A software detection method and device, and a storage medium

Abstract

This application provides a software detection method, apparatus, and storage medium. A first network, through pre-training, learns the general structure and semantic features of malicious binary files, which are then shared as a frozen feature extraction backbone with the second and third networks. This enhances the model's resistance to code obfuscation, packing, and variant evasion techniques, significantly improving its detection capabilities for unknown and novel malicious software. The third network generates a large number of high-quality, labeled third images for training the second network, overcoming the practical bottlenecks of difficult malicious sample acquisition and high annotation costs, and significantly improving the performance ceiling of data-driven models in scenarios with scarce samples. The parameters of the third network are correlated with those of the first network, allowing the generator to inherit the powerful representational capabilities of the pre-trained model, resulting in higher-quality generated samples and ultimately making the decision boundaries of the second network clearer and more accurate.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a software detection method, apparatus, and storage medium. Background Technology

[0002] With the rapid popularization of the Internet of Things (IoT) and mobile internet, a large number of new network applications have emerged, greatly improving the convenience of life. However, this has also led to a continuous increase in the types and numbers of malware, becoming a key threat in the field of cybersecurity. Due to the difficulty in obtaining malware samples and the significant differences in the number of different types of malware, resulting in an imbalance in malware categories, the performance of data-driven models for malware detection is not satisfactory.

[0003] Currently, to solve the problem of malware detection, it is usually necessary to use existing malware samples to train deep convolutional networks. However, since the distribution of malware types is unbalanced, there are many data samples of common types, but few data samples of rare types, and they are difficult to obtain. This may lead to insufficient training of deep convolutional networks, making it impossible to accurately detect rare malware during software detection, and reducing the ability to detect unknown and new malware. Summary of the Invention

[0004] To address the problems in the aforementioned related technologies, this application provides a software detection method, apparatus, and storage medium, which can greatly improve the detection capability for unknown and novel malicious software.

[0005] In a first aspect, embodiments of this application provide a software detection method, the method comprising: Generate a first image corresponding to the software under test based on the binary file of the software under test; The global features of the first image are extracted using a trained first network; the first network is trained based on multiple existing second images. The detection result of the software under test is determined using a trained second network based on the global features; the second network is trained based on multiple second images and a third image corresponding to each second image; each third image is generated by the third network based on the corresponding second image; at least one parameter of the third network is determined based on the parameters of the trained first network.

[0006] Through the above methods, the first network learns the general structure and semantic features of malware binary files through pre-training. This information is then shared with the second and third networks as a frozen feature extraction backbone. This enhances the model's resistance to evasion techniques such as code obfuscation, packing, and variants, significantly improving its ability to detect unknown and novel malware. The third network generates a large number of high-quality, labeled third images for training the second network, overcoming the practical bottlenecks of difficult malware sample acquisition and high annotation costs. This significantly improves the performance ceiling of data-driven models in scenarios with scarce samples. The parameters of the third network are correlated with those of the first network, allowing the generator to inherit the powerful representational capabilities of the pre-trained model, resulting in higher-quality generated samples and ultimately making the decision boundaries of the second network clearer and more accurate.

[0007] In one possible implementation, generating the first image corresponding to the software under test based on the binary file of the software under test includes: Obtain the original byte sequence of the binary file of the software under test; Repeat the following steps until the number of unprocessed bytes is less than the first number: A pixel is generated based on three consecutive unprocessed bytes in the order of the original byte sequence; the pixel value of the pixel is determined by the values ​​of the three consecutive unprocessed bytes. The three unprocessed bytes used to generate the pixel are marked as processed bytes; The generated pixels are arranged according to a preset width and height to generate the first image.

[0008] By mapping each byte of a binary file directly to a color channel value of a color image, the complete information preservation from a one-dimensional byte sequence to a two-dimensional color image is achieved without information compression or loss, thus overcoming the fundamental flaw of information loss in traditional grayscale image conversion methods. This rule-based mapping method requires no prior knowledge or manual annotation, and can automatically and batch-convert any binary file to an image, offering high processing efficiency and good consistency. Mapping three consecutive bytes to the RGB channel of the same pixel preserves the local correlation between adjacent bytes in the byte sequence, which is beneficial for the subsequent network to learn local patterns in the code.

[0009] In one possible implementation, before arranging each generated pixel according to a preset width and height, the method further includes: If the original byte sequence contains unprocessed bytes, the target quantity is determined based on the number of unprocessed bytes and the first quantity. A pixel is generated based on the unprocessed bytes and the preset pixel value of the target number.

[0010] By employing the above method, it is ensured that every byte of the binary file is mapped to the image, regardless of whether the file size is a multiple of 3, without any data loss, thus preserving the complete information of the software under test to the greatest extent. Through a pre-set pixel value completion mechanism, all converted images have a regular size and format, facilitating subsequent batch input into deep learning networks for training and inference.

