Malware detectionmethod based on hybrid deep learning model

Abstract

The present invention relates to a method for detecting malware based on a hybrid deep learning model, and more specifically, to a method for detecting malware based on a hybrid deep learning model that applies deep learning to network malware detection, combining Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM). To this end, the present invention is characterized by comprising: a data cleaning step for removing invalid data and null values ​​from a network anomaly detection dataset; a feature processing step for converting the cleaned raw data into a format suitable for analysis and encoding string features into numerical representations; a feature selection step for identifying highly relevant features from the processed data and performing correlation analysis and feature removal to improve the performance of the model; and a deep learning step for detecting malware using a hybrid deep learning model that combines a CNN and an LSTM model.

Description

Technology Field

[0001] The present invention relates to a method for detecting malware based on a hybrid deep learning model, and more specifically, to a method for detecting malware based on a hybrid deep learning model that applies deep learning to network malware detection, combining Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM). Background Technology

[0002] Due to the widespread use of smart devices, particularly in e-commerce, entertainment, and other fields, new communication modes and traffic types are continuously developing and evolving.

[0003] While this convenient method of communication has brought many benefits, it has also indirectly contributed to the increase in cybercrime.

[0004] Therefore, service providers must adopt more in-depth and comprehensive defense strategies to address increasing security threats.

[0005] In other words, to enhance network security, service providers must configure Intrusion Detection Systems (IDS) capable of identifying malicious activity on the network, in addition to implementing basic authentication, authorization, and access control (e.g., using firewalls).

[0006] However, as malware technology continues to advance, it is becoming increasingly easier for attackers to bypass existing intrusion detection systems, and advanced intrusion techniques such as polymorphic malware and zero-day exploits are posing a greater challenge to the efficiency of existing IDS systems.

[0007] Therefore, it is urgent to improve the design of intrusion detection systems to effectively resist abnormal behavior in increasingly complex networks.

[0008] However, there are many difficulties in designing an efficient anomaly-based intrusion detection system.

[0009] The biggest reason is that the ratio of normal traffic to malicious traffic within a network differs, and attackers generally try to conceal malicious traffic to make it appear like normal traffic.

[0010] In addition, as application requirements (e.g., augmented reality / virtual reality, online games, etc.) continuously change, the false alarm rate of detection systems increases significantly.

[0011] Recent research emphasizes that balancing false negatives and false positives in IDS is important for maintaining network stability and user experience.

[0012] Therefore, before developing an intrusion detection model, features must be carefully selected to ensure the reliability of the system. Prior art literature

[0013] Registered Patent Publication No. 10-2046789 (2019.11.14.) Published Patent Publication No. 10-2024-0124354 (2024.08.16.) The problem to be solved

[0014] The present invention was devised to solve the above-mentioned problems, and aims to provide a malware detection method based on a hybrid deep learning model that facilitates the detection of malware while ensuring the reliability of the system.

[0015] And the purpose is to provide a malware detection method based on a hybrid deep learning model that applies deep learning when detecting malicious network behavior.

[0017] In addition, other objects and advantages of the present invention will be described below, and it should be noted that they will be encompassed to a broader extent by means and combinations within the scope that can be easily derived from the matters described in the claims of the present invention and the disclosure of the embodiments thereof. means of solving the problem

[0018] The present invention for achieving the above objective is characterized by comprising: a data cleaning step for removing invalid data and null values ​​from a network anomaly detection dataset; a feature processing step for converting the cleaned raw data into a format suitable for analysis and encoding string features into numerical representations; a feature selection step for identifying highly relevant features from the processed data and improving the performance of the model by performing correlation analysis and feature removal; and a deep learning step for detecting malware using a hybrid deep learning model that combines a Convolutional Neural Network (CNN) and a Long Short-Term Memory (LSTM) model.

[0019] And according to a preferred embodiment of the present invention, the feature processing step is characterized by traffic features, basic features, contents features, time features, and additional features in the dataset where the raw data is stored.

[0020] In addition, according to a preferred embodiment of the present invention, the feature selection step is characterized by performing a comprehensive correlation analysis to evaluate the relationship between variables within the dataset using a correlation matrix to quantitatively measure linear dependencies between the features.

[0021] And according to a preferred embodiment of the present invention, the CNN model includes a convolution layer and a pooling layer for generating a feature map, wherein data that has undergone the feature selection step is first input to the convolution layer, and the pooling layer combines features identified in the convolution layer to reduce the dimension of the feature map.

