資料載入中.....
|
請使用永久網址來引用或連結此文件:
https://nccur.lib.nccu.edu.tw/handle/140.119/159100
|
| 題名: | 基於異質靜態與動態分析模態的組合式潛在空間學習
Learning Compositional Latent Space from Heterogeneous Static-Dynamic Analysis Modalities |
| 作者: | 姚昀誠
Yao, Yun-Cheng |
| 貢獻者: | 蕭舜文
Hsiao, Shun-Wen
姚昀誠
Yao, Yun-Cheng |
| 關鍵詞: | 多模態融合
潛在空間解耦
惡意家族分類
模型可解釋性
Multimodal Fusion
Latent Space Disentanglement
Malware Family Classification
Model Interpretability |
| 日期: | 2025 |
| 上傳時間: | 2025-09-01 15:06:14 (UTC+8) |
| 摘要: | 多模態惡意程式分析為一種新興且具發展潛力之方法，藉由整合不同資料來源（如組合語言程式碼與API呼叫序列）以提升威脅偵測效能。然而，現有方法存在重要限制，包含長序列資訊擷取不足、共享語意與模態特定資訊相互混雜，以及表示學習缺乏可解釋性等問題。為解決上述挑戰，本研究提出自監督多模態協調與解耦網路（Self-Supervised Multimodal Coordination & Disentanglement Network, SMCDN），該網路能明確分離核心惡意程式語意與模態特定之私有資訊。本框架採用雙向GRU編碼器以保留序列脈絡資訊、結合對比學習之雙模態變分自編碼器以擷取協調之共享表示，並透過獨立性約束進行私有空間解耦。此外，本研究引入資訊貢獻比率指標，用以量化各模態對語意理解之重要性，進而提升模型可解釋性。實驗採用包含10,344個樣本、涵蓋29個惡意程式家族之真實資料集進行驗證。結果顯示，本方法達成74.9% 之分類準確率，較傳統融合方法提升約8%。資訊貢獻分析結果顯示，API呼叫序列對共享語意之貢獻顯著高於組合語言程式碼（6.91 vs 1.00），為惡意程式分析提供重要見解。
Multimodal malware analysis has emerged as a promising approach to improve threat detection by integrating diverse data sources such as assembly code and API call sequences. However, existing approaches face critical limitations including inadequate information extraction from long sequences, mixture of shared semantics with modality-specific information, and lack of interpretability in representation learning. To address these challenges, we propose a Self-Supervised Multimodal Coordination & Disentanglement Network (SMCDN) that explicitly separates core malware semantics from modality-specific private information. Our framework employs bidirectional GRU-based encoders to preserve sequential context, dual modality VAEs with contrastive learning to extract coordinated shared representations, and independence constraints to disentangle private spaces. We introduce an information contribution ratio metric that quantifies each modality’s importance for semantic understanding, providing model interpretability. Extensive experiments on the real-world malware dataset containing 10,344 samples across 29 families demonstrate that our approach achieves 74.9% classification accuracy, outperforming traditional fusion methods by approximately 8%. The information contribution analysis reveals that API call sequences contribute significantly more to shared semantics compared to assembly code (6.91 vs 1.00), providing valuable insights for malware analysis. |
| 參考文獻: | Alzahrani, S., Xiao, Y., Asiri, S., Alasmari, N., & Li, T. (2025). RansomFormer: A cross-modal transformer architecture for ransomware detection via the fusion of byte and API features. Electronics, 14(7).
Arrowsmith, J., Susnjak, T., & Jang-Jaccard, J. (2025). Multimodal deep learning for Android malware classification. MDPI.
AV-TEST Institute. (2024). Malware statistics & trends report. AV-TEST GmbH. https://www.av-test.org/en/statistics/malware/
Bensaoud, A., Kalita, J., & Bensaoud, M. (2024). A survey of malware detection using deep learning. Machine Learning with Applications, 16, 100546. https://doi.org/10.1016/j.mlwa.2024.100546
Chen, T., Kornblith, S., Norouzi, M., & Hinton, G. (2020). A simple framework for contrastive learning of visual representations. In Proceedings of the 37th International Conference on Machine Learning (Article 149). JMLR.org.