[0011] In one possible implementation, the first network is trained in the following manner: The target second image is segmented into multiple target image blocks; the target second image is any one of the multiple existing second images. A second number of target image blocks are selected from the plurality of target image blocks as undetermined image blocks, and the pixel value of each pixel point contained in each undetermined image block is set from the initial value to the target value; Each target image block and the undetermined image block corresponding to the target second image are input into the first network to obtain the feature representation output by the first network for each target image block; Based on the feature representation, predict the pixel value of each pixel in each of the target image blocks to be determined, and obtain the predicted value of each pixel in each target image block to be determined; The parameters of the first network are adjusted based on the difference between the predicted value and the initial value of each pixel contained in each of the target image blocks to be determined.

[0012] By employing the above methods and utilizing self-supervised tasks, the first network can be pre-trained on a large number of unlabeled binary file images, autonomously learning the underlying byte structure and semantic features of malware, greatly reducing the labeling cost of training data. The first network dynamically models the dependencies between image patches through a self-attention mechanism. Masked regions not only rely on their own local information but can also refer to relevant patterns in other locations throughout the image for prediction, forming a global understanding of the file structure.

[0013] In one possible implementation, adjusting the parameters of the first network based on the difference between the predicted value and the initial value of each pixel contained in each of the target image blocks to be determined includes: For each of the undetermined image blocks in the second number of undetermined image blocks, the mean square error between the predicted value and the initial value is determined to obtain the second number of loss values; The parameters of the first network are adjusted based on the sum of the second number of loss values.

[0014] In this way, the loss function supervises the predicted values ​​pixel by pixel, enabling the first network to learn the precise color distribution of the masked region, resulting in a more refined and accurate feature representation obtained through pre-training. The loss values ​​of the second number of masked image patches are summed and backpropagated, allowing the model to simultaneously optimize the prediction tasks of multiple local regions, accelerating convergence and avoiding overfitting to features of a single region.

[0015] In one possible implementation, the second network is trained as follows: Multiple second images and multiple third images are input into the second network, and the parameters of the second network are adjusted until the loss function reaches a preset target. The loss function is a weighted sum of a first loss, a second loss, and a third loss. The first loss is used to characterize the difference in visual distribution between the image generated by the third network and the real image. The second loss is used to characterize the difference between each third image and the corresponding second image. The third loss is used to characterize the difference between the detection result of the second network for each second image and each third image and the actual result.

[0016] By using the above method, triple loss is used for constraint, and triple supervision jointly guides the training of the third network, enabling the generator to produce high-quality, high-value data for the training of the second network. This effectively solves the technical problem of unstable sample quality in unidirectional generation models, which affects the accuracy of detection and classification.

[0017] In one possible implementation, the plurality of third images are generated in the following manner: Multiple second images are input into the third network to obtain multiple synthesized second images; If any synthesized second image is detected by the fourth network and determined to be the real image, then the synthesized second image is input into the third network to obtain the third image; the fourth network is used to detect whether the synthesized second image is a real image in terms of visual distribution.

[0018] In this way, the fourth network acts as a filter in the generation chain of the third image. Only synthesized images that pass the detection are used in the next round of generation, ensuring that the quality of samples entering the loop is controllable. The third image is essentially the reconstructed result after a complete loop, and its difference from the original second image directly reflects the degree of information loss in the generation process, providing a computational basis for the cycle consistency loss. Because the filtering mechanism of the fourth network incentivizes the third network to generate more diverse and compliant samples, the final distribution of the generated third image is closer to the real data distribution, effectively avoiding the pattern collapse problem.

[0019] Secondly, embodiments of this application provide a software detection device, the device comprising: The first image generation unit is used to generate a first image corresponding to the software under test based on the binary file of the software under test; A global feature extraction unit is used to extract global features of the first image using a trained first network; the first network is trained based on multiple existing second images. The detection result determination unit is used to determine the detection result of the software under test based on the global features using a trained second network; the second network is trained based on multiple second images and a third image corresponding to each second image; each third image is generated by the third network based on the corresponding second image; at least one parameter of the third network is determined based on the parameters of the trained first network.

[0020] Thirdly, embodiments of this application provide an electronic device, including: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the method described in the first aspect according to the obtained program instructions.

[0021] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the method described in the first aspect.

[0022] This application provides a software detection method, apparatus, and storage medium. A first network, through pre-training, learns the general structure and semantic features of malicious binary files, which are then shared as a frozen feature extraction backbone with the second and third networks. This enhances the model's resistance to code obfuscation, packing, and variant evasion techniques, significantly improving its detection capabilities for unknown and novel malicious software. The third network generates a large number of high-quality, labeled third images for training the second network, overcoming the practical bottlenecks of difficult malicious sample acquisition and high annotation costs, and significantly improving the performance ceiling of data-driven models in scenarios with scarce samples. The parameters of the third network are correlated with those of the first network, allowing the generator to inherit the powerful representational capabilities of the pre-trained model, resulting in higher-quality generated samples and ultimately making the decision boundaries of the second network clearer and more accurate. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This application provides an illustration of an application scenario for a software detection method. Figure 2 A flowchart illustrating a software detection method provided in this application embodiment; Figure 3 A schematic diagram of an interface for creating a target scene provided in an embodiment of this application; Figure 4 A schematic diagram of a second network training architecture provided for an embodiment of this application; Figure 5 A detailed flowchart of a software detection method provided in an embodiment of this application; Figure 6 A structural block diagram of a software testing device provided in an embodiment of this application; Figure 7 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] It should be noted that the terms "comprising" and "having" and their variations used in this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or device.

