as a document. Term Frequency-Inverse Document Frequency (TF-IDF) is used to calculate the importance of each n-gram phrase in the document, and the malware to be analyzed is vectorized based on its importance. Then, based on the vectorization results, clustering algorithms are used to group the malware for identification.

[0003] Since the core of TF-IDF lies in evaluating the discriminative power of a feature across the entire dataset through Inverse Document Frequency (IDF), the calculation of IDF requires a sufficient number of documents (i.e., malware samples) to obtain a reliable statistical distribution. When faced with a small sample set, the sparsity of the data can lead to inaccurate IDF estimates, making it impossible to effectively capture and distinguish the essential characteristics of different families. This results in a sharp drop in clustering accuracy, making it difficult to obtain meaningful classification results.

[0004] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] The main purpose of this application is to provide a software clustering method, device and storage medium, which aims to solve the technical problem of low clustering accuracy caused by data sparsity in existing malware clustering methods on small sample datasets.

[0006] To achieve the above objectives, this application proposes a software clustering method, which includes: Extract the opcode sequence corresponding to the public dataset from the disassembled files of multiple software programs; The opcodes in the opcode sequence are one-hot encoded according to their frequency to obtain a general one-hot encoding mapping table corresponding to the opcodes; Determine the target opcode sequence corresponding to the software to be clustered, and generate a vectorized document corresponding to the software to be clustered based on the general one-hot coding mapping table and the target opcode sequence. The vectorized document is reshaped into an initial grayscale image, and a software feature map corresponding to the software to be clustered is constructed based on the initial grayscale image; Clustering algorithms are used to perform clustering analysis on the software feature maps, and the category labels of the software to be clustered are determined based on the clustering results of the software feature maps.

[0007] In one embodiment, the step of constructing the software feature map corresponding to the software to be clustered based on the initial grayscale image includes: The initial grayscale image is enlarged to a standard size using bilinear interpolation to obtain the software feature map corresponding to the clustering software.

[0008] In one embodiment, the step of enlarging the initial grayscale image to a standard size using bilinear interpolation to obtain software feature maps corresponding to each of the clustering software includes: For each pixel to be determined in the software feature map, the corresponding original position of the pixel to be determined is determined in the initial grayscale image; In the initial grayscale image, four neighboring pixels around the original position are determined, including the top-left pixel, the top-right pixel, the bottom-left pixel, and the bottom-right pixel; Based on the gray values ​​of the lower left and lower right pixels, the gray value of the first virtual point is obtained through linear interpolation in the horizontal direction. Based on the gray values ​​of the top left and top right pixels, the gray value of the second virtual point is obtained through linear interpolation in the horizontal direction. Based on the gray values ​​of the first virtual point and the second virtual point, the gray value of the pixel to be determined is obtained by linear interpolation in the vertical direction. The software feature map of the standard size is generated by traversing and calculating the grayscale values ​​of all the pixels to be determined in the software feature map.

[0009] In one embodiment, the step of performing one-hot encoding on the opcodes in the opcode sequence according to their frequencies to obtain a universal one-hot encoding mapping table corresponding to the opcodes includes: Determine the total frequency of each opcode in the opcode sequence of the public dataset; The opcodes are sorted in descending order of their total frequency of occurrence to generate a global opcode frequency sorting table containing the opcodes, their corresponding total frequency of occurrence, and sorting numbers. Using the global opcode frequency sorting table, one-hot encoding is performed on each opcode to obtain the general one-hot encoding mapping table containing the opcode and the one-hot encoding vector corresponding to the opcode.

[0010] In one embodiment, the step of generating the vectorized document corresponding to the clustering software based on the general one-hot encoding mapping table and the target opcode sequence includes: For each target opcode in the target opcode sequence, the target one-hot encoding vector corresponding to the target opcode is queried according to the general one-hot encoding mapping table; The target one-hot encoded vectors corresponding to all target opcodes in the target opcode sequence are summed, and the sum vector is used as the vectorized document of the clustering software.

[0011] In one embodiment, the step of using a clustering algorithm to perform clustering analysis on the software feature map and determining the category label of the software to be clustered based on the clustering results of the software feature map includes: The elbow rule is used to determine the optimal number of clusters for clustering. K-means clustering is performed on the software feature map using the optimal number of clusters as the number of cluster centers. Based on the clustering results of the software feature map, the category label of the software to be clustered is determined.

[0012] In one embodiment, the step of determining the optimal number of clusters using the elbow rule includes: Obtain the number of multiple distinct candidate clusters; For each candidate cluster number, K-means clustering is performed on the software feature map with the candidate cluster number as the number of cluster centers, and the sum of squared errors corresponding to the clustering results under the candidate cluster number is calculated; Calculate the absolute value of the difference between the sum of squared errors corresponding to the number of candidate clusters and the sum of squared errors corresponding to the number of previous candidate clusters, wherein the number of candidate clusters is adjacent to the number of previous candidate clusters and the number of candidate clusters is greater than the number of previous candidate clusters; If the absolute value of the difference is less than a preset value, the corresponding number of candidate clusters will be determined as the preliminary optimal number of clusters. The minimum value among the preliminary optimal cluster numbers is determined as the optimal cluster number.

[0013] In one embodiment, the step of performing K-means clustering on the software feature map using the optimal number of cluster centers as the number of cluster centers, and determining the category label of the software to be clustered based on the clustering results of the software feature map includes: The optimal number of clusters is used as the number of cluster centers to initialize the number of centroids for the optimal number of clusters; The software feature map is latently encoded using an autoencoder to obtain the corresponding latent feature vector; The latent feature vectors are assigned to the clusters to which the nearest centroids belong, and the cluster affiliations of each cluster centroid and each latent feature vector are iteratively updated until the convergence condition is met, thus obtaining the clustering results. The cluster category label of the cluster to which each potential feature vector in the clustering result belongs is used as the category label of the corresponding clustering software.

[0014] Furthermore, to achieve the above objectives, this application also proposes a software clustering device, which includes: The sequence code extraction module is used to extract the opcode sequence corresponding to the public dataset from the public dataset containing disassembled files of multiple software programs; One-hot encoding module is used to perform one-hot encoding on the opcodes in the opcode sequence according to their frequency, so as to obtain a general one-hot encoding mapping table corresponding to the opcodes; The vector document generation module is used to determine the target opcode sequence corresponding to the software to be clustered, and generate a vectorized document corresponding to the software to be clustered based on the general one-hot coding mapping table and the target opcode sequence. The reshaping module is used to reshape the vectorized document into an initial grayscale image, and construct the software feature map corresponding to the clustering software based on the initial grayscale image; The clustering module is used to perform clustering analysis on the software feature map using a clustering algorithm, and to determine the category label of the software to be clustered based on the clustering results of the software feature map. In addition, to achieve the above objectives, this application also proposes a software clustering device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the software clustering method as described above.

[0015] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and which, when executed by a processor, implements the steps of the software clustering method described above.

[0016] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the software clustering method described above.

