CN111552964A - A Malware Classification Method Based on Static Analysis - Google Patents

Abstract

The invention belongs to the technical field of computer security, and in particular relates to a static analysis-based malware classification method. The invention relates to converting malicious software into binary files and generating grayscale images, using a convolutional neural network model with a spatial pyramid pooling layer to train the grayscale images to obtain static classifiers, and classifying malware samples into families through the static classifiers Classification. The invention can use the grayscale image as a feature to classify malicious software, and effectively reduces the information loss caused by the image preprocessing stage. The present invention classifies the malicious software by analyzing the contour features of the malicious software, which can help professionals reduce the cost of identifying the malicious software.

Description

A Malware Classification Method Based on Static Analysis

technical field

The invention belongs to the technical field of computer security, and particularly relates to a static analysis-based malware classification method.

Background technique

With the rapid development of the Internet industry, people's dependence on various software has also increased, which brings great convenience to the attack and spread of malware. Due to the emergence of various automated tools, malware is discovered at a rate much slower than its derivatives on the Internet. For example, in 2017 Kaspersky Lab detected 15,714,700 malicious objects. McAfee Labs detected 7.9 million malicious files per day in Q1 2018, an increase of 4.5 million from Q4 2017. Although the rate of derivation of malware is getting faster and faster, the vast majority of malware evolves through polymorphism and deformation of known malware. Therefore, discovering the homology relationship in the sample plays a very important role in the traceability of the attack organization, the restoration of the operating environment, and the attack prevention.

Due to the continuous improvement of malware technology and the wider use of application software, the spread of malware is also increasing during certain operations, but the vast majority of them are caused by known malware. evolved. Although relevant personnel have done a lot of research work, malware is still rampant. The dynamic analysis method has higher accuracy but lower efficiency, and will generate excessive classification cost in the analysis process. Compared with the dynamic analysis method, the static analysis method has higher classification accuracy and higher efficiency than the dynamic analysis method. Therefore, it is very important to study the malware classification method based on static analysis. It has very important scientific theoretical value and practical application significance to study the widely applicable and practical malware classification technology to improve the security of computer system.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a malware classification method based on static analysis, which can classify the malware by analyzing the contour features of the malware, and help professionals reduce the cost of identifying the malware.

The object of the present invention is achieved through the following technical solutions: comprise the following steps:

Step 1: Input the software data set to be classified, and divide the software data set to be classified into a training set and a test set;

Step 2: Convert the software samples in the training set into binary files, and the conversion method is specifically: converting the Windows executable file .exe to be analyzed into a binary stream file in .bytes format;

Step 3: Split the binary file by each 8-bit byte and convert each 8-bit byte to grayscale value, the conversion scheme maps the byte value from 0 to 255, where 0 represents black and 255 represents white; then in order The arrangement method converts the gray value into a two-dimensional grayscale matrix, and determines the width and height of the two-dimensional grayscale matrix according to the file size, thereby visualizing it as a grayscale image;

Step 4: use the generated grayscale image to train a convolutional neural network model to generate a static classifier; the convolutional neural network model includes an input layer, a convolutional layer, a maximum pooling layer, a spatial pyramid pooling layer and an output layer; Use small-window convolution filters to process grayscale images; convolution layers all use 3 × 3 convolution kernels with stride set to 1; 1-pixel edge padding is performed on the input feature map in the convolution layer; max pooling When using a 2×2 sliding window, the step size is set to 2; the last pooling layer adopts 3-layer spatial pyramid pooling, inputting the features of any dimension and then outputting them uniformly; after each pooling layer, the convolutional neural network, Use dropout with probability 0.5 to prevent overfitting phenomenon; use Leaky ReLU activation function, uniform weight initialization and batch normalization;

Step 5: Input the test set of the software data set to be classified into the static classifier, and determine the family to which the malware belongs according to the classification result of the classifier, and complete the classification of the malware.

The beneficial effects of the present invention are:

The present invention takes the grayscale image as a feature and uses a convolutional neural network with a spatial pyramid pooling layer for classification, which effectively reduces the information loss caused by the image preprocessing stage. The invention has lower time cost in the field of malware detection, and has the advantages of fast detection speed and high detection efficiency.

Description of drawings

FIG. 1 is a flow chart of the present invention.

FIG. 2 is a flowchart of generating a grayscale image of malware in the present invention.

FIG. 3 is a structural diagram of a convolutional neural network in the present invention.

Detailed ways

The present invention will be further described below with reference to the accompanying drawings.

The invention provides a malware classification system based on static analysis, which belongs to the field of computer security. The invention relates to converting malicious software into binary files and generating grayscale images, using a convolutional neural network model with a spatial pyramid pooling layer to train the grayscale images to obtain a static classifier, and classifying malware samples into families through the static classifiers Classification. The invention can use the grayscale image as a feature to classify malicious software, and effectively reduces the information loss caused by the image preprocessing stage. The purpose of the present invention is to classify the malware by analyzing the contour features of the malware and help professionals reduce the cost of identifying the malware.

(1) The classification system converts malware samples into binary files for processing in the form of static analysis.

(2) The classification system divides the binary file with every 8 bytes as a block, and then converts a string of gray value streams into gray values ranging from 0 to 255 and stores it in a one-dimensional gray scale array, and then converts the one-dimensional vector into A two-dimensional grayscale matrix, which in turn generates a grayscale image.

(3) The classification system uses the generated grayscale images to train a convolutional neural network model to generate a static classifier. The convolutional neural network model includes an input layer, a convolutional layer, a max pooling layer, a spatial pyramid pooling layer and an output layer.

(4) The classification system inputs the malware samples in the test set into the static classifier, and judges the family of the malware according to the classification result of the classifier.