[0027] The terms "first" and "second" used in this document are for descriptive purposes only and should not be construed as indicating relative importance or implying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0028] The word “exemplary” as used below means “serving as an example, embodiment, or illustration.” Any embodiment illustrated as an “exemplary” need not be construed as superior to or better than other embodiments.

[0029] The present application will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0030] In one possible embodiment, Figure 1 This illustration shows an application scenario diagram of a software detection method provided in an embodiment of this application, such as... Figure 1 As shown, the scenario includes computing device 100 and computing device 200. Computing device 100 can be used to download the software to be tested, and computing device 200 can be used to execute the software detection method provided in this application to perform software detection on the software to be tested in computing device 100. Alternatively, computing device 100 can be used for the training process of a first network, a second network, and a third network, and computing device 200 can be used to perform software detection using the first network, second network, and third network trained by computing device 100. The computing devices include, but are not limited to, mobile phones, tablets, laptops, handheld computers, and mobile internet devices (MIDs). It should be noted that this application may use fewer computing devices, such as one computing device simultaneously performing the training of the first network, the second network, and the third network, the downloading of the software to be tested, and the detection process; or it may include more computing devices, such as one computing device for downloading the software to be tested and the detection process, and multiple computing devices for training different networks respectively. Therefore, different numbers of computing devices can be set, and this application does not limit this.

[0031] Besides using computing devices, the software detection method provided in this application embodiment can also be deployed on a server. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. Similarly, this application does not limit the number of servers.

[0032] With the rapid popularization of the Internet of Things (IoT) and mobile internet, a large number of new network applications have emerged, greatly improving the convenience of life. However, this has also led to a continuous increase in the types and numbers of malware, becoming a key threat in the field of cybersecurity. Due to the difficulty in obtaining malware samples and the significant differences in the number of different types of malware, resulting in an imbalance in malware categories, the performance of data-driven models for malware detection is not satisfactory.

[0033] Currently, to solve the problem of malware detection, it is usually necessary to use existing malware samples to train deep convolutional networks. However, since the distribution of malware types is unbalanced, there are many data samples of common types, but few data samples of rare types, and they are difficult to obtain. This may lead to insufficient training of deep convolutional networks, making it impossible to accurately detect rare malware during software detection, and reducing the ability to detect unknown and new malware.

[0034] Therefore, in order to solve the above problems, embodiments of this application provide a software detection method. Figure 2 A flowchart of a software detection method provided in an embodiment of this application is shown, such as... Figure 2 As shown, the method may include the following steps: Step S201: Generate the first image corresponding to the software under test based on the binary file of the software under test.

[0035] In one possible embodiment, to complete step S201, the original byte sequence of the binary file of the software under test can first be obtained. For any software under test, it is essentially a binary file; reading this file yields a sequence of bytes arranged in order. The length of this sequence is the total number of bytes in the binary file.

[0036] In one possible embodiment, after obtaining the original byte sequence, it is necessary to determine the size of the first image to be generated, namely the preset image width and height. This width and height can be preset according to the actual application scenario; for example, a fixed size can be set based on the common file size of the software under test, or a suitable size can be dynamically calculated based on the total number of bytes in the binary file, so that the generated image can fully accommodate all the byte information. After determining the width and height, a blank RGB image canvas can be created, the total number of pixels of which is the product of the width and height.

[0037] In one possible embodiment, the original byte sequence is traversed, starting from the first unprocessed byte, and three consecutive unprocessed bytes are taken sequentially each time to generate a pixel. Specifically, the value of the first byte of the three consecutive bytes is used as the value of the red channel, the value of the second byte as the value of the green channel, and the value of the third byte as the value of the blue channel, thus forming a complete RGB pixel. After each pixel is generated, the three bytes used to generate the pixel are marked as processed bytes, and then the subsequent bytes are processed until the number of remaining unprocessed bytes is less than three (i.e., less than a first number, which is 3 in this application). The above operation can be represented as the following loop: determine whether the current number of unprocessed bytes is less than 3. If it is not less than 3, take three consecutive unprocessed bytes to generate a pixel, mark it as processed, and repeat the determination and generation operation; if it is less than 3, exit the loop and enter the end processing logic.

[0038] In one possible embodiment, after completing the above-described cyclic pixel generation operation, each generated pixel is arranged according to a preset image width and height. Specifically, these pixels are sequentially filled into the previously created blank image canvas in row-major order (i.e., from left to right and from top to bottom). When a row is filled, a new row is started and the filling continues until all generated pixels have filled the canvas, thereby obtaining the first image corresponding to the software under test.

