Apparatus for generating a signature that reflects the similarity of a malware detection and classification system based on deep neural networks, method therefor, and computer-readable recording medium recorded with a program for performing the method
An apparatus for generating a signature that reflects the similarity of a malware detection and classification system of the present invention includes a pre-processing unit configured to generate an input vector from input information, a classification unit configured to calculate a latent vector which indicates the similarity between at least one malware classification and the input vector by performing a plurality of computations to which learned weights of a plurality of layers are applied on the input vector through a deep neural network model, and a signature generation unit configured to generate a signature of the malware in a form of a binary vector by quantizing the latent vector.
1. An apparatus for generating a signature that reflects the similarity of a malware detection and classification system, the apparatus comprising: a pre-processing unit configured to generate an input vector from input information which is information on a file whose malware classification is unknown; a classification unit configured to calculate a latent vector which indicates the similarity between at least one malware classification and the input vector by performing a plurality of computations to which learned weights of a plurality of layers are applied on the input vector through a deep neural network model; and a signature generation unit configured to generate a signature of the malware in a form of a binary vector by quantizing the latent vector, wherein the quantizing includes: setting an expected value for a learning input vector of a known malware classification; calculating a latent vector which indicates the similarity between the malware classification and the input vector; applying unlearned weights to the learning input vector and correcting the weights so that the expected value is minimized using the equation:
L
b
=
η
∑
i
N
∑
j
M
b
ij
-
k
1
❘
"\[LeftBracketingBar]"
-
k
2
❘
"\[RightBracketingBar]"
wherein, Lb is an objective function which allows a value of the latent vector to be binarized (to be brought close to ki+k2 or ki−k2), i is a ratio in which the computation result value of the objective function is reflected in weight learning, N is the number of learning input vectors, M is a length of the latent vector, i denotes the i-th among first to N-th learning input vectors, j denotes the j-th element among first to M-th elements of the latent vector, bi is a value of the j-th element of the latent vector of the i-th learning input vector, ki is the reference value, and k2 is the separation value.
2. The apparatus according to claim 1 , further comprising a classification learning unit configured to: set an expected value for a learning input vector whose malware classification is known according to the known malware classification; input the learning input vector into the deep neural network model; and when the deep neural network model calculates an output value which indicates the similarity between at least one malware classification and the input vector by performing a plurality of computations to which unlearned weights are applied on the learning input vector, correct the weights of the deep neural network model so that a difference between the calculated output value and the expected value set according to the known malware classification is minimized.
3. The apparatus according to claim 1 , further comprising a distance function learning unit configured to: set a center vector of the known malware classification as an expected value for a learning input vector whose malware classification is known; input the learning input vector into the deep neural network model; and when the deep neural network model calculates a latent vector which indicates the similarity between at least one malware classification and the input vector by performing a plurality of computations to which unlearned weights are applied on the learning input vector, correct the weights of the deep neural network model so that a distance between the calculated latent vector and the center vector of the known malware classification is minimized.
4. The apparatus according to claim 3 , wherein the distance function learning unit corrects the weights of the deep neural network model, so that a computation result value of an objective function is minimized as shown in Equation 1 below:
L
c
=
λ
1
N
∑
i
(
c
yi
-
e
i
)
2
[
Equation
1
]
wherein, Lc is an objective function which allows the distance between the latent vector and the center vector to be minimized, X is a ratio in which the computation result value of the objective function of the distance function learning unit is reflected in weight learning of the deep neural network model, N is the number of learning input vectors, i denotes the i-th among first to N-th learning input vectors, Cyi is a center vector of the malware classification of the i-th learning input vector, and ei is a latent vector of the i-th learning input vector.
5. A method for generating a signature that reflects the similarity of a malware detection and classification system, the method comprising the steps of generating, by a pre-processing unit, an input vector from input information which is information on a file whose malware classification is unknown; calculating, by a classification unit, a latent vector which indicates the similarity between at least one malware classification and the input vector by performing a plurality of computations to which learned weights of a plurality of layers are applied on the input vector through a deep neural network model; and generating, by a signature generation unit, a signature vector of a malware in a form of a binary vector by quantizing the latent vector, wherein the quantizing includes: setting an expected value for a learning input vector of a known malware classification; calculating a latent vector which indicates the similarity between the malware classification and the input vector; applying unlearned weights to the learning input vector and correcting the weights so that the expected value is minimized using the equation:
L
b
=
η
∑
i
N
∑
j
M
b
ij
-
k
1
❘
"\[LeftBracketingBar]"
-
k
2
❘
"\[RightBracketingBar]"
wherein, Lb is an objective function which allows a value of the latent vector to be binarized (to be brought close to ki+k2 or ki−k2), i is a ratio in which the computation result value of the objective function is reflected in weight learning, N is the number of learning input vectors, M is a length of the latent vector, i denotes the i-th among first to N-th learning input vectors, j denotes the j-th element among first to M-th elements of the latent vector, bi is a value of the j-th element of the latent vector of the i-th learning input vector, ki is the reference value, and k2 is the separation value.
6. The method according to claim 5 , before the step of generating the input vector, further comprising a classification learning step comprising the steps of: generating, by the pre-processing unit, a learning input vector whose malware classification is known; setting, by a classification learning unit, an expected value for the learning input vector according to the known malware classification; inputting, by the classification learning unit, the learning input vector into the deep neural network model; calculating, by the deep neural network model of the classification unit, an output value which indicates the similarity between at least one malware classification and the input vector by performing a plurality of computations to which unlearned weights are applied on the learning input vector; and correcting, by the classification learning unit, the weights of the deep neural network model so that a difference between the calculated output value and the expected value set according to the known malware classification is minimized.
7. The method according to claim 6 , before the step of generating the input vector, and after the classification learning step, further comprising a distance function learning step comprising the steps of setting, by a distance function learning unit, a center vector of the known malware classification as an expected value for a learning input vector whose malware classification is known; inputting, by the distance function learning unit, the learning input vector into the deep neural network model; calculating, by the deep neural network model of the classification unit, a latent vector which indicates the similarity between at least one malware classification and the input vector by performing a plurality of computations to which unlearned weights are applied on the learning input vector; and correcting, by the distance function learning unit, the weights of the deep neural network model so that a distance between the calculated latent vector and the center vector of the known malware classification in a vector space is minimized.
8. The method according to claim 7 , wherein the distance function learning step comprises: correcting, by the distance function learning unit, the weights of the deep neural network model, so that a computation result value of an objective function is minimized as shown in Equation 1 below:
L
c
=
λ
1
N
∑
i
(
c
yi
-
e
i
)
2
[
Equation
1
]
wherein, Lc is an objective function which allows the distance between the latent vector and the center vector to be minimized, X is a ratio in which the computation result value of the objective function of the distance function learning unit is reflected in weight learning of the deep neural network model, N is the number of learning input vectors, i denotes the i-th among first to N-th learning input vectors, Cyi is a center vector of the malware classification of the i-th learning input vector, and ei is a latent vector of the i-th learning input vector.
9. A computer-readable recording medium in which a program for performing the method for generating a signature according to claim 5 in a computer is recorded.