一种基于特征融合的恶意代码快速检测方法

doi:10.12263/DZXB.20211701

摘要/Abstract

摘要：

随着恶意代码对抗技术的发展，恶意攻击者通过加壳、代码混淆等技术繁衍大量恶意代码变种，而传统恶意代码检测方法难以对其进行有效检测.基于恶意代码可视化的恶意代码检测方法被证明是一种能够有效识别恶意代码及其变种的新方法.针对目前研究仅着眼于提升模型分类准确率而忽略了恶意代码检测的时效性，本文提出了一种基于特征融合的恶意代码快速检测方法.该方法以深度神经网络为框架，采取模块化设计思想，将多尺度恶意代码特征融合与通道注意力机制结合，增强关键特征表达，并使用数据增强技术改善数据集类别不平衡问题.通过实验证明本文方法分类准确率高且参数量小、检测时效性高，优于目前的恶意代码检测技术.

关键词: 恶意代码, 深度神经网络, 特征融合, 通道注意力机制, 数据增强技术, 恶意代码可视化

Abstract:

With the development of anti-malicious code technology, malicious attackers multiply a large number of malicious code variants by adding shell, code obfuscation and other technologies. However, traditional malicious code detection methods are difficult to detect them effectively. Malicious code detection based on malicious code visualization has been proved to be an effective method for identifying malicious code variants. The current research only focuses on improving the accuracy of model classification while ignoring the timeliness of malicious code detection. To solve the above problem, this paper proposes a fast malicious code detection method based on feature fusion. Based on the framework of deep neural network and the idea of modular design, our method combines multi-scale malicious code feature fusion with channel attention mechanism to enhance typical feature expression. In addition, data augmentation technology is utilized to deal with the problem of dataset category imbalance. The results of experiments indicate that the proposed method achieves high classification accuracy, small number of parameters and high detection timeliness, which is superior to the current malicious code detection technology.

Key words: malicious code, deep neural network, feature fusion, channel attention mechanism, data augmentation technology, malicious code visualization

中图分类号:

TP309.5

王硕, 王坚, 王亚男, 等. 一种基于特征融合的恶意代码快速检测方法[J]. 电子学报, 2023, 51(1): 57-66.

Shuo WANG, Jian WANG, Ya-nan WANG, et al. A Fast Malicious Code Detection Method Based on Feature Fusion[J]. Acta Electronica Sinica, 2023, 51(1): 57-66.