[0039] It's important to note that before arranging each generated pixel according to the preset width and height, a special case needs to be handled: after the loop ends, there may still be unprocessed bytes in the original byte sequence (i.e., the number of remaining bytes is 1 or 2). In this case, the target number needs to be determined based on the number of unprocessed bytes and a first target (i.e., 3). Specifically, the target number equals the first target minus the number of unprocessed bytes, i.e., the target number is 3 minus the number of remaining bytes. Then, a pixel is generated based on the unprocessed bytes and the preset pixel value of this target number. For example, if there are 2 unprocessed bytes remaining, the target number is 1. In this case, the value of the first unprocessed byte is assigned to the red channel, the value of the second unprocessed byte is assigned to the green channel, and the blue channel is assigned the preset pixel value 0, forming one pixel. If there is 1 unprocessed byte remaining, the target number is 2. In this case, the value of that unprocessed byte is assigned to the red channel, and both the green and blue channels are assigned the preset pixel value 0, forming one pixel. This preset pixel value can be 0 or set to other values ​​as needed. After the completion operation is completed, the newly generated pixel also participates in the subsequent arrangement and fills the image canvas, thus ensuring that all bytes in the original byte sequence are completely mapped to the first image without any omissions.

[0040] Step S202: Extract global features of the first image using the trained first network.

[0041] In one possible embodiment, the first network mentioned in step S202 can adopt a Vision Transformer (ViT) architecture. This architecture does not rely on convolutional operations but captures the relationships between image patches through a self-attention mechanism, effectively modeling the global contextual information of the image. During the pre-training phase, the first network learns the general structure and semantic representation of binary file images from a large number of unlabeled second images through a mask self-supervised learning task.

[0042] Specifically, for any one of the multiple existing second images (denoted as the target second image), the target second image is first divided into multiple target image blocks. Each target image block has a fixed size, for example, P×P pixels. Then, the target second image is divided into N non-overlapping target image blocks, where N is equal to the image height multiplied by the width and then divided by the square of P.

[0043] After segmentation, a second number of target image blocks are selected from the multiple target image blocks as candidate image blocks. This selection can be random, and the selection ratio can be preset, such as selecting 30% or 50% of the image blocks as candidate image blocks. For each candidate image block, the pixel value of each pixel contained therein is set from the initial value to the target value. Here, the initial value refers to the original pixel value of the candidate image block before it was selected, and the target value refers to the preset mask value, for example, all pixel values ​​can be set to 0. Through this operation, the information of these candidate image blocks in the target second image is "erased".

[0044] Then, each target image patch and the undetermined image patch corresponding to the second target image are input into the first network. It should be noted that the second target image input to the first network here is the masked version—that is, the pixel values ​​of some image patches (undetermined image patches) have been set to the target values, while the pixel values ​​of the remaining image patches remain unchanged. The first network processes the input second target image, outputting a corresponding feature representation for each target image patch. In the first network, each image patch is first flattened into a one-dimensional vector, then mapped to a high-dimensional space through a linear embedding layer, and positional encoding is added to preserve spatial location information. Finally, it passes through multiple Transformer encoders to output a high-level feature representation for each target image patch.

[0045] After obtaining the feature representation of each target image patch, the pixel value of each pixel in each unmasked target image patch is predicted based on this feature representation, thus obtaining the predicted value of each pixel in each unmasked target image patch. In other words, the first network needs to predict the original pixel values ​​of the erased region based on the features of the unmasked image patch and the feature representation of the masked image patch itself. The essence of this prediction task is to enable the first network to learn and understand the underlying structure and semantic information in the binary file image.

[0046] Finally, the parameters of the first network are adjusted based on the difference between the predicted value and the initial value for each pixel in each target image block. Specifically, for each of the second number of target image blocks, the mean squared error between the predicted value and the initial value is determined, resulting in a second number of loss values. Then, based on the sum of these second number of loss values, backpropagation using optimization algorithms such as gradient descent is employed to adjust the parameters of the first network. This mean squared error loss function can measure the difference between the predicted value and the true value pixel by pixel, prompting the first network to continuously improve the accuracy of predicting the masked region.

[0047] In one possible embodiment, the first network repeatedly undergoes a "masking-prediction-parameter tuning" training process on a large number of second images, eventually learning a general feature representation that can effectively characterize the underlying structure and semantics of binary files. After the first network is trained, its network weights are frozen, serving as the backbone for feature extraction in the entire system. When detecting the software under test, the first image generated in step S201 is directly input into the trained and weight-frozen first network to extract the global features of the first image. These global features can be derived from the final state of the classification token (CLS token) output by the first network, which aggregates information from various image blocks in the entire image and can represent the global semantics of the entire image.

[0048] Figure 3 This diagram illustrates a mask self-supervised pre-training process, as shown below. Figure 3As shown, in the pre-training phase, the input image is first segmented into multiple non-overlapping image patches, and a subset of these patches is randomly selected according to a preset ratio. All pixel values ​​of the selected patches are set as preset mask values. Then, all masked image patches are sequentially flattened and linearly transformed into corresponding embedding vectors. Positional encoding is added to each embedding vector, and a learnable classification token is appended to the beginning of the embedding vector sequence. Next, all processed embedding vectors are input into a Transformer encoder. After processing by multiple Transformer encoders, a high-level feature representation for each image patch is output. Finally, the high-level feature representation of each masked image patch is input into a multilayer perceptron. This multilayer perceptron predicts the original pixel values ​​of each pixel in each masked image patch, obtaining predicted pixel values. The parameters of the Transformer encoder and the multilayer perceptron are then adjusted based on the difference between the predicted pixel values ​​and the actual original pixel values. After pre-training, the multilayer perceptron is removed, and only the Transformer encoder is retained as the backbone for feature extraction in subsequent tasks.

