Deep-learning-based method for dynamic analysis and detection of cyberspace malicious code
Patent Information
- Application Number
- PCT/CN2025/120262
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2025-09-10
- Publication Date
- 2026-08-27
Smart Images
Figure CN2025120262_27082026_PF_FP_ABST
Abstract
Description
A Deep Learning-Based Dynamic Analysis and Detection Method for Cybersecurity Malicious Code Technical Field
[0001] This invention belongs to the field of computer network security technology, and in particular relates to a method for dynamic analysis and detection of malicious code in cyberspace based on deep learning. Background Technology
[0002] With the widespread adoption of the internet and the acceleration of digital transformation, malicious code attacks have become one of the most serious threats in cyberspace. These attacks not only disrupt system functions but also steal sensitive data and can even cause large-scale network outages. The complexity and diversity of malicious code make its detection and defense a key issue in the field of cybersecurity, urgently requiring innovative technologies to address the ever-evolving threats.
[0003] Existing malware detection methods often fall short when facing new types of attacks. Many traditional solutions rely on static analysis or single-dimensional behavioral monitoring, which struggles to cope with the dynamic changes and complex camouflage of malware. Particularly in multi-dimensional behavioral capture, existing technologies often fail to effectively integrate various runtime behaviors of code, such as insufficient correlation between behavioral sequences, network traffic, and memory changes. This results in a significant decrease in the accuracy and robustness of detection systems when facing well-designed adversarial attacks or rapidly evolving malware.
[0004] Malicious code generates various behavioral traces during execution, such as file operations, network communications, and memory modifications. However, these traces are often scattered and varied in format, making them difficult to model uniformly. Existing methods typically lack effective fusion mechanisms when processing this heterogeneous data, resulting in the feature extraction process failing to fully uncover the deep connections between behaviors. This deficiency in feature extraction further presents another technical challenge: how to maintain the adaptability of the detection model in dynamic environments. Malicious code mutates extremely rapidly, and attackers often use adversarial techniques to interfere with detection systems, such as injecting noise or forging behavioral patterns to evade detection. This makes it difficult for models to maintain stable performance when facing unknown variants or adversarial examples. Especially on edge devices, where computing resources are limited, detection systems need to find a balance between lightweight design and high accuracy, which existing methods often struggle to achieve simultaneously.
[0005] Therefore, how to efficiently extract high-dimensional correlation features from multi-dimensional and heterogeneous behavioral data, and build a detection system that can continuously adapt to new variants and adversarial examples in a dynamic environment, has become a key issue in the field of cybersecurity. Summary of the Invention
[0006] To address the aforementioned technical problems, this invention proposes a method for dynamic analysis and detection of cyberspace malicious code based on deep learning, thereby resolving the issues present in the existing technologies.
[0007] To achieve the above objectives, this invention provides a method for dynamic analysis and detection of cyberspace malware based on deep learning, comprising:
[0008] The system acquires multidimensional behavioral traces during malicious code execution, constructs a multi-source behavioral dataset, and preprocesses it to obtain a normalized behavioral matrix. The multidimensional behavioral traces include file operation data, network communication data, and memory modification data.
[0009] Based on the normalized behavior matrix, a local correlation pattern between file operations and network communication is obtained, and a high-dimensional feature vector is obtained based on the local correlation pattern.
[0010] Based on the high-dimensional feature vector, the temporal dependency relationship between memory modification and the local association pattern is obtained, and the fused association feature embedding is obtained based on the temporal dependency relationship;
[0011] Noise analysis is performed on the fused associated feature embeddings. The fused associated feature embeddings are then processed based on the noise analysis results. Finally, a robust feature set adapted to the new variant is obtained based on the processed associated feature embeddings.
[0012] A lightweight classifier is deployed on edge devices based on a robust feature set that adapts to new variants, and the classification labels of potential adversarial examples are obtained by analyzing the feature set.
[0013] If the label indicates malicious behavior, then updated samples are extracted from the robust feature set adapted to new variants and injected into the recurrent neural network to obtain an optimized detection model under limited computing resources, thereby realizing dynamic analysis and detection of malicious code in cyberspace.
[0014] Optionally, the process of obtaining multi-dimensional behavioral traces during malicious code execution and constructing a multi-source behavioral dataset includes:
[0015] By dynamically monitoring and capturing multidimensional behavioral traces during the execution of malicious code, a heterogeneous data set is obtained. Behavioral sequences are extracted from the heterogeneous data set, and time series analysis tools are used to integrate the timestamp information of the data in the heterogeneous data set to obtain a multi-source behavioral dataset.
[0016] Optionally, the process of preprocessing the multi-source behavior dataset to obtain a normalized behavior matrix includes:
[0017] The multi-source behavioral dataset is integrated to obtain a unified heterogeneous data set. If the data formats of the unified heterogeneous data set are inconsistent, a standardized data set is generated through format unification processing. Principal component analysis is used to reduce the dimensionality of the standardized data set to obtain dimensionality-reduced behavioral feature data. Cluster analysis algorithm is used to group the dimensionality-reduced behavioral feature data. If the Euclidean distance between features is less than a preset threshold, they are classified into the same behavioral category to obtain the behavioral classification result. Based on the behavioral classification result, a behavioral pattern matrix is constructed, and the classification result is mapped to a normalized behavioral matrix through a matrix generation process.