[0017] The one or more technical solutions proposed in this application have at least the following technical effects: Extracting the opcode sequence corresponding to the public dataset from a public dataset containing disassembled files of multiple software programs. One-hot encoding of the opcodes in the opcode sequence based on frequency yields a universal one-hot encoding mapping table corresponding to the opcodes. A unique fixed encoding vector is assigned to each opcode. The universal one-hot encoding mapping table is global, static, and deterministic, and does not change with the software to be clustered. Even if the number of samples to be clustered is extremely small, the opcodes can still obtain stable and highly discriminative encodings through the universal one-hot encoding mapping table, eliminating the need to calculate term frequency / inverse document frequency and freeing them from dependence on large sample statistical distributions. Determining the target opcode sequence corresponding to the software to be clustered, for each software to be clustered, directly performing one-hot encoding transformation on the complete target opcode sequence according to the universal one-hot encoding mapping table and the corresponding target opcode sequence, preserving the global sequence features of the opcodes of the software to be clustered, and generating a vectorized document corresponding to the software to be clustered. Reshaping the vectorized document into an initial grayscale image, and constructing a software feature map corresponding to the software to be clustered based on the initial grayscale image. Finally, clustering algorithms are used to perform clustering analysis on software feature maps, and based on the clustering results of the software feature maps, the category labels of the software to be clustered are determined, effectively distinguishing the differences in feature maps of different malicious software and obtaining the category labels of each software to be clustered. This solves the technical problem of low clustering accuracy caused by data sparsity in existing malicious software clustering methods on small-scale sample datasets. Overall, it eliminates the dependence of traditional methods on the number of samples, so as to achieve high-precision clustering division when the number of samples is limited. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating an embodiment of the software clustering method of this application. Figure 2 A schematic diagram of a global opcode frequency sorting table provided for this application; Figure 3 A schematic diagram of a general one-hot encoding mapping table provided in this application; Figure 4 A schematic diagram illustrating the extraction of opcode sequences from the disassembled code of software to be clustered, as provided in this application; Figure 5 A schematic diagram illustrating a vectorized representation of an opcode sequence provided in this application; Figure 6 A schematic diagram illustrating the visualization effect of an initial grayscale image and a software feature map provided in this application; Figure 7 A schematic diagram illustrating the process of calculating the grayscale value of a pixel in a software feature map provided in this application; Figure 8 A schematic diagram of the sum of squared errors as a function of the number of clusters k, provided for this application; Figure 9 A schematic diagram of a clustering framework based on an autoencoder provided in this application; Figure 10 This is a schematic diagram of the module structure of the software clustering device in an embodiment of this application; Figure 11 This is a schematic diagram of the device structure of the hardware operating environment involved in the software clustering method in this application embodiment. Detailed Implementation

[0021] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0022] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0023] The main solution of this application embodiment is as follows: Extract the opcode sequence corresponding to the public dataset from the disassembled files containing multiple software programs; perform one-hot encoding on the opcodes in the opcode sequence according to their frequency to obtain a general one-hot encoding mapping table corresponding to the opcodes; determine the target opcode sequence corresponding to the software to be clustered; generate a vectorized document corresponding to the software to be clustered based on the general one-hot encoding mapping table and the target opcode sequence; reshape the vectorized document into an initial grayscale image, and construct a software feature map corresponding to the software to be clustered based on the initial grayscale image; perform clustering analysis on the software feature map using a clustering algorithm, and determine the category label of the software to be clustered based on the clustering results of the software feature map.

[0024] In this embodiment, for ease of description, the following description uses a software clustering system as the execution subject.

[0025] In text mining, text clustering is a common unsupervised learning method. Its goal is to divide text data into multiple categories based on similarity relationships. Text clustering can be used in various applications such as text classification, text retrieval, and text summarization. Term Frequency-Inverse Document Frequency (TF-IDF) is a commonly used text representation method that can be used to calculate the importance of words in a text, thereby helping text clustering algorithms better identify relationships between texts.

[0026] In the field of computer security, malware clustering technology has adopted unsupervised clustering methods from text mining for cross-domain applications. The core technology relies on TF-IDF feature vectorization combined with the KMeans clustering algorithm to classify software (such as malware). The overall technical approach is to treat a single piece of malware as an equivalent text document, and the opcode features of the malware as equivalent to lexical features in the text. Malware clustering analysis is then performed using the logic of text clustering. Specifically, the executable file of the malware is first disassembled. The core opcodes are extracted from the disassembled file and arranged into an opcode sequence according to the instruction execution order. Then, using an opcode n-gram (n=2) extraction method, the opcode sequence of a single piece of malware is continuously binary-segmented. Adjacent opcodes are combined into an opcode phrase, forming a phrase document representing the characteristics of the malware. For example, the opcode sequence push, call, add, add, retn can be segmented into a phrase document of {(push, call), (call, add), (add, add), (add, retn)}. Next, using opcode phrases as the basic unit of calculation, the TF-IDF algorithm is used to vectorize the features of malware. First, the number of times each opcode phrase appears in a single malware phrase document is counted, then divided by the total number of phrases in that document to obtain the term frequency (TF). Simultaneously, using all malware samples as the dataset, the ratio of the total number of samples in the dataset to the number of samples containing the opcode phrase is calculated, and the logarithm is taken to obtain the inverse document frequency (IDF). The TF value of each phrase is multiplied by the IDF value to obtain the corresponding TF-IDF value, which characterizes the feature discrimination of the phrase against the corresponding malware. For example, if a document has 100 words, and the word "cow" appears 3 times, then the term frequency of "cow" in that document is 3 / 100 = 0.03. One method for calculating document frequency (IDF) is to divide the total number of documents in the document set by the number of documents in which the word "cow" appears. Therefore, if the word "cow" appears in 1,000 files, and the total number of files is 10,000,000, its inverse file frequency (IDF) is lg(10,000,000 / 1,000) = 4, resulting in a TF-IDF value of 0.03 * 4 = 0.12. Finally, using all opcode phrases in the entire dataset as vector dimensions, the TF-IDF values ​​of each phrase in a single malware are arranged according to these dimensions to form the TF-IDF feature vector of that malware. Ultimately, using the TF-IDF feature vectors of all malware as input, an unsupervised clustering algorithm is employed to cluster malware with similar features into one class based on the similarity between vectors, thus achieving the malware clustering objective.The aforementioned TF-IDF-based malware clustering method, in application scenarios with sufficient malware datasets, can rely on the statistical distribution characteristics of large samples to accurately measure the feature discrimination of opcode word groups, thereby obtaining clustering results that meet expectations.

[0027] However, the aforementioned TF-IDF-based malware clustering method has significant technical limitations in practical applications. This method is only suitable for clustering large datasets. In applications with small-scale malware sample datasets, it fails to achieve ideal clustering results, exhibiting large clustering errors and making it unsuitable for practical clustering applications with small-scale samples. The core reason lies in the fact that the TF-IDF feature vectorization process of this method highly depends on the statistical distribution of large samples. With small-scale samples, the distribution of opcode phrases in the dataset lacks effective statistical significance, easily leading to situations where some opcode phrases appear entirely or are completely missing in the dataset. This results in distorted calculation of the inverse document frequency (IDF) value, failing to accurately reflect the feature discriminativeness of phrases. Consequently, the generated TF-IDF feature vectors cannot accurately represent the core features of malware, losing the necessary feature discriminativeness. For unsupervised clustering algorithms that rely on distance metrics between samples, the input features (TF-IDF feature vectors) lack discriminative representation, failing to effectively separate structurally clear clusters. The accuracy of similarity calculations decreases significantly, ultimately resulting in large clustering errors and unsatisfactory performance, thus limiting the applicability of this malware clustering method.

[0028] This application provides a solution that extracts the opcode sequence corresponding to the public dataset from a disassembled dataset containing multiple software programs. The opcodes in the opcode sequence are then one-hot encoded according to their frequencies to obtain a universal one-hot encoding mapping table, transforming the opcodes into one-hot encoded vectors. The target opcode sequence corresponding to the software to be clustered is determined, and a vectorized document corresponding to each software to be clustered is generated based on the universal one-hot encoding mapping table and the target opcode sequence. This method abandons the existing TF-IDF calculation method that relies on large-sample statistics, eliminates the need to consider term frequency and inverse document frequency, and avoids the problem of feature quantization distortion under small-scale samples. Subsequently, the vectorized document is reshaped into an initial grayscale image, and a software feature map corresponding to the software to be clustered is constructed based on the initial grayscale image. Finally, clustering algorithms are used to perform clustering analysis on the software feature maps. The clustering algorithm effectively identifies the feature differences between small-scale samples, groups similar software into one category, obtains the clustering results of the software feature maps, and determines the category label of the software to be clustered based on the clustering results of the software feature maps. It still achieves high-precision clustering results on small-scale datasets, improves clustering accuracy, and solves the technical problem of low clustering accuracy caused by data sparsity in existing malware clustering methods on small-scale sample datasets.

[0029] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or a software clustering device capable of performing the above functions. The following description uses a software clustering system as an example to illustrate this embodiment and the subsequent embodiments.

