基于TCN与ChebyKAN融合网络的恶意软件多分类模型

Malware multi-classification model for based on TCN and ChebyKAN fusion network

  • 摘要: 针对基于API调用序列的传统恶意软件检测方法存在长距离时序依赖捕捉不足、忽略特征间高阶非线性关系等相关问题,提出了一种融合时序卷积网络(TCN)与Chebyshev-Kolmogorov-Arnold network(ChebyKAN)的恶意软件多分类模型(TCN-SE-ChebyKAN)。首先,基于TCN模块对API调用序列提取特征,利用因果卷积和膨胀卷积,突破传统循环神经网络在长距离时序依赖建模中的局限,精准捕捉恶意软件多阶段行为的时序关联;其次,引入SE模块构建通道注意力机制,动态优化通道权重,解决关键判别性特征被冗余信息掩盖的问题;最后,通过切比雪夫多项式改进KAN模块(ChebyKAN),利用其全局逼近特性增强特征间高阶非线性关系的建模能力,克服原始KAN中B样条函数局部性强的缺陷。实验结果表明,该模型在Mal-API-2019数据集上AUC值达 92.53%,精确率、召回率、F1值等指标均有显著提升。

     

    Abstract: The traditional malware detection methods based on API (application programming interface) call sequences fail to sufficiently capture the long-term temporal dependencies and neglect the high-order nonlinear relationships among features. To address these issues, this paper proposes a multi-classification model for malware (TCN-SE-ChebyKAN) that integrates a temporal convolutional network (TCN) and Chebyshev-Kolmogorov-Arnold network (ChebyKAN). First, the TCN module is employed to extract features from API call sequences. By leveraging causal convolutions and dilated convolutions, the model captures temporal characteristics and long-range dependencies representing malware behavior, thereby obtaining more comprehensive behavioral information. Next, a squeeze-and-excitation (SE) network module is introduced to construct a channel attention mechanism. Through dynamic adjustment of channel weights, the model enhances its ability to capture discriminative features. Finally, the KAN (Kolmogorov-Arnold network) module is utilized to model complex relationships among features. By improving the KAN module with Chebyshev polynomials, the model strengthens its capability to model high-order nonlinear relationships among features, boosting overall detection performance. Experimental results demonstrate that the proposed model achieves an AUC value of 92.53% on the Mal-API-2019 data set, with significant improvements in other detection metrics.

     

/

返回文章
返回