intel/malconv-model-base

Intel优化的Malconv模型镜像

镜像概述

本Docker镜像包含基于Keras API训练的Intel优化Malconv模型（H5格式）。Malconv是一种用于***PE（可执行文件）检测的卷积神经网络，其原理在论文《Malware detection by eating a whole exe.》中提出，首个开源实现由Ember项目发布。为在第4代Intel® Xeon®可扩展处理器平台（代号Sapphire Rapids）上利用Intel® Advanced Matrix Extensions (Intel® AMX)提升推理速度，本镜像中的模型在保持网络拓扑不变的前提下优化了部分超参数。

核心功能与特性

• ***PE检测能力：基于卷积神经网络架构，可对PE文件进行静态检测
• Intel硬件优化：针对Intel AMX技术优化，提升在Sapphire Rapids平台上的推理性能
• 模型格式：采用H5格式存储，兼容Keras/TensorFlow加载
• 网络拓扑保留：与原始Malconv架构一致，仅调整超参数以适配硬件加速

训练集

模型训练使用以下公开数据集：

• https://github.com/elastic/ember%EF%BC%9A%E5%BC%80%E6%BA%90%E9%9D%99%E6%80%81PE***%E6%9C%BA%E5%99%A8%E5%AD%A6%E4%B9%A0%E6%A8%A1%E5%9E%8B%E8%AE%AD%E7%BB%83%E6%95%B0%E6%8D%AE%E9%9B%86
• https://github.com/sophos/SOREL-20M%EF%BC%9A%E5%A4%A7%E8%A7%84%E6%A8%A1***PE%E6%A3%80%E6%B5%8B%E5%9F%BA%E5%87%86%E6%95%B0%E6%8D%AE%E9%9B%86

超参数配置

使用场景

• ***检测系统集成
• 静态PE文件安全分析工具
• 端点安全解决方案
• ***代码研究与教育

参考文献

Raff, Edward, et al. "Malware detection by eating a whole exe." arXiv preprint arXiv:1710.09435 (2017).

H. Anderson and P. Roth, "EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models”, in ArXiv e-prints. Apr. 2018.

@ARTICLE{2018arXiv180404637A,
  author = {{Anderson}, H.~S. and {Roth}, P.},
  title = "{EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models}",
  journal = {ArXiv e-prints},
  archivePrefix = "arXiv",
  eprint = {1804.04637},
  primaryClass = "cs.CR",
  keywords = {Computer Science - Cryptography and Security},
  year = 2018,
  month = apr,
  adsurl = {http://adsabs.harvard.edu/abs/2018arXiv180404637A},
}

@misc{harang2020sorel20m,
      title={SOREL-20M: A Large Scale Benchmark Dataset for Malicious PE Detection}, 
      author={Richard Harang and Ethan M. Rudd},
      year={2020},
      eprint={2012.07634},
      archivePrefix={arXiv},
      primaryClass={cs.CR}
}