基于深度学习的端到端恶意软件检测方法研究

Research on End-to-End Malware Detection Method Based on Deep Learning

摘要: 目前恶意软件对网络安全构成了严重威胁，现有基于机器学习的恶意软件检测方法，需要恶意软件分析师花费大量时间和精力来构建动态或静态特征，因此在实践中难以应用。为有效缓解上述问题，提出了一种基于深度学习的端到端恶意软件检测方法。与传统检测方法相比，所提方法具有端到端学习过程的优势。首先，提取恶意软件的前n字节，其中包含恶意软件关键信息作为模型输入；然后，基于卷积神经网络设计一种新的深度学习模型，引入残差网络和多头注意力机制，提高模型对不同输入的适应性以及对于复杂特征的提取能力。最后，经实验验证表明，该方法资源消耗低，并大大提升了检测精度。

Abstract: At present, malware poses a serious threat to network security. Existing malware detection methods based on machine learning require malware analysts to spend a lot of time and energy to construct dynamic or static features, so they are difficult to apply in practice. To effectively alleviate the above problems, an end-to-end malware detection method based on deep learning is proposed. Compared with traditional detection methods, the proposed method has the advantage of an end-to-end learning process. First, the first n bytes of malware are extracted, which contain key information of malware as the model input. Then, a new deep learning model is designed based on convolutional neural network, and residual network and multi-head attention mechanism are introduced to improve the adaptability of the model to different inputs and the ability to extract complex features. Finally, experimental verification shows that this method has low resource consumption and greatly improves the detection accuracy.