Cuckoo Foundation. (2010). Cuckoo Sandbox [GitHub repository]. GitHub. https://github.com/cuckoosandbox
de Oliveira, A. S., & Sassi, R. J. (2023). Chimera: an android malware detection method based on multimodal deep learning and hybrid analysis. Authorea Preprints. Authorea.
Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., Houlsby, N., & Steiner, A. (2020). An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929.
Geng, X., Liu, H., Lee, L., Schuurams, D., Levine, S., & Abbeel, P. (2022). Multimodal masked autoencoders learn transferable representations. arXiv preprint arXiv:2205.14204.
Gibert, D., Mateu, C., & Planes, J. (2020). HYDRA: A multimodal deep learning framework for malware classification. Computers & Security, 95, 101873. https://doi.org/10.1016/j.cose.2020.101873
Gretton, A., Bousquet, O., Smola, A., & Schölkopf, B. (2005). Measuring statistical dependence with Hilbert-Schmidt norms. In International Conference on Algorithmic Learning Theory (pp. 63-77). Springer.
Guo, D., Lu, S., Duan, N., Wang, Y., Zhou, M., & Yin, J. (2022). UniXcoder: Unified cross-modal pre-training for code representation. arXiv preprint arXiv:2203.03850.
Hsu, W. N., & Glass, J. (2018). Disentangling by partitioning: A representation learning framework for multimodal sensory data. arXiv preprint arXiv:1805.11264.
Huang, Y. T., Lin, C. Y., Guo, Y. R., Lo, K. C., Sun, Y. S., & Chen, M. C. (2021). Open source intelligence for malicious behavior discovery and interpretation. IEEE Transactions on Dependable and Secure Computing, 19(2), 776-789.
Khattar, D., Goud, J. S., Gupta, M., & Varma, V. (2019). MVAE: Multimodal variational autoencoder for fake news detection. In The World Wide Web Conference (pp. 2915-2921). ACM. https://doi.org/10.1145/3308558.3313552
Lei, J., Li, L., Zhou, L., Gan, Z., Berg, T. L., Bansal, M., & Liu, J. (2021). Less is more: CLIPBERT for video-and-language learning via sparse sampling. In 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 7327-7337). IEEE Computer Society. https://doi.org/10.1109/CVPR46437.2021.00725
Li, S., & Tang, H. (2024). Multimodal alignment and fusion: A survey. arXiv preprint arXiv:2411.17040.
Li, X., Liu, L., Liu, Y., & Liu, H. (2025). Detecting Android malware: A multimodal fusion method with fine-grained feature. Information Fusion, 114, 102662. https://doi.org/10.1016/j.inffus.2024.102662
Li, X., Liu, L., Liu, Y., Zhao, Y., Zhang, P., & Liu, H. (2025). Multimodal fusion for Android malware detection based on large pre-trained models. IEEE Transactions on Software Engineering. IEEE.
Liang, P. P., Deng, Z., Ma, M. Q., Zou, J. Y., Morency, L. P., & Salakhutdinov, R. (2023). Factorized contrastive learning: Going beyond multi-view redundancy. Advances in Neural Information Processing Systems, 36, 32971-32998.
Liang, P. P., Zadeh, A., & Morency, L. P. (2024). Foundations & trends in multimodal machine learning: Principles, challenges, and open questions. ACM Computing Surveys, 56(10), Article 264. https://doi.org/10.1145/3656580
Liang, V. W., Zhang, Y., Kwon, Y., Yeung, S., & Zou, J. Y. (2022). Mind the gap: Understanding the modality gap in multi-modal contrastive representation learning. Advances in Neural Information Processing Systems, 35, 17612-17625.