[0030] Based on this, embodiments of this application provide a software clustering method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the software clustering method of this application.

[0031] In this embodiment, the software clustering method includes steps 101-105: Step 101: Extract the opcode sequence corresponding to the public dataset from the public dataset containing disassembled files of multiple software programs.

[0032] Specifically, public datasets are malware samples containing a large number of labeled families, publicly released by research institutions or companies, along with disassembled files (.asm files) obtained by disassembling these malware samples. Using public datasets helps improve the reproducibility and verifiability of methods and serves as a reliable and diverse data source for constructing a global feature dictionary. Optionally, public datasets can be malware datasets provided by the Kaggle Microsoft Malware Classification Competition. Software disassembled files are text files obtained by converting the executable file of binary software using a disassembler, containing information such as instruction addresses, opcodes, and operands. The opcode sequence is a sequence of opcodes (such as push, call, add, jmp, etc.) extracted from the software disassembled file and arranged in execution order; it is the core representation of software behavior.

[0033] In some embodiments, a public dataset containing a large number of labeled malware samples, such as the Microsoft Malware Classification Challenge dataset, is acquired. Each sample in this public dataset has been converted into a readable assembly code file using a professional disassembler. Subsequently, the disassembled files of each software in the public dataset are automatically parsed, reading the assembly instructions line by line. The opcode of each instruction is extracted using regular expressions or an instruction parser, while redundant content such as address information, register names, memory offsets, immediate values, and comments is removed. Finally, all opcodes of each software in the dataset are arranged sequentially according to their original execution order in the program, forming a one-dimensional symbol sequence. The opcode sequences of all software are then aggregated to form an opcode sequence set covering the entire dataset. This opcode sequence set can comprehensively reflect the typical behavioral patterns of various (malicious) software families, providing a sufficient and stable statistical foundation for the subsequent construction of a global one-hot encoding mapping table. By relying on large-scale external data rather than the small samples to be clustered, feature representation bias caused by data sparsity in small sample scenarios is effectively avoided, thereby improving the generalization ability and accuracy of subsequent clustering of the software to be clustered.

[0034] Step 102: Perform one-hot encoding on the opcodes in the opcode sequence according to their frequency to obtain a general one-hot encoding mapping table corresponding to the opcodes.

[0035] Specifically, the opcodes in all opcode sequences extracted from the public dataset are one-hot encoded according to their frequency to obtain a general one-hot encoding mapping table containing each opcode and its corresponding one-hot encoding vector.

[0036] One-hot encoding vectors are a discrete feature encoding method. The vector dimension is equal to the total number of unique opcodes. Each opcode corresponds to a unique position of 1 in the vector, and the rest are 0. For example, if all opcodes include mov, push, and call, then the one-hot encoding vector of push is [0, 1, 0]. A general one-hot encoding mapping table defines the mapping relationship between each unique opcode in a public dataset and its corresponding fixed and unique one-hot encoding vector. For example, a general one-hot encoding mapping table can indicate that the opcode "Mov" corresponds to vector [...0001], and the opcode "Push" corresponds to vector [...0010]. The general one-hot encoding mapping table is the core reference for opcode vectorization.

[0037] In some embodiments, all opcode sequences extracted from public datasets are aggregated, and the sequences are iterated, counted, and deduplicated to obtain a globally unique opcode set. Then, using the total number of opcodes in this globally unique opcode set as the encoding dimension, a dedicated one-hot encoding vector is assigned to each unique opcode. In the one-hot encoding vector, only the position corresponding to the opcode is set to 1, and the remaining positions are set to 0. Finally, all opcodes and their corresponding one-hot encoding vectors are organized into a structured table in key-value pairs, forming a general one-hot encoding mapping table. This provides a unified encoding reference for the vectorization of target opcode sequences in each clustering software, ensuring the consistency and comparability of feature vector dimensions. If a public dataset yields 1000 unique opcodes, the corresponding universal one-hot encoding mapping table contains 1000 rows, each row corresponding to one opcode and one 1000-dimensional one-hot encoded vector. This ensures that all opcodes can be transformed into numerical vectors with uniform dimensions based on this table, converting discrete opcodes into computable and quantifiable numerical vectors. This approach abandons the existing TF-IDF calculation method that relies on sample statistics, solves the problem of feature quantization distortion under small-scale samples, and provides a unified encoding benchmark for all clustering software, ensuring the dimensionality consistency and comparability of feature vectors.

[0038] Optionally, the step of performing one-hot encoding on the opcodes in the opcode sequence according to their frequencies to obtain a universal one-hot encoding mapping table corresponding to the opcodes includes: Determine the total frequency of each opcode in the opcode sequence of the public dataset; Sort each opcode in descending order of its total frequency of occurrence to generate a global opcode frequency sorting table containing the opcode, its total frequency of occurrence, and sorting number. By using a global opcode frequency sorting table, one-hot encoding is performed on each opcode to obtain a general one-hot encoding mapping table containing the opcode and its corresponding one-hot encoding vector.

[0039] Specifically, total frequency refers to the total number of times a particular opcode appears in the entire dataset. The global opcode frequency sorting table is a list that sorts all opcodes from highest to lowest based on total frequency, assigning each opcode a unique sorting number. (Refer to...) Figure 2 , Figure 2 The intention of sorting global opcode frequencies is as follows: Figure 2 As shown, Mov has the highest frequency, with an index of 1; Push is next, with an index of 2. The global opcode frequency sorting table establishes a mapping between opcodes and global sorting indices (frequency indices). The sorting index is a unique number obtained by sorting the opcodes according to their total frequency of occurrence from high to low, and it determines the position of the opcode in the one-hot encoding vector.

[0040] For example, the opcode sequences corresponding to all software in the public dataset are traversed, and the total frequency of each unique opcode appearing in the dataset is counted in the entire dataset (the set of opcode sequences of all software to be clustered). Then, all opcodes are sorted from high to low according to their total frequency, and a unique sorting number is assigned to each opcode, generating a sequence like this. Figure 2 The global opcode frequency sorting table shown has Mov ranked first due to its highest frequency and Vcmpss ranked 674th due to its lowest frequency. This sorting ensures that high-frequency, commonly used opcodes are assigned earlier indices, providing a unified sorting basis for subsequent one-hot encoding. Next, the global opcode frequency sorting table is used to perform one-hot encoding on each opcode. For the i-th opcode in the global opcode frequency sorting table (i starts from 1), a zero vector with a length equal to the total number of opcodes (e.g., 674) is created, and its i-th bit is set to 1, while the remaining bits remain 0. For example, the one-hot encoded vector corresponding to "Mov" is "0000……0001", the one-hot encoded vector corresponding to "Push" is "0000……0010", the one-hot encoded vector corresponding to "Vpmpcklbw" is "0100……0000", and the one-hot encoded vector corresponding to "Vcmpss" is "1000……0000". Each opcode is associated with its corresponding one-hot encoded vector and stored, constructing a structure as shown below. Figure 3 The general one-hot encoding mapping table shown in the figure associates each opcode with its own unique one-hot encoding vector. By constructing a general one-hot encoding mapping table containing opcodes and their corresponding one-hot encoding vectors using a public dataset, the prior knowledge of external big data is solidified into a static encoding rule. When dealing with small-scale malware families with only a few dozen samples, their opcodes can still obtain a stable, ordered, and high-dimensional representation by looking up the table, effectively preserving behavioral differences and significantly improving clustering robustness and accuracy.

[0041] Step 103: Determine the target opcode sequence corresponding to the software to be clustered, and generate the vectorized document corresponding to the software to be clustered based on the general one-hot coding mapping table and the target opcode sequence.

[0042] Specifically, the software to be clustered refers to software that needs to be categorized using clustering methods; it can be malware and serves as the target sample for the clustering task. The target opcode sequence refers to the clean opcode text list obtained after disassembling and cleaning a single software sample to be clustered, for example: [push, call, add, add, retn]. The vectorized document is a numerical vector whose length is equal to the total number of different opcodes in the general one-hot encoding map (i.e., the dimension of the feature space). The value at each position in the vectorized document represents the number of times the corresponding opcode appears in the current malware sample (i.e., the software to be clustered).

