面向特征融合与知识蒸馏的恶意软件分类

Malware classification for feature fusion and knowledge distillation

提出一种面向特征融合与知识蒸馏的恶意软件分类方法.一方面,通过残差网络分别从灰度图和马尔可夫图中抽取恶意软件的序列特征和分布特征,并利用自注意力挖掘不同特征之间的关联性,以提升模型性能;另一方面,通过教师网络向多个学生网络进行知识迁移,并让学生网络互相协作学习,进一步降低模型规模.在微软和CCF数据集上的实验结果证明,该方法不仅能有效提升模型性能,而且可以降低模型的参数量和计算量.此外,通过热力图定位影响分类结果的字节,验证卷机神经网络从图像中抽取特征进行分类的科学性.

A malware classification method for feature fusion and knowledge distillation is proposed.On one hand,the sequence features and distribution features of malware are extracted from the grayscale image and the Markov image respectively through the residual network,and the correlation between different features is mined by using self⁃attention to improve the performance of the model.On the other hand,the teacher network transfer knowledge to multiple student networks,and the student networks collaborate learning to further reduce the scale of the model.The experimental results on Microsoft and CCF datasets show that this method not only effectively improves the performance of the model,but also reduces the number of parameters and computation of the model.In addition,this paper uses the heat map to locate the bytes that affect the classification results,and verifies the scientificity of the convolutional neural network to extract features from images for classification.