The dynamic malicious code identification model based on the lambda attention mechanism

With the development of the Internet, malicious code attacks have increased exponentially, with malicious code ranking as a key threat to Internet security. The ability to detect malicious code is critical for protection against security breaches, data theft, and other dangers. In the field of dynamic malicious code detection, existing vectorization methods and model construction techniques face challenges in capturing contextual information effectively and in having long convergence times.This paper proposes a method that utilizes BERT for vectorization combined with a transformer model based on the lambda attention mechanism. We use a cloud sandbox to obtain API sequences, effectively reducing the configuration complexity of the sandbox while enhancing efficiency. We then apply the concept of the longest common subsequence to deduplicate the API sequences. The BERT model is employed to perform vectorization on the API sequences. The classification model utilizes a transformer architecture based on the lambda attention mechanism, which effectively extracts contextual semantic information from the API call sequences, resulting in improved recognition and classification performance, as well as higher training efficiency. Experiments show that our model achieves higher classification accuracy than traditional models, with an accuracy increase of 2.0% to 5.6% compared to standalone CNN or LSTM models, and an improvement of 0.4% over conventional transformer models that utilize self-attention mechanisms. The use of the lambda attention mechanism results in approximately a 70% reduction in average training time for the transformer model on our dataset compared to traditional self-attention mechanisms, effectively addressing the issue of prolonged convergence times in traditional models. Additionally, comparisons with methods from other literature validate the effectiveness and efficiency of the approach presented in this paper.