[0043] In some embodiments, the binary executable file of the software to be clustered is disassembled to obtain the corresponding disassembled file. A method consistent with opcode extraction from public datasets (such as regular expression matching) can be used to filter redundant information such as addresses and operands, and extract the target opcode sequence arranged in execution order. For each piece of malware to be clustered (i.e., the software to be clustered), its opcode sequence is read, for example, [push, call, add, add, retn]. Then, each opcode in the opcode sequence is sequentially traversed. For each opcode, a pre-constructed universal one-hot encoding mapping table is queried to obtain a fixed-length one-hot encoded vector corresponding to each opcode. Next, the system sums the one-hot encoded vectors corresponding to all opcodes in the opcode sequence element-wise. The resulting vector is the vectorized document of the software to be clustered. The length of the vectorized document of the software to be clustered is consistent with the total number of global opcode types, and the value of each dimension is equal to the frequency of the corresponding opcode in the sample. By quantitatively converting the textual instruction sequence into a numerical statistical feature vector, directly processable mathematical data is provided for subsequent image reconstruction.

[0044] Optionally, the steps for determining the target opcode sequence corresponding to the clustering software include: The executable file of the clustering software is disassembled, and the target opcode sequence corresponding to the clustering software is extracted based on the disassembly results.

[0045] Specifically, an executable file is a binary software running file used by malware to store and spread on a computer. It can be a binary program file in formats such as .exe or .dll, containing all the software's execution logic and serving as the original data source for extracting opcodes. The target opcode sequence is the core code in assembly language that represents the instruction operation type, such as push, call, add, etc., arranged in an ordered sequence according to the software execution order.

[0046] In some embodiments, binary executable files of multiple software (malicious software) to be clustered are collected to form a software sample set to be processed. Then, a disassembly operation is performed on the executable file of each software to be clustered in the software sample set, converting the binary machine code into a disassembled file containing information such as addresses, opcodes, and operands. The disassembled file includes multiple assembly instructions. Next, redundant information without feature value, such as addresses and operands, is removed from the disassembled file, retaining only the core opcodes that represent the software's execution logic. Finally, the extracted core opcodes are arranged in the original execution order of the assembly instructions to obtain a unique target opcode sequence for each software to be clustered, providing raw feature data for subsequent feature vectorization. By extracting target opcode sequences that characterize the behavior of the software to be clustered from the executable files, stripping redundant binary information from the executable files, and focusing on opcode features that reflect the core execution logic of the software (malicious software), raw feature data is provided for subsequent feature vector generation steps.

[0047] Optionally, the steps of disassembling the executable file of the clustering software and extracting the target opcode sequence corresponding to the clustering software based on the disassembly results include: Load the executable file into the disassembler engine; The code segment of the executable file is parsed by a disassembler engine to generate the corresponding sequence of assembly instructions. Traverse each assembly instruction in the assembly instruction sequence, and extract the opcode from each assembly instruction by removing address information, operand information, and redundant comment information; Arrange all opcodes according to their execution order in the assembly instruction sequence to form the target opcode sequence corresponding to the software to be clustered.

[0048] Specifically, a disassembler engine is a software module or tool library used to implement disassembly functionality, such as Interactive Disassembler Professional (IDA Pro), Ghidra, and Capstone engines, which translate machine code (binary instructions) into human-readable assembly language instructions. The code segment of an executable file is the area within the executable file that stores the core execution logic (machine code), distinct from the data segment and resource segment, and is the core target area for extracting opcodes. The assembly instruction sequence is a set of assembly instructions generated by the disassembler engine after parsing the code segment, arranged in execution order. Each assembly instruction contains complete information such as address, opcode, and operands. Address information is the memory / register address corresponding to the assembly instruction, such as 0x00401000, used for instruction location and has no software feature value. Operand information is the part of the assembly instruction that specifies the operand, such as "eax" in "push eax," reflecting the operand of the assembly instruction but not the core operation logic. Redundant comment information is descriptive text automatically generated during the disassembly process, such as "push operation," and has no actual feature meaning. Opcodes are the core part of assembly instructions that represent the type of operation, such as mov (data move), call (function call), jmp (jump), etc.

[0049] For example, the executable file of the software to be clustered is loaded into a disassembler engine, which (such as IDA Pro or Capstone) automatically identifies the executable file format and locates its code segment. (See reference) Figure 4 Subsequently, the disassembler parses the binary machine code within the code segment line by line, generating a sequence of assembly instructions containing addresses, opcodes, operands, and comments, such as... Figure 4The complete assembly instruction lines, such as “.text:0040153D 53 51 push ecx” and “.text:0040153E 8E 74 00 00movzx??@YAXI@Z”, are extracted. Next, the assembly instruction sequence is traversed, and information stripping is performed on each instruction: address information at the beginning of the instruction line (e.g., “.text:0040153D”), operand information in the middle of the instruction (e.g., ecx, esp,4), and redundant comments are removed, retaining only the opcodes representing the core operation type, such as extracting “push”, “movzx”, “add”, “add”, and “retn” from the above instructions. Finally, all extracted opcodes are arranged sequentially according to their original execution order in the assembly instruction sequence, forming a target opcode sequence uniquely corresponding to the software to be clustered, such as [push, call, add, add, retn]. This target opcode sequence, as input to subsequent feature encoding, can focus on common behavioral patterns among different malware families, thereby helping to improve the discriminative power and robustness of clustering algorithms in small sample scenarios.

[0050] Optionally, the steps for generating the vectorized document corresponding to the clustering software based on the general one-hot coding mapping table and opcode sequence include: For each target opcode in the target opcode sequence, look up the target one-hot encoded vector corresponding to the opcode according to the general one-hot encoded mapping table; Summing the target one-hot encoded vectors corresponding to all target opcodes in the target opcode sequence, and using the sum vector as the vectorized document of the clustering software.

[0051] For example, refer to Figure 5 For the target opcode sequence of the software to be clustered, such as Figure 5 The left-hand side (push, call, add, add, retn) iterates through each target opcode in the target opcode sequence. For each target opcode in the sequence, it queries a pre-established universal one-hot encoding mapping table to obtain a fixed-length target one-hot encoding vector corresponding to each target opcode, such as... Figure 5As shown, the one-hot encoded vector corresponding to the opcode "push" is "00……0000(672 zeros)10", the one-hot encoded vector corresponding to "call" is "00……0000(671 zeros)100", the one-hot encoded vector corresponding to "add" is "00……00(664 zeros)10000000", and the one-hot encoded vector corresponding to "retn" is "00……00(658 zeros)1000000000000000", etc. Each one-hot encoded vector has a fixed dimension, with only the position corresponding to the opcode being 1 and the other positions being 0. Next, the element-wise summation of the target one-hot encoded vectors obtained from all target opcode queries in the target opcode sequence is performed. The values ​​at corresponding positions in the target one-hot encoded vectors corresponding to each target opcode are added together to obtain a sum vector. The value at each position in this sum vector represents the number of times the corresponding target opcode appears in the target opcode sequence of the software. For example, the sum vector obtained after summation might be "00…0 (658 zeros)1000020000000110". This sum vector is the vectorized document corresponding to the clustering software. Generating fixed-dimensional feature vectors through vector summation preserves the global distribution characteristics of the opcodes while avoiding dimensional inconsistencies caused by differences in opcode sequence lengths. This provides a unified and stable feature input for subsequent visualization and clustering analysis, thus eliminating the dependence on large-sample statistical distributions.

[0052] Step 104: Reshape the vectorized document into an initial grayscale image, and construct the software feature map corresponding to the software to be clustered based on the initial grayscale image.

[0053] Specifically, the initial grayscale image is a two-dimensional matrix obtained after reshaping. Each element (0 or 1) in the matrix is ​​regarded as the grayscale value (0-255) of a pixel, thus forming a binarized grayscale image.

