Abstract: To address the limitations of traditional methods in feature extraction and representation, which are unable to simultaneously capture the spatial and temporal features of API sequences and fail to capture key features that determine the target task, a malware detection method based on word embedding and feature fusion has been proposed. First, the word embedding technology from the field of natural language processing is utilized to encode API sequences, obtaining their semantic feature representations. Then, multiple convolutional networks and BiLSTM networks are employed to extract ngram local spatial features and temporal features of the API sequences, respectively. Finally, a selfattention mechanism is used to deeply fuse the captured features of critical positions, thereby achieving the classification task by characterizing deep malicious behavior features. Experimental results show that in binary classification tasks, the accuracy of this method reaches 94.79%, which is an improvement of 12.37% on average compared to traditional machine learning algorithms, and 5.78% higher on average compared to deep learning algorithms. In multiclass classification tasks, the accuracy of this model also reaches 91.95%, effectively enhancing the detection accuracy of malware.

Key words: malware detection, software call sequence, multiple convolutional networks, long short term memory network, feature fusion

摘要： 针对现有传统方法存在特征提取和表示受限、无法同时捕获API序列的空间语义特征和时序特征、无法捕获能决定目标任务的关键特征信息等问题，利用自然语言处理领域的词嵌入技术和多模型特征抽取以及特征融合技术，提出一种基于词嵌入和特征融合的恶意软件检测方法.首先使用自然语言处理领域的词嵌入技术对API序列编码，得到其语义特征编码表示；然后分别利用多重卷积网络和BiLSTM网络提取API序列的ngram局部空间特征和时序特征；最后利用自注意力机制对捕获的特征进行关键位置信息的深度融合，通过刻画深层恶意行为特征实现分类任务.实验结果表明，在二分类任务中，该方法准确率达到94.79%，相较于传统机器学习方法平均提高了12.37%，比深度学习方法平均提高5.78%.在多分类任务中，该方法的准确率也达到91.95%，能够有效地提高对恶意软件的检测准确率.

关键词: 恶意软件检测, 软件调用序列, 多重卷积网络, 长短期记忆网络, 特征融合