[0018] Optionally, the process of obtaining high-dimensional feature vectors includes:
[0019] File operation frequency data and network communication traffic data are obtained from the normalized behavior matrix. A convolutional neural network is used to extract the local correlation pattern between the file operation frequency and the network communication traffic to obtain a preliminary high-dimensional feature vector. Principal component analysis algorithm is used to reduce the dimensionality of the preliminary high-dimensional feature vector. If the variance contribution rate of the preliminary high-dimensional feature vector is greater than a preset threshold, the corresponding principal component is retained to obtain the dimensionality-reduced high-dimensional feature vector.
[0020] Optionally, the process of obtaining the temporal dependency relationship between memory modification and the local association pattern based on the high-dimensional feature vector, and obtaining the fused association feature embedding based on the temporal dependency relationship, includes:
[0021] Based on the high-dimensional feature vectors, a long short-term memory network is used to process the time-series data of memory modification operations, extract temporal dependency characteristics, and generate temporal feature embeddings. Based on the temporal feature embeddings, a clustering algorithm is used to group dynamic behavior patterns to obtain behavior pattern classifications. Operation frequency distribution data is obtained from the behavior pattern classifications. If the variance of the operation frequency distribution is greater than a preset threshold, the pattern classification with high variance is retained to obtain selected behavior patterns. According to the selected behavior patterns, the temporal evolution law in the local association patterns is extracted to obtain dynamic association features. Based on the dynamic association features, an embedding vector generation algorithm is used to obtain the fused association feature embeddings.
[0022] Optionally, the process of obtaining a robust feature set adapted to new variants includes:
[0023] The distribution characteristics of dynamic environmental noise are obtained from the fused associated feature embeddings. Statistical analysis is used to determine the significance level of noise interference, resulting in a noise distribution description. If the significance level of the noise distribution description exceeds a preset threshold, the embedding parameters are adjusted through an adversarial training mechanism to generate an optimized embedding parameter set. Based on the optimized embedding parameter set, the associated feature embeddings are regenerated. A clustering algorithm is used to group the associated feature embeddings, resulting in grouped feature patterns. From the grouped feature patterns, the temporal variation characteristics of variant patterns are extracted, and a long short-term memory network is used to process these temporal variation characteristics, generating variant pattern descriptions. If the dynamic variation amplitude of the variant pattern description exceeds a preset threshold, the associated feature embeddings are optimized through an embedding vector update algorithm to obtain an updated associated feature embedding set. Robustness is then assessed to determine a robust feature set adapted to the new variant.
[0024] Optionally, a lightweight classifier is deployed on edge devices based on a robust feature set adapted to novel variants. The process of analyzing the feature set to obtain classification labels for potential adversarial examples includes:
[0025] A feature extraction algorithm is used to process the robust feature set adapted to the new variants, obtaining an initial feature vector set. Based on the initial feature vector set, principal component analysis is used to reduce the dimensionality, resulting in a compressed feature vector set. If the dimensionality of the compressed feature vector set meets a preset threshold, a lightweight classifier is deployed on an edge device to generate a deployed classification model. Based on the deployed classification model, the compressed feature vector set is compared in real time to obtain preliminary classification labels for potential adversarial examples. From the preliminary classification labels, the label confidence distribution is obtained, and statistical analysis is used to determine whether the confidence level meets a preset threshold, thus determining reliable classification labels. If the confidence level of reliable classification labels is lower than the preset threshold, the classification model is optimized using a gradient boosting algorithm to obtain an updated classification model. Based on the updated classification model, the compressed feature vector set is re-compared to generate the final classification labels for potential adversarial examples.
[0026] Optionally, the process of obtaining an optimized detection model under computationally limited conditions includes:
[0027] The system obtains a set of labels indicating malicious behavior from the classification labels of potential adversarial examples. A filtering method is used to separate the feature subsets corresponding to the malicious labels, resulting in a malicious feature set. A feature selection algorithm is then used to filter the malicious feature set, generating a simplified feature set. If the dimensionality of the simplified feature set meets a preset threshold, it is injected into a recurrent neural network for training, resulting in an initial detection model. Based on the initial detection model, cross-validation is used to evaluate the model's performance in a resource-constrained environment, generating performance evaluation results. If the performance evaluation results do not meet the preset threshold, the parameters of the recurrent neural network are adjusted using a gradient descent algorithm to obtain an optimized detection model. Based on the optimized detection model, the input feature data stream is processed in real time to generate behavior detection labels.
[0028] The present invention provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method.
[0029] The present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.
[0030] Compared with the prior art, the present invention has the following advantages and technical effects:
[0031] This invention extracts initial behavior sequences from heterogeneous data and standardizes them into a normalized behavior matrix. Then, it utilizes a convolutional neural network to mine local correlation patterns between file operations and network communication, generating high-dimensional feature vectors. Finally, a recurrent neural network captures the temporal dependencies of memory modifications, forming a fused correlation feature embedding. To cope with dynamic environmental noise interference, this invention employs an adversarial training mechanism to optimize embedding parameters, extracts robust feature sets adapted to new variants, and deploys a lightweight classifier on edge devices for real-time detection. If malicious behavior is detected, updated samples are extracted from the robust feature set and injected into the recurrent neural network to optimize the model. Through multi-source behavior data integration, deep learning feature mining, adversarial training optimization, and edge deployment iteration, this invention comprehensively improves the comprehensiveness, robustness, and real-time performance of detecting malicious code variants in cyberspace under resource-constrained environments. Attached Figure Description
[0032] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:
[0033] Figure 1 is a flowchart of the method according to an embodiment of the present invention. Detailed Implementation
[0034] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.