[0049] Step S203: Use the trained second network to determine the detection result of the software under test based on global features.

[0050] In one possible embodiment, after the first image is generated in step S201, it is input to the first network. The first network has been pre-trained in step S202, and its network weights are frozen. It serves as the feature extraction backbone to process the first image corresponding to the software under test, outputting the global features of the first image. These global features can be the final state representation of the classification token (CLS token) in the first network. This token aggregates information from various image patches in the first image and can represent the global semantic information of the entire image. The global features output by the first network are input to the second network. The second network is a classifier, and its structure includes a feature extraction backbone and a classification head. The feature extraction backbone is the aforementioned first network (with frozen weights), and the classification head is a multilayer perceptron. The multilayer perceptron receives the global features output by the first network, processes them through fully connected layers and activation functions, and finally outputs a probability distribution through a Softmax function. This probability distribution is used to indicate the detection result of the software under test.

[0051] In one possible embodiment, the detection results include two levels of information: the first level is a binary classification result, used to indicate whether the software under test is malware; the second level is a multi-classification result, used to further indicate the malware family category to which the software under test belongs (e.g., which known malware family it belongs to) when the software under test is determined to be malware. In this way, the second network completes end-to-end detection and classification of the software under test based on the global features extracted by the first network.

[0052] It should be noted that the second network was trained on multiple second images and multiple third images before being deployed. The second images are existing image samples, including images of malware and benign software; the third images are synthetic images generated by the third network based on the second images, including synthetic malware and synthetic benign software images. The specific training method for the second network and the specific generation method for the third images are as follows: During the training phase of the second network, multiple second and third images are input into it, and the parameters of the second network are adjusted until the loss function reaches a preset target. This loss function is a weighted sum of the first, second, and third losses. The first loss characterizes the difference in visual distribution between the image generated by the third network and the real image, i.e., the adversarial loss. Its function is to constrain the image generated by the third network to be visually realistic, making it impossible for the discriminator to distinguish between the generated image and the real image. The second loss characterizes the difference between each third image and its corresponding second image, i.e., the cycle consistency loss. Its function is to constrain the reconstructed image obtained by the third network after "forward generation" and then "backward generation" to be consistent with the original image, preventing the loss or tampering with the core structural information of the original file during the generation process. The third loss characterizes the difference between the detection results of the second network for each second and third image and the actual results, i.e., the classification loss. Its function is to constrain the second network to make the predicted label of the input image consistent with the real label, ensuring that the generated sample is not only visually realistic but also has the correct category label. After the above three losses are weighted and summed, backpropagation is performed through optimization algorithms such as gradient descent, while simultaneously adjusting the parameters of the second and third networks.

[0053] When generating the third image, multiple second images are input into the third network. The third network processes each second image and outputs a corresponding synthesized second image. For any synthesized second image, it is input into the fourth network for detection. The fourth network is used to detect whether the synthesized second image is a real image in terms of visual distribution, that is, to distinguish whether the input image is a synthesized image generated by the third network or a real image. If any synthesized second image passes the detection of the fourth network, that is, the fourth network determines that the synthesized second image is a real image, then the synthesized second image is input into the third network again. The third network performs a reverse transformation on the synthesized second image to obtain the final third image. Through the above process of "forward generation → fourth network quality detection → reverse generation", the third image generated by the third network simultaneously meets the dual requirements of visual realism and content preservation, and can be used as a high-quality augmentation sample for training the second network.

[0054] Specifically, the first loss can be expressed as: L adv =E B~p(B) [logDB (B)]+E M~p(M) [log(1-D B (B m )]+E M~p(M) [logD M (M)]+E B~p(B) [log(1-D M (M b )] Where B represents a real, benign software image, and M represents a real, malicious software image, B m M represents a synthetic benign software image generated from a malware image via a third-party network. b D represents a synthetic malware image generated from benign software images via a third-party network. B D represents the first detection discriminator. M Let E represent the second detection discriminator, p(B) represent the distribution of real benign software images, p(M) represent the distribution of real malicious software images, and log represent the natural logarithm. In the above formula, E... B~p(B) [logD B [(B)] represents the discrimination result of the first detection discriminator on real benign software images. The larger this term is, the stronger the ability of the first detection discriminator to distinguish real benign software images as real images; E M~p(M) [log(1-D B (B m [)] represents the discrimination result of the first detection discriminator on the synthetic benign software image generated by the third network. The larger this term is, the stronger the ability of the first detection discriminator to distinguish the synthetic benign software image as a fake image; E M~p(M) [logD M [M] represents the discrimination result of the second detection discriminator on the real malware image. The larger this value is, the stronger the ability of the second detection discriminator to distinguish the real malware image as a real image; E B~p(B) [log(1-D M (M b The value represents the discrimination result of the second detection discriminator on the synthetic malware image generated by the third network. The larger this value is, the stronger the ability of the second detection discriminator to distinguish the synthetic malware image as a fake image. During adversarial training, the third network (generator) attempts to minimize this adversarial loss to generate realistic images that can deceive the two detection discriminators, while the two detection discriminators attempt to maximize this adversarial loss to improve their ability to distinguish between real and generated images. Through this adversarial game, the images generated by the third network continuously approach the real images in terms of visual distribution.

