基于MobileNet的恶意软件家族分类模型

现有基于卷积神经网络(CNN)的恶意代码分类方法存在计算资源消耗较大的问题.为降低分类过程中的计算量和参数量,构建基于恶意代码可视化和轻量级CNN模型的恶意软件家族分类模型.将恶意软件可视化为灰度图,以灰度图的相似度表示同一家族的恶意软件在代码结构上的相似性,利用灰度图训练带有深度可分离卷积的神经网络模型MobileNet v2,自动提取纹理特征,并采用Softmax分类器对恶意代码进行家族分类.实验结果表明,该模型对恶意代码分类的平均准确率为99.32%,较经典的恶意代码可视化模型高出2.14个百分点.

Malware Family Classification Model Based on MobileNet

The existing malicious code classification method based on Convolutional Neural Network(CNN)has the problem of large computational resource consumption.In order to reduce the computational quantity and parameter quantity in the classification process,this paper constructs a malware family classification model based on malicious code visualization and lightweight CNN.The malware is visualized as grayscale to represent the similarity on code structure of the same malware family.Then the gray map is used to train the neural network model MobileNet v2 with deep separable convolution,so as to automatically extract the texture features.The Softmax classifier is used to classify the malicious code.Experimental results show that the average classificationaccuracy ofthe proposed model is 99.32%,which is 2.4 percentage points higher than the classic malicious code visualization model.