[0035] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.
[0036] Example 1
[0037] As shown in Figure 1, this embodiment provides a method for dynamic analysis and detection of cyberspace malware based on deep learning, including:
[0038] The system acquires multidimensional behavioral traces during malicious code execution, constructs a multi-source behavioral dataset, and preprocesses it to obtain a normalized behavioral matrix. The multidimensional behavioral traces include file operation data, network communication data, and memory modification data.
[0039] As a specific implementation method, the process of obtaining multi-dimensional behavioral traces during malicious code execution and constructing a multi-source behavioral dataset includes:
[0040] By dynamically monitoring and capturing multidimensional behavioral traces during the execution of malicious code, a heterogeneous data set is obtained. Behavioral sequences are extracted from the heterogeneous data set, and time series analysis tools are used to integrate the timestamp information of the data in the heterogeneous data set to obtain a multi-source behavioral dataset.
[0041] Dynamic monitoring captures file operations, network communications, and memory data modifications during malicious code execution, requiring the acquisition of heterogeneous data sets through a real-time monitoring system.
[0042] Specifically, for malicious code detection, a sandbox environment can be deployed to simulate real system operation and capture code behavior. File operation monitoring can record process read, write, and delete operations on files using hook functions. Network communication monitoring uses packet capture tools to capture data packets and record the timestamps and data volumes of encrypted requests sent externally by malicious code. Memory modification monitoring uses memory snapshot technology to detect illegal writes to critical memory areas by processes. This multi-dimensional monitoring can comprehensively capture malicious code behavior, generating heterogeneous data sets including files, networks, and memory, which helps in subsequent analysis of the complete behavioral chain.
[0043] Extracting behavioral sequences from heterogeneous datasets requires integrating timestamp information from file operations, network communications, and memory modifications to form a multi-source behavioral dataset.
[0044] Specifically, time series analysis tools, such as time-axis-based log aggregation technology, can be used to arrange the above timestamp data in chronological order, forming a behavioral sequence: 10:28:05 file modification → 10:28:06 memory write → 10:28:07 network request. This serialization process can clearly show the behavioral path of malicious code and reveal its potential intent, such as data theft or remote control.
[0045] This data can be stored using time-series databases, supporting efficient querying and visualization. For example, the behavioral sequence of a piece of malware can show that it first modifies system files to gain privileges, then writes malicious modules into memory, and finally sends them over the network to steal data. This kind of sequence analysis helps identify attack patterns and improves detection accuracy.
[0046] The integrated multi-source behavioral dataset can be used to train machine learning models, identify characteristic patterns of malicious code, such as frequent file modifications combined with abnormal network traffic, and significantly improve the detection system's ability to respond to unknown threats. Through multi-source data integration and time-series analysis, the complete behavioral chain of malicious code can be effectively reconstructed.
[0047] For example, the behavioral sequence of a ransomware program shows that it first encrypts files, then modifies memory to reside on the system, and finally sends a key to a C2 server over the network. Such analysis can provide accurate threat intelligence for defense systems. Compared to analysis from a single data source, multi-source behavioral datasets can support the inference of attack intent from multiple perspectives, significantly improving detection efficiency and tracing capabilities, reducing false negative rates, and providing more reliable technical support for network security protection.
[0048] As a specific implementation method, the process of preprocessing the multi-source behavior dataset to obtain a normalized behavior matrix includes:
[0049] The multi-source behavioral dataset is integrated to obtain a unified heterogeneous data set. If the data formats of the unified heterogeneous data set are inconsistent, a standardized data set is generated through format unification processing. Principal component analysis is used to reduce the dimensionality of the standardized data set to obtain dimensionality-reduced behavioral feature data. Cluster analysis algorithm is used to group the dimensionality-reduced behavioral feature data. If the Euclidean distance between features is less than a preset threshold, they are classified into the same behavioral category to obtain the behavioral classification result. Based on the behavioral classification result, a behavioral pattern matrix is constructed, and the classification result is mapped to a normalized behavioral matrix through a matrix generation process.
[0050] To integrate data sources and generate a unified heterogeneous dataset, data fusion techniques can be employed. Specifically, file operation log formats, network communication data packets, and memory modification binary records are integrated into a unified data storage structure. Assuming file operation logs are in JSON format, network communication data in PCAP format, and memory modification data in binary logs, these data can be converted into a unified CSV format using parsing tools, including fields such as timestamps, operation types, and operation objects. This integration facilitates subsequent processing while preserving the original characteristics of the heterogeneous data.
[0051] If data formats are inconsistent during data preprocessing, a standardized dataset can be generated through format unification processing.
[0052] For example, a file operation timestamp might be "2025-08-14 10:29:00", while a network communication timestamp might be in Unix timestamp format 1660234140. Both need to be converted to a unified ISO8601 format, such as "2025-08-14T10:29:00Z". Furthermore, if missing values exist in the data, such as an incomplete address record for a memory modification, interpolation can be used to fill in the missing fields. The generation of standardized datasets ensures the accuracy and consistency of subsequent analysis.
[0053] When using principal component analysis to reduce the dimensionality of data, high-dimensional file operations, network communications, and memory modifications can be mapped to a low-dimensional space.
[0054] For example, file operations may include multiple features such as operation type, file path, and file size; network communication includes source IP, destination port, and data volume; and memory modifications include address and modified content. Principal component analysis (PCA) is used to extract the principal components that contribute most to behavioral changes, such as file operation frequency, network communication packet size, and memory modification frequency, generating dimensionality-reduced behavioral features. This method effectively reduces data dimensionality, facilitating subsequent classification.