Liu, Y., Ott, M., Goyal, N., Du, J., Joshi, M., Chen, D., Levy, O., Lewis, M., Zettlemoyer, L., & Stoyanov, V. (2019). RoBERTa: A robustly optimized BERT pretraining approach. arXiv preprint arXiv:1907.11692.
Microsoft. (2025). How Microsoft names malware - Unified security operations. https://learn.microsoft.com/en-us/unified-secops-platform/malware-naming
Mohammed, T. M., Nataraj, L., Chikkagoudar, S., Chandrasekaran, S., & Manjunath, B. S. (2021). Malware detection using frequency domain-based image visualization and deep learning. arXiv preprint arXiv:2101.10578.
National Security Agency. (2019). Ghidra [GitHub repository]. GitHub. https://github.com/NationalSecurityAgency/ghidra
Onwuzurike, L., Mariconti, E., Andriotis, P., Cristofaro, E. D., Ross, G., & Stringhini, G. (2019). MaMaDroid: Detecting Android malware by building Markov chains of behavioral models (extended version). ACM Transactions on Privacy and Security, 22(2), Article 14. https://doi.org/10.1145/3313391
Pawłowski, M., Wróblewska, A., & Sysko-Romańczuk, S. (2023). Effective techniques for multimodal data fusion: A comparative analysis. Sensors, 23(5), Article 2381. https://doi.org/10.3390/s23052381
Poklukar, P., Vasco, M., Yin, H., Melo, F. S., Paiva, A., & Kragic, D. (2022). Geometric multimodal contrastive representation learning. In International Conference on Machine Learning (pp. 17782-17800). PMLR.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., & Sutskever, I. (2021). Learning transferable visual models from natural language supervision. In International Conference on Machine Learning (pp. 8748-8763). PMLR.
Sun, C., Myers, A., Vondrick, C., Murphy, K., & Schmid, C. (2019). VideoBERT: A joint model for video and language representation learning. In 2019 IEEE/CVF International Conference on Computer Vision (pp. 7463-7472). IEEE Computer Society. https://doi.org/10.1109/ICCV.2019.00756
Tsai, Y. H. H., Liang, P. P., Zadeh, A., Morency, L. P., & Salakhutdinov, R. (2018). Learning factorized multimodal representations. arXiv preprint arXiv:1806.06176.
Ucci, D., Aniello, L., & Baldoni, R. (2019). Survey of machine learning techniques for malware analysis. Computers & Security, 81, 123-147. https://doi.org/10.1016/j.cose.2018.11.001
VirusTotal. (2025). VirusTotal - Home. https://www.virustotal.com/gui/home/upload
Wong, G. W., Huang, Y. T., Guo, Y. R., Sun, Y., & Chen, M. C. (2023). Attention-based API locating for malware techniques. IEEE Transactions on Information Forensics and Security, 19, 1199-1212.
Wu, D., Zhao, Y., Tsai, Y. H. H., Yamada, M., & Salakhutdinov, R. (2018). "Dependency bottleneck" in auto-encoding architectures: An empirical study. arXiv preprint arXiv:1802.05408.
Yoon, J., Kang, C., Kim, S., & Han, J. (2022). D-vlog: Multimodal vlog dataset for depression detection. Proceedings of the AAAI Conference on Artificial Intelligence, 36(11), 12226-12234. https://doi.org/10.1609/aaai.v36i11.21483
Zhao, F., Zhang, C., & Geng, B. (2024). Deep multimodal data fusion. ACM Computing Surveys, 56(9), Article 216. https://doi.org/10.1145/3649447 |
| 描述: | 碩士
國立政治大學
資訊管理學系
112356046 |
| 資料來源: | http://thesis.lib.nccu.edu.tw/record/#G0112356046 |
| 資料類型: | thesis |
| 顯示於類別: | [資訊管理學系] 學位論文
|
文件中的檔案:
| 檔案 |
描述 |
大小 | 格式 | 瀏覽次數 |
|---|
| 604601.pdf | | 3067Kb | Adobe PDF | 0 | 檢視/開啟 |
|
在政大典藏中所有的資料項目都受到原著作權保護.
|