[0054] In some embodiments, the vectorized document (i.e., fixed-dimensional opcode feature vector) corresponding to the software to be clustered is arranged row by row according to a preset standard width and reshaped into a two-dimensional matrix. Then, the values ​​in the matrix are directly mapped to the grayscale values ​​of the corresponding pixels to generate an initial grayscale image. Finally, this initial grayscale image is used as the software feature map corresponding to the software to be clustered, completing the standardized transformation from numerical features to visual features. This process transforms sparse one-dimensional opcode feature vectors (vectorized documents) into two-dimensional visual features with spatial distribution patterns, improving feature recognition and adaptability to clustering algorithms, and providing standardized input data rich in behavioral semantics for subsequent accurate clustering analysis based on image features.

[0055] Step 105: Use a clustering algorithm to perform clustering analysis on the software feature map, and determine the category label of the software to be clustered based on the clustering results of the software feature map.

[0056] Specifically, the category label is the output result assigned by the clustering algorithm to each input sample (i.e., the software feature map corresponding to the software to be clustered). It can be an integer (such as 0, 1, 2...) representing the cluster ID to which the sample belongs. Samples (software feature maps corresponding to the software to be clustered) under the same label are considered to have similar behavior and may belong to the same family.

[0057] In some embodiments, an unsupervised clustering algorithm (such as K-Means) is used to analyze all software feature maps. The algorithm calculates the similarity between software feature maps, iteratively optimizes the cluster centers, and groups samples with similar behavioral patterns (the software feature maps corresponding to the software to be clustered) into the same cluster. Finally, the clustering results of the software feature maps are obtained, and each sample (the software feature map corresponding to the software to be clustered) is assigned an integer cluster index, which is the category label of the software to be clustered, thereby completing the category division of all software to be clustered. This category label represents the behavioral cluster or potential family to which the software belongs. It can achieve efficient grouping of unknown malware without manual annotation, thus providing a key basis for subsequent threat intelligence analysis and defense strategy formulation.

[0058] Optionally, the steps of using clustering algorithms to perform clustering analysis on software feature maps and determining the category labels of the software to be clustered based on the clustering results of the software feature maps include: The elbow rule is used to determine the optimal number of clusters for clustering. K-means clustering is performed on the software feature map with the optimal number of cluster centers. Based on the clustering results of the software feature map, the category label of the software to be clustered is determined.

[0059] Specifically, the elbow rule is an empirical but widely used method for determining the optimal number of clusters in K-Means. Its principle is as follows: as k increases, the corresponding clustering error continues to decrease; however, after reaching a certain "inflection point," the rate of decrease in clustering error slows significantly. This inflection point resembles an elbow, and the corresponding k value is the optimal number of clusters. The optimal number of clusters refers to the number of clusters that best balances intra-cluster compactness and model complexity in the current dataset (i.e., the image set composed of all software feature maps). Choosing the optimal number of clusters avoids under-clustering (k too small) or over-clustering (k too large).

[0060] For example, an image set is constructed from the software feature maps corresponding to all software to be clustered. The elbow rule is used to evaluate the clustering effect of this image set. By traversing the clustering errors corresponding to different numbers of clusters and calculating the error change trend, the optimal number of clusters is determined when the error decrease rate slows down significantly. Then, using this optimal number of clusters as the number of cluster centers, the K-means clustering algorithm is used to perform clustering operations on the image set. During the iteration process, the cluster centers are continuously updated, and software feature maps with high feature similarity are grouped into the same cluster, minimizing the feature distance within the cluster and maximizing the feature distance between the clusters. After the iteration converges, a unique category identifier is assigned to each cluster, and this identifier is used as the category label for each software to be clustered within the corresponding cluster. Finally, the category labels for all software to be clustered are obtained, achieving high-precision and adaptive malware clustering.

[0061] Based on the software clustering method provided in this application, the opcode sequence corresponding to the public dataset is extracted from the disassembled files of multiple software programs. The opcodes in the opcode sequence are one-hot encoded according to their frequency to obtain a universal one-hot encoding mapping table. A unique fixed encoding vector is assigned to each opcode. The universal one-hot encoding mapping table is global, static, and deterministic, and does not change with the software to be clustered. Even if the number of samples to be clustered is very small, the opcodes can still obtain stable and highly discriminative encodings through the universal one-hot encoding mapping table, without the need to calculate term frequency / inverse document frequency, thus eliminating the dependence on large sample statistical distributions. The target opcode sequence corresponding to the software to be clustered is determined. For each software to be clustered, the complete target opcode sequence is directly transformed by one-hot encoding according to the universal one-hot encoding mapping table and the corresponding target opcode sequence, preserving the global sequence features of the opcodes of the software to be clustered, and generating a vectorized document corresponding to the software to be clustered. The vectorized document is reshaped into an initial grayscale image, and a software feature map corresponding to the software to be clustered is constructed based on the initial grayscale image. Finally, clustering algorithms are used to perform clustering analysis on software feature maps, and based on the clustering results of the software feature maps, the category labels of the software to be clustered are determined, effectively distinguishing the differences in feature maps of different malicious software and obtaining the category labels of each software to be clustered. This solves the technical problem of low clustering accuracy caused by data sparsity in existing malicious software clustering methods on small-scale sample datasets. Overall, it eliminates the dependence of traditional methods on the number of samples, so as to achieve high-precision clustering division when the number of samples is limited.

[0062] In some embodiments, the step of constructing a software feature map corresponding to the software to be clustered based on an initial grayscale image includes: The initial grayscale image is enlarged to a standard size using bilinear interpolation to obtain the software feature map corresponding to the clustering software.

[0063] Specifically, the width of the initial grayscale image can be a standard width, which is a preset fixed value referring to the number of pixels in the horizontal direction of the reconstructed initial grayscale image. The standard width can be set to 32 pixels. The standard size is a preset target image size (such as width × height) to ensure that the dimensions of all software feature maps are uniform. In this application, the standard size can be 32x32.

[0064] As an example, see reference Figure 6 , Figure 6 This diagram illustrates the visualization of the initial grayscale image and the software feature map. The fixed-dimensional vectorized document corresponding to the clustering software is arranged row-by-row according to a preset standard width, reshaped into a two-dimensional matrix, and the values ​​in the two-dimensional matrix are directly mapped to grayscale values ​​to generate the initial grayscale image. Figure 6 The small-sized image shown on the left, the initial grayscale image's pixel distribution, directly reflects the numerical distribution of the vectorized document. Subsequently, bilinear interpolation is performed on this initial grayscale image. Using a preset standard size as the target, for each new pixel in the software feature map, its corresponding position in the initial grayscale image is calculated. Then, a weighted average is taken based on the grayscale values ​​of the four neighboring pixels at that position to generate a smoothly transitioning new pixel. Finally, the initial grayscale image is enlarged to a uniform standard size, resulting in a standard-sized software feature map, as shown below. Figure 6 The larger image shown on the right. By transforming sparse one-dimensional numerical features (vectorized documents) into two-dimensional visual features (initial grayscale images) with spatial distribution patterns, and by interpolating to complete pixel information and standardizing all sample feature dimensions, software feature maps corresponding to each clustering software are generated. This improves feature recognition and the adaptability of clustering algorithms, providing a more robust input for subsequent image feature-based clustering analysis.

[0065] In some embodiments, the step of enlarging the initial grayscale image to a standard size by bilinear interpolation to obtain the software feature map corresponding to each clustering software includes: For each pixel to be determined in the software feature map, the corresponding original position of the pixel to be determined is determined in the initial grayscale image; In the initial grayscale image, determine the four neighboring pixels around the original position. The four neighboring pixels include the top-left pixel, the top-right pixel, the bottom-left pixel, and the bottom-right pixel. Based on the gray values ​​of the lower left and lower right pixels, the gray value of the first virtual point is obtained through linear interpolation in the horizontal direction. Based on the gray values ​​of the top left and top right pixels, the gray value of the second virtual point is obtained through linear interpolation in the horizontal direction. Based on the gray values ​​of the first virtual point and the second virtual point, the gray value of the pixel to be determined is obtained by linear interpolation in the vertical direction. A standard-sized software feature map is generated by iterating through and calculating the grayscale values ​​of all pixels in the software feature map.

