基于参数优化元学习和困难样本挖掘的小样本恶意软件分类方法  

Classification of Few-Sample Malware Based on Parameter-Optimized Meta-Learning and Hard Example Mining

作　　者：王方伟[1,2] 柴国芳 李青茹[1,2] 王长广[1,2] WANG Fangwei;CHAI Guofang;LI Qingru;WANG Changguang(Key Laboratory of Network and Information Security of Hebei Province,Hebei Normal University,Shijiazhuang 050024,Hebei,China;College of Computer and Cyber Security,Hebei Normal University,Shijiazhuang 050024,Hebei,China)

机构地区：[1]河北师范大学河北省网络与信息安全重点实验室,河北石家庄050024 [2]河北师范大学计算机与网络空间安全学院,河北石家庄050024

出　　处：《武汉大学学报（理学版）》2022年第1期17-25,共9页Journal of Wuhan University:Natural Science Edition

基　　金：国家自然科学基金(61572170);河北省自然科学基金(F2021205004);河北省教育厅自然科学基金(201901028,ZD2021062)。

摘　　要：在恶意软件分类中,针对新出现的恶意软件样本数量少导致分类准确性低的问题,提出了一种基于参数优化元学习和困难样本挖掘的方法。首先,将恶意软件反编译得到二进制文件,进而转化为灰度图。然后,使用参数优化元学习在多个任务上训练模型,获得浅层神经网络的初始化参数,并在此基础上,根据测试集中的少量任务来微调模型。同时,结合困难样本挖掘方法,有目的性地组织样本训练模型,提高模型的收敛速度以及分类准确率。最后,在Malimg数据集和BIG-2015数据集上与已有深度学习方法做了对比实验。实验结果表明:在Malimg数据集上,分类准确率达到0.9967;在BIG-2015数据集上,分类准确率达到0.9933,都优于已有方法。This paper proposes a method based on parameter optimization meta-learning and hard example mining to deal with the problem of low classification accuracy in malware classification due to the few samples of the emerging malwares.Firstly,each malware is decompiled into binary files and then transformed into gray-scale images.Secondly,we use a parameter optimization-based meta-learning method to train the shallow neural network,and obtain its initialization parameters.Based on these parameters,the new model can be easily fine-tuned and applied to new tasks.At the same time,combined with the method of hard sample mining,the model is organized purposefully to improve the convergence speed and classification accuracy.Finally,comparison experiments with the existing deep learning methods are done on the Malimg and BIG-2015 datasets.Experimental results show that the classification accuracy is 0.9967 and 0.9933 on Malimg and Big-2015,respectively,which outperforms the existing methods.

关 键 词：恶意软件 神经网络 元学习 困难样本挖掘 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]