[0055] The second loss can be expressed as: L cc =E B~p(B)[‖B-B'‖1]+E M~p(M) )[‖M-M'‖1], where B represents a real benign software image, M represents a real malicious software image, B′ represents a reconstructed benign software image obtained by transforming a real benign software image twice ("benign→malicious→benign"), M′ represents a reconstructed malicious software image obtained by transforming a real malicious software image twice ("malicious→benign→malicious"), ‖‖1 represents the L1 norm distance (i.e., the sum of the absolute values ​​of the differences between pixel values), E represents the expectation, p(B) represents the distribution of real benign software images, and p(M) represents the distribution of real malicious software images. In the above formula, E B~p(B) [‖B-B'‖1] represents the cycle consistency loss in the benign software image domain, i.e., the L1 norm distance between the original benign software image and the reconstructed benign software image, E M~p(M) [‖M-M'‖1] represents the cycle consistency loss in the malware image domain, i.e., the L1 norm distance between the original malware image and the reconstructed malware image. The L1 norm distance measures the difference between two images pixel by pixel. The smaller the distance, the closer the reconstructed image is to the original image, meaning that the third network has better preserved the content information of the original image during the conversion process. Through the constraint of the cycle consistency loss, the third network will not arbitrarily change or lose the core structural information of the original file when converting benign software images into synthetic malware images, because the synthetic malware image needs to be able to be restored to an image as consistent as possible with the original benign software image in the subsequent reverse conversion. Similarly, the process of converting malware images into synthetic benign software images is also subject to the same constraint. This bidirectional cycle constraint mechanism effectively prevents the third network from experiencing pattern collapse or shifts in the distribution of generated sample features during the generation process.

[0056] The third loss can be represented as L c =Entropy(D C (B),T(B))+Entropy(D C (M),T(M)), where D c D represents the second network (classifier / discriminator). C (B) represents the distribution of predicted labels for real benign software images by the second network, D C (M) represents the predicted label distribution of the second network for real malware images, T(B) represents the real labels of real benign software images, T(M) represents the real labels of real malware images, and Entropy represents the cross-entropy loss function. In the above formula, Entropy(D) C(B),T(B)) represents the cross-entropy loss between the second network's classification prediction of a real benign software image and the true label. This loss reflects the classification accuracy of the second network on benign software images; Entropy(D C (M),T(M)) represents the cross-entropy loss between the second network's classification prediction and the ground truth label for a real malware image. This loss reflects the classification accuracy of the second network on malware images. During joint training, the classification loss is used not only to update the parameters of the second network but also to guide the training of the third network. Specifically, the third network needs to generate synthetic samples that enable the second network to classify correctly, thereby minimizing the classification loss. This mechanism ensures that the synthetic samples generated by the third network have correct category semantic information. Adding them to the training data of the second network can effectively alleviate the problems of insufficient samples and class imbalance in malware detection.

[0057] Figure 4 A schematic diagram of a second network training architecture is shown, as follows: Figure 4 As shown, the second image can be either a benign software image B or a malicious software image M. When the second image is a benign software image B, the corresponding synthesized second image is a malicious software image M. b The corresponding third image is B'; when the second image is malware image M, the corresponding synthesized second image is malware image B. m The corresponding third image is M'. The third network used to generate malware images based on benign software images is the generator G_B_MS. The third network used to generate benign software images based on malware images is G_MS_B. The second network is the classification discriminator D_C. The fourth network used to detect malware images is the detection discriminator D_M. The fourth network used to detect benign software images is the detection discriminator D_B.

[0058] This application provides a software detection method, apparatus, and storage medium. A first network, through pre-training, learns the general structure and semantic features of malicious binary files, which are then shared as a frozen feature extraction backbone with the second and third networks. This enhances the model's resistance to code obfuscation, packing, and variant evasion techniques, significantly improving its detection capabilities for unknown and novel malicious software. The third network generates a large number of high-quality, labeled third images for training the second network, overcoming the practical bottlenecks of difficult malicious sample acquisition and high annotation costs, and significantly improving the performance ceiling of data-driven models in scenarios with scarce samples. The parameters of the third network are correlated with those of the first network, allowing the generator to inherit the powerful representational capabilities of the pre-trained model, resulting in higher-quality generated samples and ultimately making the decision boundaries of the second network clearer and more accurate.

[0059] In one specific embodiment, Figure 5 A detailed flowchart of a software detection method provided in this application embodiment is shown below. Figure 5 As shown, the method may include the following steps: Step S501: Obtain the original byte sequence of the binary file of the software under test.

[0060] Step S502: Determine whether the number of unprocessed bytes is less than the first number. If yes, proceed to step S505; otherwise, proceed to step S503.

[0061] Step S503: Generate a pixel based on three consecutive unprocessed bytes in the order of the original byte sequence.

[0062] Step S504: Mark the three unprocessed bytes used to generate the pixels as processed bytes. Then return to step S502.

[0063] Step S505: If the original byte sequence contains unprocessed bytes, then determine the target number based on the number of unprocessed bytes and the first number, and generate a pixel based on the preset pixel value of the unprocessed bytes and the target number.

[0064] Step S506: Divide the second target image into multiple target image blocks.