[0055] When performing clustering analysis on dimensionality-reduced behavioral features, the K-means clustering algorithm can be used to determine the behavioral category based on Euclidean distance. If, in the dimensionality-reduced feature vector, the Euclidean distance of a group of behaviors is less than a preset threshold of 0.5, then they are classified into the same category.
[0056] For example, repeatedly creating temporary files and sending small data packets to the same IP address might be categorized as "data theft," while frequently modifying memory might be categorized as "memory injection." This classification clearly reflects the characteristics of different behaviors.
[0057] When constructing a behavior pattern matrix, the classification results can be mapped to a normalized behavior matrix.
[0058] For example, suppose the classification results include three types of behavior: data theft, memory injection, and file encryption. The feature vector of each behavior type is normalized and mapped to the range of 0 to 1, forming a matrix where rows represent behavior categories and columns represent feature values, such as file operation frequency of 0.8 and network communication volume of 0.3. This matrix intuitively displays the behavior patterns, facilitating subsequent analysis and visualization.
[0059] Based on the normalized behavior matrix, a local correlation pattern between file operations and network communication is obtained, and a high-dimensional feature vector is obtained based on the local correlation pattern.
[0060] As a specific implementation method, the process of obtaining high-dimensional feature vectors includes:
[0061] File operation frequency data and network communication traffic data are obtained from the normalized behavior matrix. A convolutional neural network is used to extract the local correlation pattern between the file operation frequency and the network communication traffic to obtain a preliminary high-dimensional feature vector. Principal component analysis algorithm is used to reduce the dimensionality of the preliminary high-dimensional feature vector. If the variance contribution rate of the preliminary high-dimensional feature vector is greater than a preset threshold, the corresponding principal component is retained to obtain the dimensionality-reduced high-dimensional feature vector.
[0062] Specifically, when extracting file operation frequency data and network communication traffic data from the normalized behavior matrix, specific dynamic features need to be extracted through time window analysis. Specifically, file operation frequency data reflects the number of times the system reads and writes files per unit time (e.g., per second), reflecting file access activity; network communication traffic data records the number of data packets sent and received per unit time (e.g., per second) (in bytes), reflecting network interaction intensity. Since the normalized behavior matrix has already standardized the dimensions of data from different sources (e.g., mapping file operation frequency and network traffic to the 0-1 range), it is necessary to decompose the matrix dimensionally to extract quantitative indicators for file operations and network communication respectively, forming a dataset in a unified time series format, laying the foundation for subsequent analysis.
[0063] When extracting local correlation patterns between file operations and network communication, convolutional neural networks are used for feature mining. First, file operation frequency and network communication traffic data are arranged in time series to form a two-dimensional input matrix. Then, a convolutional kernel (e.g., set to 3×3 size with a stride of 1) is designed to capture local patterns within short time windows by scanning the matrix. For example, in a server monitoring scenario, if the file operation frequency suddenly increases within a certain time period while network traffic peaks, the convolutional neural network can learn this synchronization pattern of "high-frequency file read / write and network traffic surge," generating a preliminary high-dimensional feature vector containing complex temporal correlation information. This vector can reflect the dynamic correlation pattern between file operations and network communication (such as behavioral characteristics during batch data uploads).
[0064] For the initial high-dimensional feature vector, dimensionality reduction is required using principal component analysis (PCA). The specific steps are as follows: calculate the covariance matrix of the feature vector to determine the variance contribution rate of each principal component (i.e., the explanatory power of a single principal component for data variation); set a variance contribution rate threshold (usually adjusted according to business needs, such as 90% for high-precision monitoring scenarios and 85% for regular scenarios), and retain principal components whose cumulative variance contribution rate exceeds the threshold. For example, if the initial high-dimensional feature vector contains 100 dimensions, and the cumulative variance contribution rate of the first 5 principal components reaches 85% (exceeding the preset threshold of 80%), then these 5 principal components are retained to generate the dimensionality-reduced high-dimensional feature vector.
[0065] The core value of dimensionality reduction lies in preserving the core correlation characteristics between file operations and network communication (such as patterns of large-scale file writing accompanied by abnormal network traffic within a short period) while reducing data redundancy and computational complexity. This process not only improves the efficiency and accuracy of subsequent analysis but also supports real-time monitoring needs. For example, during peak hours on enterprise servers, abnormal behavior can be quickly identified using the dimensionality-reduced feature vectors. High-frequency file operations and abnormal network traffic during off-peak hours at night may indicate data breaches or malware activity. Furthermore, the dimensionality-reduced feature vectors can be combined with time-series analysis to further uncover periodic changes in behavioral patterns, providing a basis for system security protection and resource optimization.
[0066] Based on the high-dimensional feature vector, the temporal dependency relationship between memory modification and the local association pattern is obtained, and the fused association feature embedding is obtained based on the temporal dependency relationship;
[0067] As one specific implementation method, the process includes:
[0068] Based on the high-dimensional feature vectors, a long short-term memory network is used to process the time-series data of memory modification operations, extract temporal dependency characteristics, and generate temporal feature embeddings. Based on the temporal feature embeddings, a clustering algorithm is used to group dynamic behavior patterns to obtain behavior pattern classifications. Operation frequency distribution data is obtained from the behavior pattern classifications. If the variance of the operation frequency distribution is greater than a preset threshold, the pattern classification with high variance is retained to obtain selected behavior patterns. According to the selected behavior patterns, the temporal evolution law in the local association patterns is extracted to obtain dynamic association features. Based on the dynamic association features, an embedding vector generation algorithm is used to obtain the fused association feature embeddings.