[0022] In addition, according to a preferred embodiment of the present invention, the LSTM model utilizes a hyperbolic tangent function and is characterized by managing the flow of data using an input gate, a forget gate, and an output gate that control the connection between the input and the memory. Effects of the invention

[0023] As described above, according to the present invention, the following effects can be expected.

[0024] It has the effect of ensuring system reliability while facilitating the detection of malware.

[0025] In other words, by applying deep learning to malware detection, and by applying a hybrid deep learning model that combines CNN and LSTM, the accuracy and efficiency of intrusion detection are improved.

[0026] Through a CNN model capable of powerful feature extraction and the recognition of complex patterns, high-level features can be automatically extracted from network traffic data during network malicious activity detection, thereby increasing the accuracy of malicious activity identification.

[0027] And by additionally capturing time-series patterns of the data through the LSTM model, this combination can be more effective in complex and dynamic network environments.

[0029] In addition, it should be noted that other effects of the present invention will be encompassed to a broader extent by the embodiments described above and the matters described in the claims of the present invention, as well as by effects that can be easily derived from them and potential advantages that contribute to industrial development. Brief explanation of the drawing

[0030] FIG. 1 is a diagram briefly illustrating the data flow in a malware detection method based on a hybrid deep learning model according to the present invention. FIG. 2 is a diagram illustrating a malware detection method based on a hybrid deep learning model according to the present invention. Specific details for implementing the invention

[0031] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the attached drawings. Prior to the description, the advantages and features of the present invention and the methods for achieving them will become clear by referring to the embodiments described below in detail together with the attached drawings. Furthermore, it should be noted that the terms used in this specification are for describing the embodiments and are not intended to limit the present invention; that singular forms of such terms include plural forms unless specifically stated otherwise in the text, and that words indicating direction in the description are intended to aid in understanding the description and may change depending on the context.

[0033] A method for detecting malware based on a hybrid deep learning model according to a preferred embodiment of the present invention will be described in detail below with reference to the attached drawings. FIG. 1 is a diagram briefly showing the data flow in a method for detecting malware based on a hybrid deep learning model according to the present invention, and FIG. 2 is a diagram showing a method for detecting malware based on a hybrid deep learning model according to the present invention.

[0034] Referring to the drawings, the malware detection method based on a hybrid deep learning model according to the present invention first performs a data cleaning step (S1).

[0035] The data cleanup step removes invalid data and null values ​​from the network anomaly detection dataset (dataset; 10).

[0036] Here, the dataset (10) according to the present invention is a state-of-the-art network anomaly detection dataset, and since network traffic contains various types and a lot of noise, it is important to remove the noise, and the hybrid deep learning model according to the present invention can solve this problem.

[0037] The dataset (10) used in the present invention contains approximately 4.89 million samples, and invalid data and null values ​​are filtered out to ensure the accuracy and reliability of the data.

[0039] Next, the feature processing step is performed (S3).

[0040] The feature processing step converts the raw data organized in the aforementioned S1 step into a format suitable for analysis in the dataset (20) and encodes string features into numerical representations.

[0041] In the present invention, 42 features of different classification angles, such as traffic features, basic features, contents features, time features, and additional features, are collected from the dataset (20).

[0042] These features are inherent in various types of qualitative and quantitative data, including 38 integer features and 4 string features.

[0043] In this step, character data is encoded and mapped into a numeric format.

[0044] For example, the 'duration' column contains three categories, and to facilitate subsequent calculations, they are mapped to three digital types: 0, 1, and 2.

[0046] Next, the feature selection step is performed (S5).

[0047] The feature selection step can improve the performance of the model by identifying highly relevant features from the data processed in the aforementioned S3 step and performing correlation analysis and feature removal.

[0048] This step involves performing a comprehensive correlation analysis to evaluate the relationships between variables within the dataset (20), using a correlation matrix to quantitatively measure linear dependencies between features.

[0049] Through such correlation matrices, many variables exhibit high correlations and a high degree of redundancy, which allows for the transmission of redundant information regarding the features of the dataset.

[0050] At the same time, other features may show weak or negligible correlations, providing unique and independent information that can improve the model's predictive ability.

[0051] To mitigate the potential effects of multicollinearity, one variable can be removed from each pair of highly correlated features during feature selection, which can improve the model's generalization ability by effectively reducing redundancy and minimizing the risk of overfitting.

[0052] In addition, while simple feature removal based on domain knowledge or statistical thresholds was prioritized in this stage, redundancy can also be further addressed using advanced techniques such as PCA (Principal Component Analysis) or hierarchical clustering.