[0065] Step S507: Select a second number of target image blocks from multiple target image blocks as undetermined image blocks, and set the pixel value of each pixel in each undetermined image block from the initial value to the target value.

[0066] Step S508: Input each target image block and the undetermined image block corresponding to the second target image into the first network to obtain the feature representation output by the first network for each target image block.

[0067] Step S509: Based on the feature representation, predict the pixel value of each pixel in each target image block to obtain the predicted value of each pixel in each target image block.

[0068] Step S510: Adjust the parameters of the first network based on the difference between the predicted value and the initial value of each pixel contained in each target image block to be determined.

[0069] It should be noted that steps S506-S510 can be executed at any time before step S511, and are not limited to execution after step S505.

[0070] Step S511: Extract global features of the first image using the trained first network.

[0071] Step S512: Input multiple second images and multiple third images into the second network, and adjust the parameters of the second network until the loss function reaches the preset target.

[0072] It should be noted that step S512 can be executed before step S513 and at any time after steps S506-S510, and is not limited to execution after step S511.

[0073] Step S513: Use the trained second network to determine the detection result of the software under test based on global features.

[0074] Based on the same inventive concept Figure 6 A structural block diagram of a software detection device provided in an embodiment of this application is shown below. Figure 6 As shown, the software testing device 600 may include: The first image generation unit 601 is used to generate a first image corresponding to the software under test based on the binary file of the software under test; The global feature extraction unit 602 is used to extract global features of the first image using a trained first network; the first network is trained based on multiple existing second images. The detection result determination unit 603 is used to determine the detection result of the software under test based on the global features using a trained second network; the second network is trained based on multiple second images and a third image corresponding to each second image; each third image is generated by the third network based on the corresponding second image; at least one parameter of the third network is determined based on the parameters of the trained first network.

[0075] In one possible implementation, the first image generation unit 601 is specifically used to acquire the original byte sequence of the binary file of the software under test; Repeat the following steps until the number of unprocessed bytes is less than the first number: A pixel is generated based on three consecutive unprocessed bytes in the order of the original byte sequence; the pixel value of the pixel is determined by the values ​​of the three consecutive unprocessed bytes. The three unprocessed bytes used to generate the pixel are marked as processed bytes; The generated pixels are arranged according to a preset width and height to generate the first image.

[0076] In one possible implementation, the first image generation unit 601 is further configured to determine a target quantity based on the number of unprocessed bytes and the first quantity if the original byte sequence contains unprocessed bytes; A pixel is generated based on the unprocessed bytes and the preset pixel value of the target number.

[0077] In one possible implementation, the global feature extraction unit 602 is specifically used to train the first network in the following manner: The target second image is segmented into multiple target image blocks; the target second image is any one of the multiple existing second images. A second number of target image blocks are selected from the plurality of target image blocks as undetermined image blocks, and the pixel value of each pixel point contained in each undetermined image block is set from the initial value to the target value; Each target image block and the undetermined image block corresponding to the target second image are input into the first network to obtain the feature representation output by the first network for each target image block; Based on the feature representation, predict the pixel value of each pixel in each of the target image blocks to be determined, and obtain the predicted value of each pixel in each target image block to be determined; The parameters of the first network are adjusted based on the difference between the predicted value and the initial value of each pixel contained in each of the target image blocks to be determined.

[0078] In one possible implementation, the global feature extraction unit 602 is specifically used to determine the mean square error between the predicted value and the initial value for each of the second number of undetermined image blocks, thereby obtaining a second number of loss values. The parameters of the first network are adjusted based on the sum of the second number of loss values.

[0079] In one possible implementation, the detection result determination unit 603 is further configured to train the second network by: inputting multiple second images and multiple third images into the second network, adjusting the parameters of the second network until the loss function reaches a preset target, wherein the loss function is a weighted sum of a first loss, a second loss, and a third loss; the first loss is used to characterize the difference in visual distribution between the image generated by the third network and the real image; the second loss is used to characterize the difference between each third image and the corresponding second image; and the third loss is used to characterize the difference between the detection result of the second network for each second image and each third image and the actual result.

[0080] In one possible implementation, the detection result determination unit 603 is specifically configured to generate the plurality of third images in the following manner: Multiple second images are input into the third network to obtain multiple synthesized second images; If any synthesized second image is detected by the fourth network and determined to be the real image, then the synthesized second image is input into the third network to obtain the third image; the fourth network is used to detect whether the synthesized second image is a real image in terms of visual distribution.

[0081] Based on the same inventive concept, embodiments of this application provide an electronic device that can implement the functions of the software detection method described above. Please refer to... Figure 7 The electronic device 700 includes a memory 701, a processor 702, and a bus 703. The memory 701 stores computer programs executed by the processor 702. The memory 701 may mainly include a program storage area and a data storage area. The program storage area may store the operating system and programs required for running instant messaging functions; the data storage area may store various instant messaging information and operation instruction sets.

[0082] Memory 701 may be volatile memory, such as random-access memory (RAM); memory 701 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 701 may be any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 701 may be a combination of the above-mentioned memories.

[0083] The processor 702 may include one or more central processing units (CPUs) or digital processing units, etc. The processor 702 is used to implement the software detection method in the above embodiments when it calls the computer program stored in the memory 701.