[0069] Specifically, LSTM, as a neural network suitable for processing time series data, can capture long-term dependencies. When processing time series data of memory modification operations, it is necessary to focus on its temporal characteristics: by monitoring the number of memory writes per second of a process to generate time series data (e.g., [10,15,12,20,8]), LSTM uses forget gates and input gates to analyze the temporal patterns in the data, extracting periodic changes or abnormal fluctuations in operation frequency, and finally generating temporal feature embeddings. This embedding vector can reflect the dynamic trend of memory operations; for example, high-frequency modifications in a short period of time may be related to a specific task.
[0070] For the generated temporal feature embeddings, K-means clustering algorithms are used to group dynamic behavior patterns. Assuming the embedding vectors contain memory modification patterns from multiple processes, they can be categorized into three types: high-frequency modifications, low-frequency modifications, and abnormal modifications. For example, process A's memory modification frequency is stable at 10 times / second, process B fluctuates between 20-30 times / second, and process C occasionally shows a peak of 100 times / second. K-means clustering groups these patterns based on vector distance, generating behavior pattern classifications to distinguish between normal operations and abnormal behavior.
[0071] Operation frequency distribution data is obtained from behavioral pattern classifications, and key patterns are filtered by examining variance. For example, if the variance of the operation frequency distribution for process A is 2.5, for process B it is 15.0, and for process C it is 50.0, and if a preset variance threshold of 10.0 is set, then the pattern classifications of processes B and C, whose variances are higher than the threshold, are retained, generating a selected set of behavioral patterns. This filtering ensures that patterns with significant dynamic changes are retained, accurately reflecting the key behaviors in system operation.
[0072] For selected behavioral patterns, the temporal evolution patterns in the correlation patterns are extracted, with a focus on analyzing the temporal correlation between memory modifications and network communication. For example, the high-frequency memory modifications of process B are synchronized with the frequency of network data packet transmission, manifested as an increase in network traffic within 0.5 seconds after the peak of memory modifications. By analyzing the event sequence within the time window, dynamic correlation features describing the causal relationship or temporal dependence between the two can be generated.
[0073] An embedding vector generation algorithm (such as an attention mechanism) is used to integrate dynamically related features. Weights are assigned to different features (e.g., memory modification frequency accounts for 0.6, network traffic peak accounts for 0.4), generating a fused related feature embedding vector. This vector combines the temporal characteristics of memory modification and network communication, and can more comprehensively describe the system's operating state.
[0074] Noise analysis is performed on the fused associated feature embeddings. The fused associated feature embeddings are then processed based on the noise analysis results. Finally, a robust feature set adapted to the new variant is obtained based on the processed associated feature embeddings.
[0075] As a specific implementation method, the process of obtaining a robust feature set adapted to new variants includes:
[0076] The distribution characteristics of dynamic environmental noise are obtained from the fused associated feature embeddings. Statistical analysis is used to determine the significance level of noise interference, resulting in a noise distribution description. If the significance level of the noise distribution description exceeds a preset threshold, the embedding parameters are adjusted through an adversarial training mechanism to generate an optimized embedding parameter set. Based on the optimized embedding parameter set, the associated feature embeddings are regenerated. A clustering algorithm is used to group the associated feature embeddings, resulting in grouped feature patterns. From the grouped feature patterns, the temporal variation characteristics of variant patterns are extracted, and a long short-term memory network is used to process these temporal variation characteristics, generating variant pattern descriptions. If the dynamic variation amplitude of the variant pattern description exceeds a preset threshold, the associated feature embeddings are optimized through an embedding vector update algorithm to obtain an updated associated feature embedding set. Robustness is then assessed to determine a robust feature set adapted to the new variant.
[0077] Specifically, in deep learning-based network space malware analysis and detection, to address potential dynamic environmental noise interference in the fused associated feature embeddings, a robust feature set adapted to new variants needs to be generated through multiple optimization steps. The specific process is as follows:
[0078] By analyzing the fluctuations of associated feature embeddings (reflecting the fusion behavior patterns of malicious code file operations, network communication, and memory modification) over time, the distribution characteristics of dynamic environmental noise are obtained. Noise sources may include the camouflage behavior of malicious code variants, system operational interference, and data acquisition errors. Statistical analysis methods (such as calculating the mean and standard deviation of embedding vectors at different time points) are used to quantify the noise distribution. For example, if the standard deviation of malicious code behavior feature embeddings is 0.7 over a certain period, which is higher than the preset threshold of 0.4, it indicates significant noise interference. Further hypothesis testing (such as t-tests) is used to determine the significance level. If the p-value is less than 0.05, the fluctuation can be determined to be caused by noise, requiring targeted treatment.
[0079] If the noise significance level exceeds a threshold, the embedding parameters are adjusted through an adversarial training mechanism: a Generative Adversarial Network (GAN) is introduced. The generator simulates real malicious code behavior to generate feature embeddings that approximate the real distribution, while the adversarial network distinguishes between real embeddings and embeddings affected by noise, optimizing the parameters through dynamic game theory. For example, with the initial embedding parameters, the malicious code detection accuracy is 82%. After 10 adversarial training iterations, the accuracy increases to 91%, generating an optimized set of embedding parameters.