The classification system for converting malware into binaries further includes:

The malware sample data is preprocessed, and the Windows executable file .exe to be analyzed is converted into a binary stream file in .bytes format.

The generation of grayscale images in the classification system further includes:

The classification system treats the malware as a binary file, splits the binary file at every 8-bit byte, and converts each 8-bit byte into a grayscale value, the conversion scheme maps the byte value from 0 (black) to 255 (white) . Then the gray values are converted into a two-dimensional grayscale matrix in a sequential manner, and the width and height of the two-dimensional grayscale matrix are determined according to the size of the malicious code file, thereby visualizing it as a grayscale image.

The convolutional neural networks involved in the classification system further include:

The classification system processes grayscale images through a convolutional neural network using small-window convolutional filters. The convolutional layers all use 3×3 convolution kernels with stride set to 1. The input feature map is then subjected to 1-pixel edge padding in the convolutional layer. A 2×2 sliding window is used for max pooling, and the stride is set to 2. The last pooling layer adopts 3-layer spatial pyramid pooling, which inputs the features of any dimension and outputs them uniformly.

Convolutional neural network optimization further includes:

The convolutional neural network uses dropout with probability 0.5 after each pooling layer to prevent overfitting. Then use Leaky ReLU activation function, uniformly distributed weight initialization and batch normalization.

The static classifier classification involved in the classification system further includes:

The classification of each malware sample by the convolutional neural network model is the classification result of the static classifier.

The invention provides a malware classification system based on static analysis, and the invention can use grayscale images as features to classify malware. The purpose of the present invention is to classify the malware by analyzing the contour features of the malware, and help professionals reduce the cost of identifying the malware.

Compared with the prior art, the advantages of the present invention are:

1. The present invention proposes a malware classification system based on static analysis, which uses grayscale images as features and uses a convolutional neural network with a spatial pyramid pooling layer for classification, which effectively reduces the information loss caused by the image preprocessing stage. .

2. The present invention proposes a malware classification system based on static analysis, which has lower time cost in the field of malware detection.

3. The present invention proposes a malware classification system based on static analysis, which has the advantages of fast detection speed and high detection efficiency.

FIG. 1 is a flowchart of a malware classification system based on static analysis provided by the present invention. The present invention includes the following four aspects.

(1) The classification system converts malware samples into binary files for processing in the form of static analysis.

The malware sample data is preprocessed, and the Windows executable file .exe to be analyzed is converted into a binary stream file in .bytes format.

(2) The classification system divides the binary file with every 8 bytes as a block, and then converts a series of gray value streams into gray values ranging from 0 to 255 and stores them in a one-dimensional gray scale array, and then converts the one-dimensional vector into A two-dimensional grayscale matrix, which in turn generates a grayscale image.

Combined with the grayscale image generation flow chart in Figure 2, the classification system treats the malware as a binary file, divides the binary file by every 8-bit byte, and converts every 8-bit byte into a grayscale value. The conversion scheme converts the byte value from 0 (black) maps to 255 (white). Then the gray values are converted into a two-dimensional grayscale matrix in a sequential manner, and the width and height of the two-dimensional grayscale matrix are determined according to the size of the malicious code file, thereby visualizing it as a grayscale image.

(3) The classification system uses the generated grayscale images to train a convolutional neural network model to generate a static classifier. The convolutional neural network model includes an input layer, a convolutional layer, a max pooling layer, a spatial pyramid pooling layer and an output layer.

In conjunction with Figure 3, the classification system processes grayscale images through a convolutional neural network using small-window convolutional filters. The convolutional layers all use 3×3 convolution kernels with stride set to 1. The input feature map is then subjected to 1-pixel edge padding in the convolutional layer. A 2×2 sliding window is used for max pooling, and the stride is set to 2. The last pooling layer adopts 3-layer spatial pyramid pooling, which inputs the features of any dimension and outputs them uniformly.

(4) The classification system inputs the malware samples in the test set into the static classifier, and judges the family of the malware according to the classification result of the classifier.

The classification of each malware sample by the convolutional neural network model is the classification result of the static classifier.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims (1)

1. A malware classification method based on static analysis is characterized by comprising the following steps:

step 1: inputting a software data set to be classified, and dividing the software data set to be classified into a training set and a testing set;

step 2: converting the software sample in the training set into a binary file, wherein the conversion method specifically comprises the following steps: the Exe of the Windows executable file to be analyzed is converted into a binary stream file in a bytes format;

and step 3: partitioning the binary file with every 8-bit byte and converting every 8-bit byte into a gray value, the conversion scheme mapping byte values from 0 to 255, where 0 represents black and 255 represents white; secondly, converting the gray values into a two-dimensional gray matrix in a sequential arrangement mode, and determining the width and the height of the two-dimensional gray matrix according to the size of a file so as to visualize the two-dimensional gray matrix into a gray image;

and 4, step 4: training a convolutional neural network model by using the generated gray level image to generate a static classifier; the convolutional neural network model comprises an input layer, a convolutional layer, a maximum pooling layer, a spatial pyramid pooling layer and an output layer; processing the gray scale image using a small window convolution filter; convolution layers all use a convolution kernel of 3 × 3, and the step size is set to 1; performing 1-pixel edge filling on the input feature map in the convolutional layer; using a 2 multiplied by 2 sliding window when the pooling is maximum, and setting the step length to be 2; the last pooling layer adopts 3 layers of space pyramid pooling, and features of any dimension are input and then uniformly output; the convolutional neural network uses dropout with probability of 0.5 after each pooling layer to prevent the overfitting phenomenon; initializing and batch normalizing by using a Leaky ReLU activation function and uniformly distributed weights;

and 5: and inputting the test set of the software data set to be classified into a static classifier, judging the family to which the malicious software belongs according to the classification result of the classifier, and finishing classification of the malicious software.

Images