[0084] This application embodiment does not limit the specific connection medium between the memory 701 and the processor 702 described above. This application embodiment... Figure 7 The memory 701 and the processor 702 are connected via a bus 703, and the bus 703 is in Figure 7 The connections between other components are shown in bold lines only and are not intended to be limiting. The 703 bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 7 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0085] It should be noted that the electronic device 700 provided in this application embodiment can implement all the method steps implemented in the above method embodiment and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0086] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium. The computer program product includes computer program code, which, when executed on a computer, causes the computer to perform any of the software detection methods discussed above. Since the principle by which the above-described computer-readable storage medium solves the problem is similar to that of the software detection method, the implementation of the above-described computer-readable storage medium can be referred to the implementation of the method; repeated details will not be elaborated further.

[0087] Based on the same inventive concept, this application provides a computer program product comprising computer program code. When the computer program code is run on a computer, it causes the computer to implement the aforementioned software detection method. Since the principle by which the above-described computer program product solves the problem is similar to that of the software detection method, the implementation of the above-described computer program product can be referred to the implementation of the method, and repeated details will not be elaborated further.

[0088] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0089] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0090] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0091] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0092] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A software detection method, characterized in that, The method includes: Generate a first image corresponding to the software under test based on the binary file of the software under test; The global features of the first image are extracted using a trained first network; the first network is trained based on multiple existing second images. The detection result of the software under test is determined using a trained second network based on the global features; the second network is trained based on multiple second images and a third image corresponding to each second image; each third image is generated by the third network based on the corresponding second image; at least one parameter of the third network is determined based on the parameters of the trained first network.

2. The method according to claim 1, characterized in that, The process of generating the first image corresponding to the software under test based on the binary file of the software under test includes: Obtain the original byte sequence of the binary file of the software under test; Repeat the following steps until the number of unprocessed bytes is less than the first number: A pixel is generated based on three consecutive unprocessed bytes in the order of the original byte sequence; the pixel value of the pixel is determined by the values ​​of the three consecutive unprocessed bytes. The three unprocessed bytes used to generate the pixel are marked as processed bytes; The generated pixels are arranged according to a preset width and height to generate the first image.

3. The method according to claim 2, characterized in that, Before arranging each generated pixel according to a preset width and height, the method further includes: If the original byte sequence contains unprocessed bytes, the target quantity is determined based on the number of unprocessed bytes and the first quantity. A pixel is generated based on the unprocessed bytes and the preset pixel value of the target number.

4. The method according to claim 1, characterized in that, The first network is trained in the following manner: The target second image is segmented into multiple target image blocks; the target second image is any one of the multiple existing second images. A second number of target image blocks are selected from the plurality of target image blocks as undetermined image blocks, and the pixel value of each pixel point contained in each undetermined image block is set from the initial value to the target value; Each target image block and the undetermined image block corresponding to the target second image are input into the first network to obtain the feature representation output by the first network for each target image block; Based on the feature representation, predict the pixel value of each pixel in each of the target image blocks to be determined, and obtain the predicted value of each pixel in each target image block to be determined; The parameters of the first network are adjusted based on the difference between the predicted value and the initial value of each pixel contained in each of the target image blocks to be determined.

5. The method according to claim 4, characterized in that, The step of adjusting the parameters of the first network based on the difference between the predicted value and the initial value of each pixel in each of the target image blocks to be determined includes: For each of the undetermined image blocks in the second number of undetermined image blocks, the mean square error between the predicted value and the initial value is determined to obtain the second number of loss values; The parameters of the first network are adjusted based on the sum of the second number of loss values.

6. The method according to claim 1, characterized in that, The second network is trained in the following way: Multiple second images and multiple third images are input into the second network, and the parameters of the second network are adjusted until the loss function reaches a preset target. The loss function is a weighted sum of a first loss, a second loss, and a third loss. The first loss is used to characterize the difference in visual distribution between the image generated by the third network and the real image. The second loss is used to characterize the difference between each third image and the corresponding second image. The third loss is used to characterize the difference between the detection result of the second network for each second image and each third image and the actual result.

7. The method according to claim 6, characterized in that, The plurality of third images are generated in the following manner: Multiple second images are input into the third network to obtain multiple synthesized second images; If any synthesized second image is detected by the fourth network and determined to be the real image, then the synthesized second image is input into the third network to obtain the third image; the fourth network is used to detect whether the synthesized second image is a real image in terms of visual distribution.

8. A software testing device, characterized in that, The device includes: The first image generation unit is used to generate a first image corresponding to the software under test based on the binary file of the software under test; A global feature extraction unit is used to extract global features of the first image using a trained first network; the first network is trained based on multiple existing second images. The detection result determination unit is used to determine the detection result of the software under test based on the global features using a trained second network; the second network is trained based on multiple second images and a third image corresponding to each second image; each third image is generated by the third network based on the corresponding second image; at least one parameter of the third network is determined based on the parameters of the trained first network.

9. An electronic device, characterized in that, include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method according to any one of claims 1-7.

10. A computer-readable storage medium storing a computer program therein, characterized in that: When the computer program is executed by a processor, it implements the method of any one of claims 1-7.

Images