[0066] Specifically, the original position is the coordinate position of the pixel to be determined mapped back to the initial grayscale image. The four neighboring pixels are the four nearest real pixels around the original position: the top-left pixel, the top-right pixel, the bottom-left pixel, and the bottom-right pixel.

[0067] As an example, see reference Figure 7 As shown, for any pixel in the target feature map, firstly, the original position (usually floating-point coordinates) of the pixel in the initial grayscale image is determined according to the scaling ratio. For example... Figure 7 As shown, the original position P(x,y) of the pixel to be determined in the initial grayscale image falls within a square formed by four neighboring integer pixels in the initial image, i.e., the lower left pixel P. 11 (x1, y1), bottom right pixel P 21 (x2, y1), top left pixel P 12 (x1, y2) and the top right pixel P 22 (x2, y2). Next, based on the bottom left pixel P... 11 The grayscale value and the bottom right pixel P 21 The grayscale value of the first virtual point P1 is calculated by linear interpolation in the horizontal direction. The calculation formula is as follows: Based on the relative horizontal distance of the original position, the lower left pixel P... 11 and the bottom right pixel P 21 The grayscale values ​​are weighted and averaged. Similarly, based on the top-left pixel P... 12 The grayscale value and the upper right pixel P 22 The grayscale value of the second virtual point P2 is calculated by linear interpolation in the horizontal direction. The calculation formula is as follows: Subsequently, in the vertical direction, based on the gray values ​​of the first virtual point P1 and the second virtual point P2, the final gray value of the pixel P(x,y) to be determined is obtained through vertical linear interpolation. The calculation formula is as follows: Based on the relative vertical distance between the original positions, a weighted average of the gray values ​​of the first and second virtual points is calculated. This calculation is repeated across all pixels in the target feature map, and the gray values ​​of all pixels in the software feature map are also calculated, ultimately resulting in a software feature map with a uniform standard size and smooth gray-level transitions. High-quality image upscaling is achieved through bilinear interpolation, ensuring consistency across all sample feature dimensions (the software feature map corresponding to the clustering software) while preserving the spatial texture features of the software opcode distribution. This improves feature recognition and the adaptability to the clustering algorithm, providing a more robust input for subsequent accurate clustering analysis based on image features.

[0068] In some embodiments, the step of determining the optimal number of clusters for clustering using the elbow rule includes: Obtain the number of multiple distinct candidate clusters; For each candidate cluster number, K-means clustering is performed on the software feature map with the candidate cluster number as the number of cluster centers, and the sum of squared errors corresponding to the clustering results under the candidate cluster number is calculated; Calculate the absolute value of the difference between the sum of squared errors corresponding to the number of candidate clusters and the sum of squared errors corresponding to the number of the previous candidate cluster. The number of candidate clusters is adjacent to the number of the previous candidate cluster and the number of candidate clusters is greater than the number of the previous candidate cluster. If the absolute value of the difference is less than the preset value, the corresponding candidate cluster number will be determined as the preliminary optimal cluster number. The minimum value among the initial optimal cluster numbers is determined as the optimal cluster number.

[0069] Specifically, the number of clusters is the number of selectable clusters to be evaluated within a preset range (e.g., k=2,3,...,10). The Sum of Squared Errors (SSE) is the core optimization objective of K-Means clustering, calculating the sum of the squared Euclidean distances from all data points to the center of their respective clusters. A smaller SSE indicates a more compact cluster. The formula is: Where i is the total number of clusters, and p is the cluster C i All points, m i It is cluster C i The cluster center. Using this formula, when clustered into k clusters, the distance from a point p in each cluster to its cluster center m is calculated. iThe sum of squared errors. The absolute value of the difference refers to the decrease in SSE between two adjacent candidate k values ​​(e.g., k and k-1), i.e., |SSE(k)-SSE(k-1)|. The absolute value of the difference measures the marginal benefit of adding a cluster. The preset value is an empirical threshold set by the user or system to determine whether the decrease in error (i.e., the sum of squared errors) tends to level off. When the decrease in SSE is less than this preset value, the improvement in clustering effect is considered limited.

[0070] As an example, obtain an increasing sequence of candidate cluster numbers (e.g., k = 1 to 10). For each candidate cluster number k, perform K-means clustering on the software feature map using that number of candidate clusters k as the number of cluster centers, and then apply the formula... Calculate the sum of squared errors (SSE) for the number of candidate clusters k, where k is the number of candidate clusters, p is the feature sample in the image set composed of multiple software feature maps, and C i For the i-th cluster, m i Let be the cluster center of the i-th cluster. Next, calculate the absolute value of the difference between the SSE corresponding to the current number of candidate clusters and the SSE corresponding to the previous smaller candidate cluster. This represents the magnitude of error reduction brought about by increasing the number of clusters. If the absolute value of this difference is less than a preset threshold, it indicates that the decrease in clustering error is becoming gradual, and the current number of candidate clusters is marked as the preliminary optimal number of clusters. Finally, select the minimum value from all preliminary optimal numbers of clusters. This value is the optimal number of clusters under the elbow rule, corresponding to the elbow position of the SSE curve.

[0071] For example, the core objective of k-means clustering is to minimize the sum of squared errors between a sample and its corresponding centroid. This sum of squared errors (SSE), also known as distortion, measures the compactness of samples within a cluster. Low distortion indicates a tighter cluster structure and stronger cohesion, while high distortion indicates a looser cluster structure. During iteration, distortion typically decreases as the number of clusters k increases. However, for datasets with inherent separation characteristics, there is a critical point beyond which the distortion improvement rate significantly decreases. This critical point is called the "elbow," which can be determined using the elbow rule.

[0072] Subsequently, for the dataset (an image set composed of all software feature maps), a pre-defined sequence of candidate cluster numbers from 1 to n is established. K-means clustering is then performed sequentially with each candidate cluster number k representing the number of cluster centers. k centers are randomly selected (they can be located inside or outside the sample) and then clustered according to the formula: Calculate the sum of squared errors (SSE) for the corresponding clustering results, where k is the number of candidate clusters, p is the number of feature samples in the image set composed of multiple software feature maps, and C... i For the i-th cluster, m i Let be the cluster center of the i-th cluster.

[0073] Next, the SSE corresponding to different k values ​​is plotted as a curve, with the horizontal axis representing the cluster number k and the vertical axis representing SSE, as shown below. Figure 8 As shown, Figure 8 This is a schematic diagram showing the sum of squared errors as a function of the number of clusters k. From... Figure 8 As can be seen from the curve, when k increases from 1 to 3, SSE drops sharply. This is because the increase in the number of clusters effectively divides the core categories that are naturally separated in the dataset, greatly improving the compactness within the clusters. When k increases from 3 to 4 or above, the rate of decrease in SSE slows down significantly. When k>4, the curve becomes flat, indicating that the contribution of the newly added cluster centers to the distortion improvement has been greatly reduced. k=3 is the key inflection point where the rate of decrease in SSE changes from sharp to slow, namely the "elbow point".

[0074] Finally, based on the elbow rule, when k < 3, the insufficient number of clusters leads to naturally different samples being forcibly grouped into the same cluster, resulting in high distortion and clustering results that cannot reflect the true distribution of the data. When k > 3, although SSE still decreases slightly, this is due to overfitting achieved by splitting homogeneous clusters, which undermines the rationality of the category division. When k = 3, high cohesion of samples within a cluster is achieved through a reasonable number of clusters, while avoiding model overfitting, perfectly balancing model complexity and clustering performance. Therefore, the highest clustering accuracy can be obtained when k = 3, and this value is the optimal number of clusters for this dataset.

[0075] In some embodiments, the step of performing K-means clustering on the software feature map with the optimal number of cluster centers as the number of cluster centers, and determining the category label of the software to be clustered based on the clustering results of the software feature map includes: The optimal number of clusters is used as the number of cluster centers, and the optimal number of centroids for each cluster is initialized. The software feature map is latently encoded using an autoencoder to obtain the corresponding latent feature vector; The latent feature vectors are assigned to the cluster to which the nearest centroid belongs. The cluster affiliation of each cluster centroid and each latent feature vector is iteratively updated until the convergence condition is met, and the clustering result is obtained. The cluster category label of the cluster to which each potential feature vector in the clustering result belongs is used as the category label of the corresponding clustering software.

