基于生成对抗网络增强恶意代码的方法  

Method based on generative adversarial network enhanced malicious code

作　　者：朱晓慧 钱丽萍 傅伟[1,2] ZHU Xiao-hui;QIAN Li-ping;FU Wei(School of Electrical and Information Engineering,Beijing University of Civil Engineering and Architecture,Beijing 100044,China;Beijing Key Laboratory of Intelligent Processing for Building Big Data,Beijing University of Civil Engineering and Architecture,Beijing 100044,China)

机构地区：[1]北京建筑大学电气与信息工程学院,北京100044 [2]北京建筑大学建筑大数据智能处理方法研究北京市重点实验室,北京100044

出　　处：《计算机工程与设计》2021年第11期3034-3042,共9页Computer Engineering and Design

基　　金：国家自然科学基金项目(61571144);北京建筑大学研究生创新基金项目(PG2020048)。

摘　　要：针对主流分类检测方法识别恶意代码面临的训练数据受限和种类均衡性不足问题,提出一种基于图像矢量结合生成对抗网络模型的恶意代码数据增强方法。将图像处理技术与WGAN-GP深度学习模型相结合,将恶意代码数据可视化为图像,通过缩放处理使恶意代码文件在长度不一致的情况下能够高概率保留全部隐含特征;使用WGAN-GP训练学习隐含的特征,生成新的数据;采用图像生成质量评价指标SSIM以及基础分类器准确率验证生成数据的相似性和有效性。实验结果表明,该方法可以有效学习样本分布规律,生成充足均衡且相似性较好的数据,满足后续研究的需要。Aiming at the problem of limited training data and insufficient balance of types faced by mainstream classification detection methods to identify malicious codes,a method for enhancing malicious code data based on the combination of image vectors and generative adversarial network model was proposed.Image processing technology was combined with the WGAN-GP deep learning model.The malicious code data were visualized as an image,and through the scaling process,the malicious code file retained all hidden features with high probability even when the length was not consistent.WGAN-GP training was used to learn the hidden features and generate new data.The image generation quality evaluation index SSIM and the basic classifier accuracy were used to verify the similarity and effectiveness of the generated data.Experimental results show that the proposed method can effectively learn the sample distribution law and generate sufficient balanced and similar data to meet the needs of subsequent research.

关 键 词：网络安全 恶意代码 生成对抗网络 数据增强 分类检测 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]