[0053] By performing such thorough correlation analysis and applying appropriate feature selection, this step can achieve an optimal balance between data complexity and model accuracy, ultimately enabling the development of a more robust and efficient predictive model.

[0054] After analysis, to reduce the potential impact of multicollinearity on the model, more representative or beneficial features can be retained for each pair of highly correlated variables, and other features can be removed to improve the model's generalization ability and reduce the risk of overfitting.

[0056] Next, the deep learning step is performed (S7).

[0057] The deep learning stage detects malware using a hybrid deep learning model (30) that combines a CNN (Convolutional Neural Networks) and an LSTM (Long Short-Term Memory) model.

[0058] First, the CNN model includes convolution layers and pooling layers to generate feature maps.

[0059] CNN models not only reduce the dimensionality of features but also generate new maps based on the original features, effectively helping to maintain a smaller number of parameters.

[0060] The data that has passed through the aforementioned S5 step is first input into the convolution layer, and the kernel filter is used to generate a feature map.

[0061] The number of output features is defined by the following formula.

[0062]

[0063] Here, f in is the number of input features, k is the kernel size, p is the padding size, and s is the stride.

[0064] The feature map is processed using the ReLU activation function f(x)=max(0,x) to reduce overfitting and is passed to the pooling layer.

[0065] Convolutional layers improve model efficiency by reducing data dimensions and identifying key features.

[0066] The pooling layer of these CNN models combines features identified in the convolution layer to reduce the dimensionality of the feature map and prevents overfitting.

[0067] As such, since CNN models can perform powerful feature extraction and recognize complex patterns, they can automatically extract high-level features from network traffic data in malicious behavior detection, as in the present invention, thereby increasing the accuracy of identifying malicious behavior.

[0069] And the LSTM model is a type of recurrent neural network designed to process sequence data and solve long-term dependency issues. Unlike conventional RNNs, it incorporates memory cells and gating mechanisms to improve the ability to capture long-term dependencies.

[0070] Memory cells store and transmit data, functioning like a conveyor belt that can add, delete, or transfer data at different time steps, thereby preventing data from decaying over time.

[0071] The gating mechanism manages the flow of data by using an input gate, a forget gate, and an output gate that control the connection between the input and memory, utilizing the hyperbolic tangent function of the LSTM.

[0078] The foregoing description is merely an illustrative explanation of the technical concept of the present invention, and those skilled in the art to which the present invention pertains will be able to make various modifications, changes, and substitutions within the scope of the essential characteristics of the present invention. Furthermore, as described above, the embodiments disclosed in the present invention and the accompanying drawings are intended to explain, not limit, the technical concept of the present invention, and the scope of the technical concept of the present invention is not limited by such embodiments and accompanying drawings. The scope of protection of the present invention shall be interpreted by the claims below, and all technical concepts within an equivalent scope shall be interpreted as being included within the scope of rights of the present invention. Explanation of the symbols

[0079] 10, 20; dataset 30; Hybrid deep learning model

Claims

Claim 1 A method for detecting malware based on a hybrid deep learning model, characterized by comprising: a data cleaning step for removing invalid data and null values ​​from a network anomaly detection dataset; a feature processing step for converting the cleaned raw data into a format suitable for analysis and encoding string features into numerical representations; a feature selection step for identifying highly relevant features from the processed data and improving the performance of the model by performing correlation analysis and feature removal; and a deep learning step for detecting malware using a hybrid deep learning model that combines a Convolutional Neural Network (CNN) and a Long Short-Term Memory (LSTM) model. Claim 2 A hybrid deep learning model-based malware detection method according to claim 1, wherein the feature processing step is characterized by collecting features including traffic features, basic features, contents features, time features, and additional features from a dataset in which the raw data is stored. Claim 3 A hybrid deep learning model-based malware detection method according to claim 1, wherein the feature selection step is characterized by performing a comprehensive correlation analysis to evaluate the relationship between variables within the dataset using a correlation matrix to quantitatively measure linear dependencies between the features. Claim 4 A method for detecting malware based on a hybrid deep learning model according to claim 1, wherein the CNN model includes a convolution layer and a pooling layer for generating a feature map, data that has undergone the feature selection step is first input into the convolution layer, and the pooling layer combines features identified in the convolution layer to reduce the dimension of the feature map. Claim 5 A method for detecting malware based on a hybrid deep learning model according to claim 1, wherein the LSTM model utilizes a hyperbolic tangent function and manages the flow of data using an input gate, a forget gate, and an output gate that regulate the connection between the input and memory.

Images