[0080] Based on the optimized parameters, regenerate the associated feature embeddings. Use K-means clustering to group the feature embeddings, classifying malicious code behavior patterns into categories such as normal behavior, known malicious behavior, and suspected variant behavior. The grouping effect is evaluated using a silhouette coefficient (e.g., a coefficient of 0.7 indicates clear group boundaries). Extract the temporal variation characteristics of variant patterns from the grouped patterns. For example, if a certain malicious code variant's network communication frequency increases by 30% and its memory modification interval shortens by 20% within 10 minutes, use a Long Short-Term Memory (LSTM) network to process these dynamic changes and generate variant pattern descriptions.
[0081] If the dynamic change magnitude described by the variant pattern (such as fluctuations in behavioral characteristics) exceeds a preset threshold (such as 20%), the feature embedding is optimized using an embedding vector update algorithm (such as gradient descent) to reduce noise bias and generate an updated feature embedding set. A classification algorithm (such as support vector machine) is used to evaluate the robustness of the feature embedding. If the classification accuracy remains above 90% under different noise interferences (such as variant camouflage and system noise), it indicates that the feature embedding has strong adaptability to dynamic environments, and a robust feature set adapted to the new variant is finally determined.
[0082] A lightweight classifier is deployed on edge devices based on a robust feature set that adapts to new variants, and the classification labels of potential adversarial examples are obtained by analyzing the feature set.
[0083] As one specific implementation method, the process includes:
[0084] A feature extraction algorithm is used to process the robust feature set adapted to the new variants, obtaining an initial feature vector set. Based on the initial feature vector set, principal component analysis is used to reduce the dimensionality, resulting in a compressed feature vector set. If the dimensionality of the compressed feature vector set meets a preset threshold, a lightweight classifier is deployed on an edge device to generate a deployed classification model. Based on the deployed classification model, the compressed feature vector set is compared in real time to obtain preliminary classification labels for potential adversarial examples. From the preliminary classification labels, the label confidence distribution is obtained, and statistical analysis is used to determine whether the confidence level meets a preset threshold, thus determining reliable classification labels. If the confidence level of reliable classification labels is lower than the preset threshold, the classification model is optimized using a gradient boosting algorithm to obtain an updated classification model. Based on the updated classification model, the compressed feature vector set is re-compared to generate the final classification labels for potential adversarial examples.
[0085] Specifically, if the compressed feature vector set meets the preset dimension threshold, such as less than 10 dimensions, it can be deployed on edge devices using a lightweight classifier.
[0086] A random forest classifier is deployed on edge devices, with a model size kept under 1MB, suitable for resource-constrained devices. The classifier, based on a compressed feature vector set, compares the input data in real time to generate preliminary classification labels, such as distinguishing whether a device is in an abnormal state. Assuming that after sensor data input, the classifier outputs an "abnormal" label with a confidence level of 0.85.
[0087] Statistical analysis of the label confidence distribution can be performed using mean and variance tests.
[0088] For example, 100 classification results are collected, with a mean confidence level of 0.80 and a variance of 0.05. If a pre-set confidence threshold of 0.90 is set, labels below the threshold are considered unreliable. Statistical analysis ensures the stability of the classification results and avoids misclassification due to noise.
[0089] If the confidence level is below the threshold, the classification model can be optimized using the gradient boosting algorithm.
[0090] For example, adjusting model parameters and increasing the number of weak classifiers to 50 can improve classification accuracy. The optimized model then re-aligns with the feature vector set to generate the final classification labels. Assuming that the confidence level of the abnormal state labels increases to 0.92 after optimization, meeting the threshold requirement, this approach improves the model's ability to identify adversarial examples.
[0091] If the label indicates malicious behavior, then updated samples are extracted from the robust feature set adapted to new variants and injected into the recurrent neural network to obtain an optimized detection model under limited computing resources, thereby realizing dynamic analysis and detection of malicious code in cyberspace.
[0092] As a specific implementation method, the process of obtaining an optimized detection model under a computing resource-constrained environment includes:
[0093] The system obtains a set of labels indicating malicious behavior from the classification labels of potential adversarial examples. A filtering method is used to separate the feature subsets corresponding to the malicious labels, resulting in a malicious feature set. A feature selection algorithm is then used to filter the malicious feature set, generating a simplified feature set. If the dimensionality of the simplified feature set meets a preset threshold, it is injected into a recurrent neural network for training, resulting in an initial detection model. Based on the initial detection model, cross-validation is used to evaluate the model's performance in a resource-constrained environment, generating performance evaluation results. If the performance evaluation results do not meet the preset threshold, the parameters of the recurrent neural network are adjusted using a gradient descent algorithm to obtain an optimized detection model. Based on the optimized detection model, the input feature data stream is processed in real time to generate behavior detection labels.
[0094] Specifically, in scenarios involving the detection of malicious behavior on edge devices, obtaining a set of labels indicating malicious behavior from classification tags is a crucial step. By analyzing the confidence levels of the classification tags, labels highly correlated with malicious behavior can be filtered out.
[0095] For example, suppose an edge device is used to monitor network traffic. The classification labels might include "normal traffic," "abnormal traffic," and "malicious attack." By statistically analyzing the confidence distribution and setting a threshold such as 0.8, labels with a confidence level higher than 0.8 for "malicious attack" are categorized as malicious labels. This method ensures that only high-confidence labels are selected, avoiding the impact of misjudgments on subsequent analysis.
