Apparatus for generating a signature that reflects the similarity of a malware detection and classification system based on deep neural networks, method therefor, and computer-readable recording medium recorded with a program for performing the method

An apparatus for generating a signature that reflects the similarity of a malware detection and classification system, the apparatus comprising:

• a pre-processing unit configured to generate an input vector from input information which is information on a file whose malware classification is unknown;
• a classification unit configured to calculate a latent vector which indicates the similarity between at least one malware classification and the input vector by performing a plurality of computations to which learned weights of a plurality of layers are applied on the input vector through a deep neural network model;
• and a signature generation unit configured to generate a signature of the malware in a form of a binary vector by quantizing the latent vector, wherein the quantizing includes:
• setting an expected value for a learning input vector of a known malware classification;
• calculating a latent vector which indicates the similarity between the malware classification and the input vector;
• applying unlearned weights to the learning input vector and correcting the weights so that the expected value is minimized using the equation:
• L
• b
• =
• η
• ⁢
• ∑
• i
• N
• ∑
• j
• M
• 
• b
• ij
• -
• k
• 1
• ⁢
• ❘
• "\[LeftBracketingBar]"
• -
• k
• 2
• ❘
• "\[RightBracketingBar]"
• wherein, Lb is an objective function which allows a value of the latent vector to be binarized (to be brought close to ki+k2 or ki−k2), i is a ratio in which the computation result value of the objective function is reflected in weight learning, N is the number of learning input vectors, M is a length of the latent vector, i denotes the i-th among first to N-th learning input vectors, j denotes the j-th element among first to M-th elements of the latent vector, bi is a value of the j-th element of the latent vector of the i-th learning input vector, ki is the reference value, and k2 is the separation value.