[0076] Specifically, an autoencoder is an unsupervised neural network model consisting of an encoder and a decoder. Its goal is to learn a mapping from the input to the latent space and back to the input. The encoder compresses the high-dimensional input into a low-dimensional latent feature vector, while the decoder reconstructs the original input from this vector. The latent feature vector is the low-dimensional vector output by the autoencoder; it is a compact representation of the software feature map, containing core behavioral features and serving as direct input for subsequent clustering analysis. The convergence condition is the criterion for determining whether the algorithm should stop iterating; it can be that the change in the centroid position is less than a certain threshold, the cluster affiliation no longer changes, or the maximum number of iterations is reached, etc.

[0077] As an example, using the optimal number of clusters determined by the elbow rule as the number of cluster centers, several sample vectors from the optimal clusters are randomly selected as initial centroids. Subsequently, refer to... Figure 9 The algorithm first inputs the software feature map corresponding to the software to be clustered into the encoder of an autoencoder. Through a multi-layer network, it compresses and encodes the feature map layer by layer to obtain low-dimensional latent feature vectors representing the core behavior of the software. Then, iterative optimization begins: in each iteration, an allocation step is performed, calculating the distance (usually Euclidean distance) from the latent feature vector corresponding to each software feature map to several centroids of all current optimal clusters, and assigning the latent feature vector to the cluster containing the nearest centroid. Next, an update step is performed, recalculating the mean vector of each cluster as its new centroid based on the new set of all latent feature vectors after this allocation. This allocation and update step is repeated until convergence conditions are met (e.g., the change in centroid position is less than a preset threshold, or the maximum number of iterations is reached). Once the algorithm converges, the final clustering result is obtained. Finally, the cluster category label of each latent feature vector in the clustering result is directly used as the final category label of the corresponding software to be clustered. By automatically revealing the inherent similarity structure between samples through unsupervised learning, each unknown malware is given a clear behavioral category label, achieving efficient and objective family classification without manual annotation, and significantly improving the analysis efficiency and accuracy in small sample scenarios.

[0078] In some embodiments, after the step of performing cluster analysis on the image set composed of all software feature maps using a clustering algorithm to obtain the cluster category labels of each software to be clustered, the method further includes: Obtain the true labels of each clustering software and calculate the adjusted RAND index between the category labels and the true labels.

[0079] After the clustering analysis is completed, the Adjusted Rand Index (ARI) is calculated to quantify the degree of consistency between the unsupervised clustering results and the supervised real labels, thereby scientifically measuring the effectiveness and accuracy of the proposed method.

[0080] As an example, the true labels of each software to be clustered are obtained, representing the known true category affiliation of the software; subsequently, based on the category labels obtained from the clustering results and the true labels, the RAND Index (RI) is calculated, and its calculation formula is as follows: , where a is the number of sample pairs that are classified into the same class in both partitions (C and K), b is the number of sample pairs that are classified into different classes in both partitions (C and K), C refers to the number of real classes in the dataset, and K refers to the number of virtual classes used. When K=C, it means that the clustering is 100% correct. C 2 n This represents the total number of element pairs that can be formed from a dataset containing n samples. Next, to eliminate the influence of random partitioning, the Adjusted Rand Index (ARI) is calculated, with the following formula: Where E(RI) is the expected Rand index under random partitioning, and max(RI) is the maximum probable Rand index. The ARI value ranges from [-1, 1]. The closer it is to 1, the higher the consistency between the clustering result and the true label; the closer it is to -1, the lower the consistency; and a negative value indicates that the clustering result is worse than random partitioning. By adjusting the calculation of the Rand index ARI, the clustering accuracy of the software classification method in this application under small-scale samples can be accurately evaluated.

[0081] Furthermore, the software clustering method in this application introduces a standardized evaluation process after cluster analysis and conducts comparative experiments with existing mainstream technologies. Specifically, after obtaining the category labels of each sample (the software to be clustered), the true family labels corresponding to each sample (the software to be clustered), such as Ramnit and Lollipop, are further obtained. Two core metrics, Accuracy (Acc) and Adjusted Rand Index (ARI), are used to quantitatively evaluate the clustering results. Acc measures the matching ratio between the clustered labels and the true labels under the optimal mapping, while ARI, by correcting for random consistency, more robustly evaluates the similarity between the two label assignment schemes. The closer its value is to 1, the better the clustering result matches the true structure. The experiments were conducted on two malware datasets of significantly different sizes: Dataset 1 was a large-scale dataset containing three families: Ramnit (1543 samples), Lollipop (2479 samples), and Kelihos ver3 (2942 samples); Dataset 2 was a typical small-scale dataset, containing only 50 samples from each family, for a total of 150 samples, used to simulate the scarcity of novel or rare malware samples in real-world scenarios. Table 1 below shows the two malware datasets of significantly different sizes.

[0082] Table 1. Two malware datasets with significantly different sizes.

[0083] The experimental results are shown in Table 2 below: Table 2 Comparison of Clustering Accuracy (Acc) and Adjusted Rand Index for Different Clustering Methods

[0084] The experimental results show that, in the larger dataset 1, the existing opcode 2-gram inverse text frequency method (Opcode_2-gram_TFIDF) achieves an accuracy of 81.4% and an adjusted Rand index of 0.588. The one-hot encoded image method without image upscaling (OneHot_Image) performs slightly worse, with an accuracy of only 71.3% and an adjusted Rand index of 0.446. However, the one-hot encoded zoomed image method (OneHot_ZoomImage) after bilinear interpolation significantly improves the clustering effect, increasing the accuracy from 71.3% to 96.3% and the adjusted Rand index from 0.446 to 0.898, far exceeding the current level. This indicates that images enlarged through bilinear interpolation are very effective for the final clustering results.

[0085] In dataset 2, with a very small sample size, the existing opcode grammar term frequency inverse text frequency method (Opcode_2-gram_TFIDF) shows a significant performance drop, with an accuracy of only 47.3% and an adjusted Rand index of only 0.332. The one-hot encoded image method (OneHot_Image) also sees its accuracy drop to 64.2% and its adjusted Rand index drop to 0.397, but the decline is far less than that of the existing opcode grammar term frequency inverse text frequency method. On the other hand, the one-hot encoded zoom image method (OneHot_ZoomImage), after bilinear interpolation amplification, still maintains an accuracy of 86.0% and an adjusted Rand index of 0.608, significantly outperforming the other two methods.

[0086] The above comparison results show that the bilinear interpolation image magnification scheme proposed in this application can effectively improve the feature recognition and adaptability of clustering algorithms by transforming one-dimensional numerical features into two-dimensional visual features with spatial texture. It not only achieves performance superiority on large datasets, but also shows strong robustness in small-scale sample scenarios. It solves the problem of the sharp decline in clustering accuracy when the data is sparse in existing technologies, and provides a more reliable and universal technical solution for malware clustering analysis.

[0087] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the software clustering method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0088] This application also provides a software clustering device, please refer to... Figure 10 The software clustering device includes: The sequence code extraction module 1010 is used to extract the opcode sequence corresponding to the public dataset from the public dataset containing disassembled files of multiple software programs; One-hot encoding module 1020 is used to perform one-hot encoding on the opcodes in the opcode sequence according to their frequency to obtain a general one-hot encoding mapping table corresponding to the opcodes; The vector document generation module 1030 is used to determine the target opcode sequence corresponding to the software to be clustered, and generate a vectorized document corresponding to the software to be clustered based on the general one-hot coding mapping table and the target opcode sequence. The reshaping module 1040 is used to reshape the vectorized document into an initial grayscale image and construct the software feature map corresponding to the clustering software based on the initial grayscale image. The clustering module 1050 is used to perform clustering analysis on software feature maps using clustering algorithms, and to determine the category labels of the software to be clustered based on the clustering results of the software feature maps.