[0096] When using filtering methods to separate the feature subsets corresponding to malicious tags, correlation-based filtering algorithms can be used.
[0097] For example, based on mutual information, a correlation score is calculated between each feature and the malicious label, retaining features with scores higher than 0.6. Assuming the initial feature set includes features such as traffic rate, packet size, and connection frequency, filtering may reveal that traffic rate and connection frequency are highly correlated with malicious labels, thus generating a malicious feature set containing these two items. This approach effectively reduces interference from irrelevant features.
[0098] When using feature selection algorithms to filter highly relevant features to generate a concise feature set, a recursive feature elimination method can be employed.
[0099] For example, features that contribute the least to classification are removed one by one from the malicious feature set until the number of features drops to a preset threshold, such as 5. Assuming the initial feature set has 10 features, after recursive elimination, 5 highly relevant features such as traffic rate, connection frequency, and protocol type are retained. This streamlined feature set can reduce computational complexity while maintaining detection accuracy.
[0100] When training a recurrent neural network by injecting a simplified feature set, a long short-term memory network can be used to process time-series data. Assuming network traffic data is collected in time series, a feature vector is generated per second, containing data such as traffic rate and connection frequency. The model is trained using 1000 labeled data points to learn temporal patterns of malicious behavior, generating an initial detection model. This method is suitable for capturing behavioral changes in dynamic environments.
[0101] When evaluating the performance of the initial detection model using cross-validation, 5-fold cross-validation can be used. If the performance is not up to standard, the parameters of the recurrent neural network can be adjusted using the gradient descent algorithm.
[0102] When optimizing the detection model to process feature data streams in real time, the traffic data input per second can be processed by the model to generate behavioral detection labels. For example, if an input shows a high connection frequency, the model outputs a "malicious attack" label with a confidence level of 0.9. This real-time detection enables rapid response to potential threats.
[0103] This invention overcomes the limitations of traditional single-dimensional monitoring by capturing and integrating multi-dimensional behavioral traces of file operations, network communications, and memory modifications into a multi-source behavioral dataset. This ensures that no malicious behavior information is missed, providing a complete data foundation for detection. A normalized behavioral matrix is generated through standardization processing, eliminating differences in multi-source data formats and dimensionality interference. Dimensionality reduction and clustering optimize feature dimensions, providing structured, low-redundancy input for deep learning models and improving analysis efficiency. Convolutional neural networks extract local correlation patterns between file operations and network communications, while recurrent neural networks capture the temporal dependencies of memory modifications, achieving dynamic fusion of three-dimensional behaviors and revealing potential correlation patterns in malicious behavior. Enhance feature representativeness; optimize feature embedding parameters through adversarial training mechanisms to effectively resist dynamic environmental noise interference, screen out robust feature sets adapted to new variants, and solve the problem of insufficient adaptability of traditional models to rapidly evolving malware; deploy lightweight classifiers on edge devices, balance detection accuracy and computational resource requirements through feature dimensionality reduction and model optimization, achieve real-time identification of potential adversarial examples, and meet the real-time detection needs of resource-constrained environments; dynamically extract and update samples based on detection results to iteratively train recurrent neural networks, and generate optimized models through parameter adjustments to ensure stable detection performance in scenarios where malware variants accelerate, thereby improving the ability to respond to dynamic threats.
[0104] This embodiment provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the steps of the above-described method.
[0105] This embodiment provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.
[0106] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. A method for dynamic analysis and detection of cyberspace malware based on deep learning, characterized in that, Includes the following steps: The system acquires multidimensional behavioral traces during malicious code execution, constructs a multi-source behavioral dataset, and preprocesses it to obtain a normalized behavioral matrix. The multidimensional behavioral traces include file operation data, network communication data, and memory modification data. Based on the normalized behavior matrix, a local correlation pattern between file operations and network communication is obtained, and a high-dimensional feature vector is obtained based on the local correlation pattern. Based on the high-dimensional feature vector, the temporal dependency relationship between memory modification and the local association pattern is obtained, and the fused association feature embedding is obtained based on the temporal dependency relationship; Noise analysis is performed on the fused associated feature embeddings. The fused associated feature embeddings are then processed based on the noise analysis results. Finally, a robust feature set adapted to the new variant is obtained based on the processed associated feature embeddings. A lightweight classifier is deployed on edge devices based on a robust feature set that adapts to new variants, and the classification labels of potential adversarial examples are obtained by analyzing the feature set. If the label indicates malicious behavior, then updated samples are extracted from the robust feature set adapted to new variants and injected into the recurrent neural network to obtain an optimized detection model under limited computing resources, thereby realizing dynamic analysis and detection of malicious code in cyberspace.
2. The method for dynamic analysis and detection of cyberspace malware based on deep learning according to claim 1, characterized in that, The process of obtaining multi-dimensional behavioral traces during malicious code execution and constructing a multi-source behavioral dataset includes: By dynamically monitoring and capturing multidimensional behavioral traces during the execution of malicious code, a heterogeneous data set is obtained. Behavioral sequences are extracted from the heterogeneous data set, and time series analysis tools are used to integrate the timestamp information of the data in the heterogeneous data set to obtain a multi-source behavioral dataset.
