面向小样本的恶意软件检测综述  

Survey on Few-shot for Malware Detection

作　　者：刘昊[1] 田志宏 仇晶 刘园 方滨兴 LIU Hao;TIAN Zhi-Hong;QIU Jing;LIU Yuan;FANG Bin-Xing(Cyberspace Institute of Advanced Technology,Guangzhou University,Guangzhou 510799,China)

机构地区：[1]广州大学网络空间安全学院,广东广州510799

出　　处：《软件学报》2024年第8期3785-3808,共24页Journal of Software

基　　金：国家自然科学基金(U20B2046);国家重点研发计划(2021YFB2012402);广东省高校创新团队项目(2020KCXTD007);广州市高校创新团队项目(202032854)。

摘　　要：恶意软件检测是网络空间安全研究中的热点问题,例如Windows恶意软件检测和安卓恶意软件检测等.随着机器学习和深度学习的发展,一些在图像识别、自然语言处理领域的杰出算法被应用到恶意软件检测,这些算法在大量数据下表现出了优异的学习性能.但是,恶意软件检测中有一些具有挑战性的问题仍然没有被有效解决,例如,基于少量新颖类型的恶意软件,常规的学习方法无法实现有效检测.因此,小样本学习(few-shot learning,FSL)被用于解决面向小样本的恶意软件检测(few-shot for malware detection, FSMD)问题.通过相关文献,提取出FSMD的问题定义和一般流程.根据方法原理,将FSMD方法分为:基于数据增强的方法、基于元学习的方法和多技术结合的混合方法,并讨论每类FSMD方法的特点.最后,提出对FSMD的背景、技术和应用的展望.Malware detection is a hotspot of cyberspace security research,such as Windows malware detection and Android malware detection.With the development of machine learning and deep learning,some outstanding algorithms in the fields of image recognition and natural language processing have been applied to malware detection.These algorithms have shown excellent learning performance with a large amount of data.However,there are some challenging problems in malware detection that have not been solved effectively.For instance,conventional learning methods cannot achieve effective detection based on a few novel malware.Therefore,few-shot learning(FSL)is adopted to solve the few-shot for malware detection(FSMD)problems.This study extracts the problem definition and the general process of FSMD by the related research.According to the principle of the method,FSMD methods are divided into methods based on data augmentation,methods based on meta-learning,and hybrid methods combining multiple technologies.Then,the study discusses the characteristics of each FSMD method.Finally,the background,technology,and application prospects of FSMD are proposed.

关 键 词：网络安全 小样本学习 恶意软件检测 恶意行为 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]