图/表 17

参考文献 36

1	国家互联网应急中心. 2021年第2期网络安全信息与动态周报[R/OL]. (2021-01-13)[2021-12-23]. .
2	ALAZAB M. Profiling and classifying the behavior of malicious codes[J]. Journal of Systems and Software, 2015, 100: 91-102.
3	VENKATRAMAN S, ALAZAB M. Use of data visualization for zero-day malware detection[J]. Security and Communication Networks, 2018, 2018: 1-13.
4	CONTI G, BRATUS S, et al. Automated mapping of large binary objects using primitive fragment type classification[J]. Digital Investigation, 2010, 7: S3-S12.
5	NATARAJ L, KARTHIKETAN S, et al. Malware images: Visualization and automatic classification[C]//Proceedings of the 8th International Symposium on Visualization for Cyber Security. New York: ACM, 2011: 1-7.
6	韩晓光, 曲武, 等. 基于纹理指纹的恶意代码变种检测方法研究[J]. 通信学报, 2014, 35(8): 125-136.
	HAN X G, QU W, et al. Research on malicious code variants detection based on texture fingerprint[J]. Journal on Communications, 2014, 35(8): 125-136. (in Chinese)
7	NATARAJ L, YEGNESWARAN V, PORRAS P, et al. A comparative assessment of malware classification using binary texture analysis and dynamic analysis[C]//Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence. New York: ACM, 2011: 21-30.
8	汪嘉来, 张超, 戚旭衍, 等. Windows平台恶意软件智能检测综述[J]. 计算机研究与发展, 2021, 58(5): 977-994.
	WANG J L, et al. A survey of intelligent malware detection on windows platform[J]. Journal of Computer Research and Development, 2021, 58(5): 977-994. (in Chinese)
9	任卓君, 陈光, 卢文科. 基于N-gram特征的恶意代码可视化方法[J]. 电子学报, 2019, 47(10): 2108-2115.
	RENG Z J, CHEN G, LU W K. Malware visualization methods based on n-gram features[J]. Acta Electronica Sinica, 2019, 47(10): 2108-2115. (in Chinese)
10	NATARAJ L, MANJUNATH B S. SPAM: Signal processing to analyze malware[J]. IEEE Signal Processing Magazine, 2016, 33: 105-117.
11	KANCHERLA K, MUKKAMALA S. Image visualization based malware detection[C]//2013 IEEE Symposium on Computational Intelligence in Cyber Security. Singapore: IEEE, 2013: 40-44.
12	刘亚姝, 王志海, 等. 抗混淆的恶意代码图像纹理特征描述方法[J]. 通信学报, 2018, 39(11): 44-53.
	LIU Y S, WANG Z H, et al. Method of anti-confusion texture feature descriptor for malware images[J]. Journal on Communications, 2018, 39(11): 44-53. (in Chinese)
13	NAEEM H, GUO B, NAEEM M R, et al. Identification of malicious code variants based on image visualization[J]. Computers & Electrical Engineering, 2019, 76: 225-237.
14	卢喜东, 段哲民, 钱叶魁, 等. 一种基于深度森林的恶意代码分类方法[J]. 软件学报, 2020, 31(5): 1454-1464.
	LU X D, DUAN Z M, QIAN Y K, et al. Malicious code classification method based on deep forest[J]. Journal of Software, 2020, 31(5): 1454-1464. (in Chinese)
15	GIBERT D, MATEU C, PLANES J, et al. Using convolutional neural networks for classification of malware represented as images[J]. Journal of Computer Virology and Hacking Techniques, 2019, 15(1): 15-28.
16	DANISH V, MAMOUN A, SOBIA W, et al. IMCFN: Image-based malware classification using fine-tuned convolutional neural network architecture[J]. Computer Networks, 2020, 171: 107138.
17	KABANGA E K, KIM C H. Malware images classification using convolutional neural network[J]. Journal of Computer and Communications, 2018, 6(1): 153-158.
18	CUI Z H, XUE F, CAI X, et al. Detection of malicious code variants based on deep learning[J]. IEEE Transactions on Industrial Informatics, 2018, 14(7): 3187-3196.
19	CUI Z H, LEI D, et al. Malicious code detection based on CNNs and multi-objective algorithm[J]. Journal of Parallel and Distributed Computing, 2019, 129: 50-58.
20	HU J, SHEN L, ALBANIE S, et al. Squeeze and excitation networks[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2020, 42(8): 2011-2023.
21	奇安信技术研究院. DataCon: 面向安全研究的多领域大规模竞赛开放数据[EB/OL]. (2021-11-11)[2021-12-23]. .
22	LI Q, MI J, LI W, et al. CNN-based malware variants detection method for internet of things[J]. IEEE Internet of Things Journal, 2021, 8(23): 16946-16962.
23	SUDHAKAR K S. MCFT-CNN: Malware classification with fine-tune convolution neural networks using traditional and transfer learning in internet of things[J]. Future Generation Computer Systems, 2021, 125: 334-351.
24	DANISH V, MAMOUN A, SOBIA W, et al. Image-based malware classification using ensemble of CNN architectures (IMCEC)[J]. Computers & Security, 2020, 92: 101748.
25	杨望, 高明哲, 蒋婷. 一种基于多特征集成学习的恶意代码静态检测框架[J]. 计算机研究与发展, 2021, 58(5): 1021-1034.
	YANG W, GAO M Z, JIANG T. A malicious code static detection framework based on multi-feature ensemble learning[J]. Journal of Computer Research and Development, 2021, 58(5): 1021-1034. (in Chinese)
26	刘亚姝, 王志海, 侯跃然, 等. 一种基于概率主题模型的恶意代码特征提取方法[J]. 计算机研究与发展, 2019, 56(11): 2339-2348.
	LIU Y S, WANG Z H, HOU Y R, et al. A method of extracting malware features based on probabilistic topic method, 2019, 56(11): 2339-2348. (in Chinese)
27	GUO H, HUANG S, ZHANG M, et al. Classification of malware variant based on ensemble learning[C]//2020 International Conference on Machine Learning for Cyber Security. Guangzhou: Springer, 2020: 125-139.
28	SAADAT S, JOSEPH R V. Malware classification using CNN-XGBoost model[C]//2020 International Conference on Advanced Computing Technology. Chennai: Springer, 2021: 192-202.
29	KRIZHEVSKY A, SUTSKEVER I, HINTON G E. ImageNet classification with deep convolutional neural networks[J]. Communications of the ACM, 2017, 60(6): 84-90.
30	SIMONVAN K, ZISSERMAN A. Very deep convolutional networks for large-scale image recognition[EB/OL]. (2015-4-10)[2021-12-23]. .
31	HE K M, ZHAGN X Y, REN S Q, et al. Deep residual learning for image recognition[EB/OL]. (2015-04-10) [2021-12-23]. .
32	VENKATRAMAN S, ALAZAB M, VINAVAKUMAR R. A hybrid deep learning image-based analysis for effective malware detection[J]. Journal of Information Security and Applications, 2019, 47: 377-389.
33	VINITA V, SUNIL K M, SINGH V B. Multiclass malware classification via first- and second-order texture statistics[J]. Computers & Security. 2020, 97: 101895.
34	NAEEM H, ULLAH F, NAEEM M R, et al. Malware detection in industrial internet of things based on hybrid image visualization and deep learning model[J]. Ad Hoc Networks, 2020, 105: 102154.
35	WANG C, ZHAO Z, WANG F, et al. A novel malware detection and family classification scheme for IoT based on DEAM and DenseNet[J]. Security and Communication Networks, 2021, 2021: 1-16.
36	WANG S, WANG J, SONG Y F, et al. Malicious code variant identification based on multiscale feature fusion CNNs[J]. Computational Intelligence and Neuroscience, 2021, 2021: 1070586.

文件大小	宽度	文件大小	宽度
<10 KB	32	100~200 KB	384
10~30 KB	64	200~500 KB	512
30~60 KB	128	500~1 000 KB	768
60~100 KB	256	>1 000 KB	1 024

文件大小	宽度	文件大小	宽度
<10 KB	32	100~200 KB	384
10~30 KB	64	200~500 KB	512
30~60 KB	128	500~1 000 KB	768
60~100 KB	256	>1 000 KB	1 024

方法	设置	方法	设置
rescale	1/255	shear range	0.0
width shift	0.0	zoom range	0.0
height shift	0.0	horizontal flip	False
rotation range	0.0	fill mode	None

方法	设置	方法	设置
rescale	1/255	shear range	0.0
width shift	0.0	zoom range	0.0
height shift	0.0	horizontal flip	False
rotation range	0.0	fill mode	None

尺寸	准确率/%	精确率/%	召回率/%	F1/%	参数/M
32×32	84.28	83.44	84.27	82.82	0.31
64×64	94.22	93.08	94.22	93.26	0.35
128×128	98.07	98.06	98.07	98.07	0.50
256×256	99.04	99.18	99.04	99.06	1.11
512×512	98.61	98.61	98.60	98.60	3.58