3. The method for dynamic analysis and detection of cyberspace malware based on deep learning according to claim 1, characterized in that, The process of preprocessing the multi-source behavior dataset to obtain the normalized behavior matrix includes: The multi-source behavioral dataset is integrated to obtain a unified heterogeneous data set. If the data formats of the unified heterogeneous data set are inconsistent, a standardized data set is generated through format unification processing. Principal component analysis is used to reduce the dimensionality of the standardized data set to obtain dimensionality-reduced behavioral feature data. Cluster analysis algorithm is used to group the dimensionality-reduced behavioral feature data. If the Euclidean distance between features is less than a preset threshold, they are classified into the same behavioral category to obtain the behavioral classification result. Based on the behavioral classification result, a behavioral pattern matrix is constructed, and the classification result is mapped to a normalized behavioral matrix through a matrix generation process.
4. The method for dynamic analysis and detection of cyberspace malware based on deep learning according to claim 1, characterized in that, The process of obtaining high-dimensional feature vectors includes: File operation frequency data and network communication traffic data are obtained from the normalized behavior matrix. A convolutional neural network is used to extract the local correlation pattern between the file operation frequency and the network communication traffic to obtain a preliminary high-dimensional feature vector. Principal component analysis algorithm is used to reduce the dimensionality of the preliminary high-dimensional feature vector. If the variance contribution rate of the preliminary high-dimensional feature vector is greater than a preset threshold, the corresponding principal component is retained to obtain the dimensionality-reduced high-dimensional feature vector.
5. The method for dynamic analysis and detection of cyberspace malware based on deep learning according to claim 1, characterized in that, The process of obtaining the temporal dependency relationship between memory modification and the local association pattern based on the high-dimensional feature vector, and obtaining the fused association feature embedding based on the temporal dependency relationship includes: Based on the high-dimensional feature vectors, a long short-term memory network is used to process the time-series data of memory modification operations, extract temporal dependency characteristics, and generate temporal feature embeddings. Based on the temporal feature embeddings, a clustering algorithm is used to group dynamic behavior patterns to obtain behavior pattern classifications. Operation frequency distribution data is obtained from the behavior pattern classifications. If the variance of the operation frequency distribution is greater than a preset threshold, the pattern classification with high variance is retained to obtain selected behavior patterns. According to the selected behavior patterns, the temporal evolution law in the local association patterns is extracted to obtain dynamic association features. Based on the dynamic association features, an embedding vector generation algorithm is used to obtain the fused association feature embeddings.
6. The method for dynamic analysis and detection of cyberspace malware based on deep learning according to claim 1, characterized in that, The process of obtaining a robust feature set for adapting to new variants includes: The distribution characteristics of dynamic environmental noise are obtained from the fused associated feature embeddings. Statistical analysis is used to determine the significance level of noise interference, resulting in a noise distribution description. If the significance level of the noise distribution description exceeds a preset threshold, the embedding parameters are adjusted through an adversarial training mechanism to generate an optimized embedding parameter set. Based on the optimized embedding parameter set, the associated feature embeddings are regenerated. A clustering algorithm is used to group the associated feature embeddings, resulting in grouped feature patterns. From the grouped feature patterns, the temporal variation characteristics of variant patterns are extracted, and a long short-term memory network is used to process these temporal variation characteristics, generating variant pattern descriptions. If the dynamic variation amplitude of the variant pattern description exceeds a preset threshold, the associated feature embeddings are optimized through an embedding vector update algorithm to obtain an updated associated feature embedding set. Robustness is then assessed to determine a robust feature set adapted to the new variant.
7. The method for dynamic analysis and detection of cyberspace malware based on deep learning according to claim 1, characterized in that, The process of deploying a lightweight classifier on edge devices based on a robust feature set adapted to novel variants and analyzing the feature set to obtain classification labels for potential adversarial examples includes: A feature extraction algorithm is used to process the robust feature set adapted to the new variants, obtaining an initial feature vector set. Based on the initial feature vector set, principal component analysis is used to reduce the dimensionality, resulting in a compressed feature vector set. If the dimensionality of the compressed feature vector set meets a preset threshold, a lightweight classifier is deployed on an edge device to generate a deployed classification model. Based on the deployed classification model, the compressed feature vector set is compared in real time to obtain preliminary classification labels for potential adversarial examples. From the preliminary classification labels, the label confidence distribution is obtained, and statistical analysis is used to determine whether the confidence level meets a preset threshold, thus determining reliable classification labels. If the confidence level of reliable classification labels is lower than the preset threshold, the classification model is optimized using a gradient boosting algorithm to obtain an updated classification model. Based on the updated classification model, the compressed feature vector set is re-compared to generate the final classification labels for potential adversarial examples.
8. The method for dynamic analysis and detection of cyberspace malware based on deep learning according to claim 1, characterized in that, The process of obtaining an optimized detection model under limited computing resources includes: The system obtains a set of labels indicating malicious behavior from the classification labels of potential adversarial examples. A filtering method is used to separate the feature subsets corresponding to the malicious labels, resulting in a malicious feature set. A feature selection algorithm is then used to filter the malicious feature set, generating a simplified feature set. If the dimensionality of the simplified feature set meets a preset threshold, it is injected into a recurrent neural network for training, resulting in an initial detection model. Based on the initial detection model, cross-validation is used to evaluate the model's performance in a resource-constrained environment, generating performance evaluation results. If the performance evaluation results do not meet the preset threshold, the parameters of the recurrent neural network are adjusted using a gradient descent algorithm to obtain an optimized detection model. Based on the optimized detection model, the input feature data stream is processed in real time to generate behavior detection labels.
9. A computer device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the steps of the method according to any one of claims 1-8.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the method according to any one of claims 1-8.