[0089] The software clustering device provided in this application, employing the software clustering method in the above embodiments, can solve the technical problem of low clustering accuracy caused by data sparsity in existing malware clustering methods on small-scale sample datasets. Compared with the prior art, the beneficial effects of the software clustering device provided in this application are the same as those of the software clustering method provided in the above embodiments, and other technical features in the software clustering device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0090] This application provides a software clustering device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the software clustering method in Embodiment 1 above.

[0091] The following is for reference. Figure 11 The diagram illustrates a structural schematic of a software clustering device suitable for implementing embodiments of this application. The software clustering device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, tablets (Portable Application Description, PADs), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 11 The software clustering device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0092] like Figure 11 As shown, the software clustering device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The random access memory 1004 also stores various programs and data required for the operation of the software clustering device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the software clustering device to communicate wirelessly or wiredly with other devices to exchange data. Although software clustering devices with various systems are shown in the figure, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems can be implemented alternatively.

[0093] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0094] The software clustering device provided in this application, employing the software clustering method described in the above embodiments, can solve the technical problem of low clustering accuracy caused by data sparsity in existing malware clustering methods on small-scale sample datasets. Compared with the prior art, the beneficial effects of the software clustering device provided in this application are the same as those of the software clustering method provided in the above embodiments, and other technical features of this software clustering device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0095] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0096] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0097] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the software clustering method in the above embodiments.

[0098] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0099] The aforementioned computer-readable storage medium may be included in the software clustering device; or it may exist independently and not be assembled into the software clustering device.

[0100] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by a software clustering device, the software clustering device: extracts the opcode sequence corresponding to the public dataset from a public dataset containing disassembled files of multiple software programs; performs one-hot encoding on the opcodes in the opcode sequence according to their frequency to obtain a general one-hot encoding mapping table corresponding to the opcodes; determines the target opcode sequence corresponding to the software to be clustered, and generates a vectorized document corresponding to the software to be clustered based on the general one-hot encoding mapping table and the target opcode sequence; reshapes the vectorized document into an initial grayscale image, and constructs a software feature map corresponding to the software to be clustered based on the initial grayscale image; performs clustering analysis on the software feature map using a clustering algorithm, and determines the category label of the software to be clustered based on the clustering results of the software feature map.

[0101] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0102] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0103] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0104] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described software clustering method. This solves the technical problem of low clustering accuracy in existing malware clustering methods on small-scale sample datasets due to data sparsity. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the software clustering method provided in the above embodiments, and will not be repeated here.

[0105] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the software clustering method described above.

[0106] The computer program product provided in this application can solve the technical problem of low clustering accuracy caused by data sparsity in existing malware clustering methods on small-scale sample datasets. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the software clustering method provided in the above embodiments, and will not be repeated here.

[0107] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A software clustering method, characterized in that, The software clustering method includes: Extract the opcode sequence corresponding to the public dataset from a public dataset containing disassembled files of multiple software programs; The opcodes in the opcode sequence are one-hot encoded according to their frequency to obtain a general one-hot encoding mapping table corresponding to the opcodes; Determine the target opcode sequence corresponding to the software to be clustered, and generate a vectorized document corresponding to the software to be clustered based on the general one-hot coding mapping table and the target opcode sequence. The vectorized document is reshaped into an initial grayscale image, and a software feature map corresponding to the software to be clustered is constructed based on the initial grayscale image; Clustering algorithms are used to perform clustering analysis on the software feature maps, and the category labels of the software to be clustered are determined based on the clustering results of the software feature maps.

2. The software clustering method as described in claim 1, characterized in that, The step of constructing the software feature map corresponding to the clustering software based on the initial grayscale image includes: The initial grayscale image is enlarged to a standard size using bilinear interpolation to obtain the software feature map corresponding to the clustering software.

3. The software clustering method as described in claim 2, characterized in that, The step of enlarging the initial grayscale image to a standard size using bilinear interpolation to obtain software feature maps corresponding to each of the clustering software includes: For each pixel to be determined in the software feature map, the corresponding original position of the pixel to be determined is determined in the initial grayscale image; In the initial grayscale image, four neighboring pixels around the original position are determined, including the top-left pixel, the top-right pixel, the bottom-left pixel, and the bottom-right pixel; Based on the gray values ​​of the lower left and lower right pixels, the gray value of the first virtual point is obtained through linear interpolation in the horizontal direction. Based on the gray values ​​of the top left and top right pixels, the gray value of the second virtual point is obtained through linear interpolation in the horizontal direction. Based on the gray values ​​of the first virtual point and the second virtual point, the gray value of the pixel to be determined is obtained by linear interpolation in the vertical direction. The software feature map of the standard size is generated by traversing and calculating the grayscale values ​​of all the pixels to be determined in the software feature map.

4. The software clustering method as described in any one of claims 1 to 2, characterized in that, The step of performing one-hot encoding on the opcodes in the opcode sequence according to their frequencies to obtain a general one-hot encoding mapping table corresponding to the opcodes includes: Determine the total frequency of each opcode in the opcode sequence of the public dataset; The opcodes are sorted in descending order of their total frequency of occurrence to generate a global opcode frequency sorting table containing the opcodes, their corresponding total frequency of occurrence, and sorting numbers. Using the global opcode frequency sorting table, one-hot encoding is performed on each opcode to obtain the general one-hot encoding mapping table containing the opcode and the one-hot encoding vector corresponding to the opcode.

5. The software clustering method as described in any one of claims 1 to 2, characterized in that, The step of generating the vectorized document corresponding to the clustering software based on the general one-hot coding mapping table and the target opcode sequence includes: For each target opcode in the target opcode sequence, the target one-hot encoding vector corresponding to the target opcode is queried according to the general one-hot encoding mapping table; The target one-hot encoded vectors corresponding to all target opcodes in the target opcode sequence are summed, and the sum vector is used as the vectorized document of the clustering software.

6. The software clustering method as described in any one of claims 1 to 2, characterized in that, The step of using a clustering algorithm to perform clustering analysis on the software feature map, and determining the category label of the software to be clustered based on the clustering results of the software feature map, includes: The elbow rule is used to determine the optimal number of clusters for clustering. K-means clustering is performed on the software feature map using the optimal number of cluster centers. Based on the clustering results of the software feature map, the category label of the software to be clustered is determined.

7. The software clustering method as described in claim 6, characterized in that, The step of determining the optimal number of clusters using the elbow rule includes: Obtain the number of multiple distinct candidate clusters; For each candidate cluster number, K-means clustering is performed on the software feature map with the candidate cluster number as the number of cluster centers, and the sum of squared errors corresponding to the clustering results under the candidate cluster number is calculated; Calculate the absolute value of the difference between the sum of squared errors corresponding to the number of candidate clusters and the sum of squared errors corresponding to the number of previous candidate clusters, wherein the number of candidate clusters is adjacent to the number of previous candidate clusters and the number of candidate clusters is greater than the number of previous candidate clusters; If the absolute value of the difference is less than a preset value, the corresponding number of candidate clusters will be determined as the preliminary optimal number of clusters. The minimum value among the preliminary optimal cluster numbers is determined as the optimal cluster number.

8. The software clustering method as described in claim 6, characterized in that, The step of performing K-means clustering on the software feature map using the optimal number of cluster centers as the number of cluster centers, and determining the category label of the software to be clustered based on the clustering results of the software feature map, includes: The optimal number of clusters is used as the number of cluster centers to initialize the number of centroids for the optimal number of clusters; The software feature map is latently encoded using an autoencoder to obtain the corresponding latent feature vector; The latent feature vectors are assigned to the clusters to which the nearest centroids belong, and the cluster affiliations of each cluster centroid and each latent feature vector are iteratively updated until the convergence condition is met, thus obtaining the clustering results. The cluster category label of the cluster to which each potential feature vector in the clustering result belongs is used as the category label of the corresponding clustering software.

9. A software clustering device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the software clustering method as described in any one of claims 1 to 8.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the software clustering method as described in any one of claims 1 to 8.

Images