基于卷积注意力机制的恶意软件样本增强方案  

Enhanced Malware Sample Generation Scheme Based on Convolution Attention Mechanism

作　　者：钟家豪 张新有[1] 冯力 邢焕来[1] Zhong Jiahao;Zhang Xinyou;Feng Li;and Xing Huanlai(School of Computer and Artificial Intelligence,Southwest Jiaotong University,Chengdu 610097)

机构地区：[1]西南交通大学计算机与人工智能学院,成都610097

出　　处：《信息安全研究》2024年第5期431-439,共9页Journal of Information Security Research

基　　金：国家自然科学基金项目(62172342)。

摘　　要：在人工智能的大背景下,越来越多的机器学习算法被应用于恶意软件检测领域.然而在实际场景中存在恶意软件数量明显低于良性软件的数据不平衡问题.基于此,提出了一种融合卷积注意力机制的生成对抗网络检测逃逸模型,该模型能够生成可绕过检测器检测的恶意软件对抗样本.实验对比了该逃逸模型、基于深度神经网络的以及基于卷积神经网络的逃逸模型在7种恶意软件分类器上的性能表现,结果表明,该逃逸模型可以在不清楚检测模型内部结构的情况下获得更高的逃逸率,能够为生成高质量对抗样本提供一种新的思路.In the context of artificial intelligence,an increasing number of machine learning algorithms are being applied in the field of malicious software detection.However,a significant challenge in practical scenarios is the imbalance in data,where the quantity of malicious software is notably lower than benign software.Addressing this issue,we propose a novel generative adversarial network(GAN)detection escape model,incorporating a convolutional attention mechanism.This model is capable of generating adversarial samples of malicious software that can evade detection by the classifier.Experimental comparisons were conducted to evaluate the performance of this escape model,along with escape models based on deep neural networks and convolutional neural networks,across seven different malicious software classifiers.The results demonstrate that this escape model can achieve higher evasion rates without explicit knowledge of the internal structure of the detection model,offering a new perspective for generating high-quality adversarial samples.

关 键 词：恶意软件检测 对抗样本 检测逃逸 卷积注意力机制 生成对抗网络 

分 类 号：TP183[自动化与计算机技术—控制理论与控制工程]