Virus detection model training method and device, and storage medium

Abstract

The application discloses a virus detection model training method and device and a storage medium, relates to the computer field, and is used for realizing accurate detection of a Mirai virus. The method comprises the following steps: acquiring a plurality of executable files, determining a first function call graph in the plurality of function call graphs, and determining at least one second function with a function symbol similarity to the first function greater than a first threshold value; determining a third function with the greatest function symbol similarity to the first function in the at least one second function; adding function attribute information of the third function to the first function call graph as attribute information of the first function, and determining a second function call graph; comparing function information in the second function call graph with function information in a virus database, and determining whether the executable file corresponding to the first function call graph is a virus file; and if yes, training a virus detection model based on the second function call graph. Embodiments of the application are applied to the process of virus detection.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to a virus detection model training method, device, and storage medium. Background Art

[0002] With the development of Internet technology, IoT devices have become widely used. However, the security protection measures of IoT devices are not perfect, which has led to the Mirai virus invading a large number of IoT devices.

[0003] The source code of the Mirai virus is open source and is presented in the form of a binary executable file. This makes the Mirai virus prone to rapid evolution. During the evolution of the Mirai virus, the function names and some symbolic information of the functions in the Mirai virus may be deleted, making it difficult to accurately detect the Mirai virus.

[0004] Therefore, how to accurately detect the Mirai virus in IoT devices is a technical problem that needs to be solved urgently. Summary of the Invention

[0005] This application provides a virus detection model training method, device, and storage medium for accurately detecting the Mirai virus.

[0006] To achieve the above objectives, this application adopts the following technical solutions:

[0007] In a first aspect, the present application provides a virus detection model training method, comprising a virus detection model training device obtaining multiple executable files, each of the multiple executable files including at least one function; the virus detection model training device determining multiple function call graphs based on the multiple executable files; one executable file corresponds to one function call graph; the virus detection model training device determining a first function call graph among the multiple function call graphs, the first function call graph being a first function including missing function attribute information; the virus detection model training device determining at least one second function among multiple functions of the multiple executable files whose function symbol similarity with the first function is greater than a first threshold; the virus detection model training device determining a third function among at least one second function whose function symbol segment is most similar to the first function; the function symbol segment includes at least one function symbol; the virus detection model training device adding the function attribute information of the third function as the attribute information of the first function to the first function call graph to determine the second function call graph; the virus detection model training device comparing the function information in the second function call graph with the function information in the virus database to determine whether the executable file corresponding to the first function call graph is a virus file, and if so, training the virus detection model based on the second function call graph.

[0008] With reference to the first aspect, in a possible implementation manner, the method further includes: the virus detection model training apparatus aligns the function symbol of the first function with function symbols of each function in the plurality of executable files according to a BLAST algorithm to determine function symbol similarity of the first function and each function; the function symbol includes: a category of the function symbol and a quantity of the function symbol, and the category of the function symbol corresponds to the quantity of the function symbol in a one-to-one manner; and the virus detection model training apparatus selects at least one second function from the plurality of functions of the plurality of executable files, and the function symbol similarity of the at least one second function and the first function is greater than a first threshold.

[0009] With reference to the first aspect, in a possible implementation manner, the method further includes: the virus detection model training apparatus aligns the function symbol segment in the first function with function symbol segments of the at least one second function according to a Smith-Waterman algorithm to determine function symbol segment similarity of the first function and each second function; and the virus detection model training apparatus selects a third function from the at least one second function, and the function symbol segment similarity of the third function and the first function is the greatest.

[0010] With reference to the first aspect, in a possible implementation manner, the method further includes: the virus detection model training apparatus obtains a number of times that each function in the M functions is called by preceding and subsequent functions; the virus detection model training apparatus deletes N functions with the least number of times of being called by the preceding and subsequent functions in the second function call graph to obtain a third function call graph; N is less than M, and N is a positive integer; and the virus detection model training apparatus inputs functions in the third function call graph into an initial network model for training based on machine learning of a support vector machine (SVM) to determine the virus detection model.

[0011] In a second aspect, an embodiment of the present application provides a virus detection model training apparatus, the apparatus comprising: an acquisition unit configured to acquire a plurality of executable files, each executable file in the plurality of executable files comprising at least one function; a processing unit configured to determine a plurality of function call graphs based on the plurality of executable files, one executable file corresponding to one function call graph; the processing unit is further configured to determine a first function call graph in the plurality of function call graphs, the first function call graph comprising a first function with missing function attribute information; the processing unit is further configured to determine at least one second function in the plurality of functions of the plurality of executable files, the at least one second function having a function symbol similarity to the first function greater than a first threshold; the processing unit is further configured to determine a third function in the at least one second function, the third function having a greatest function symbol segment similarity to the first function; the function symbol segment comprises at least one function symbol; the processing unit is further configured to add function attribute information of the third function to the first function call graph as attribute information of the first function, and determine a second function call graph; the processing unit is further configured to compare function information in the second function call graph with function information in a virus database, and determine whether the executable file corresponding to the first function call graph is a virus file; and the processing unit is further configured to train a virus detection model based on the second function call graph if the executable file corresponding to the first function call graph is the virus file.

[0012] With reference to the second aspect above, in a possible implementation, the processing unit is further configured to: determine a function symbol similarity between the function symbol of the first function and a function symbol of each function in the plurality of executable files according to a BLAST algorithm; the function symbol comprises: a function symbol category and a function symbol quantity, the function symbol category corresponding to the function symbol quantity one by one; and select at least one second function from the plurality of functions of the plurality of executable files, the at least one second function having a function symbol similarity to the first function greater than a first threshold.

[0013] With reference to the second aspect above, in a possible implementation, the processing unit is further configured to: determine a function symbol segment similarity between the function symbol segment of the first function and a function symbol segment of each second function according to a Smith-Waterman algorithm; and select a third function from the at least one second function, the third function having a greatest function symbol segment similarity to the first function.

[0014] In combination with the above-mentioned second aspect, in a possible implementation method, the second function call graph includes M functions, where M is a positive integer; the acquisition unit is further used to: obtain the number of times each function in the M functions is called by the previous and next functions; the processing unit is further used to: delete the N functions with the least number of times called by the previous and next functions in the second function call graph to obtain a third function call graph; wherein N is less than M and is a positive integer; based on machine learning of support vector machine (SVM), the functions in the third function call graph are input into the initial network model for training to determine the virus detection model.

[0015] In a third aspect, an embodiment of the present application provides a virus detection model training device, which includes: a processor and a memory; wherein the memory is used to store computer execution instructions, and when the virus detection model training device is running, the processor executes the computer execution instructions stored in the memory, so that the virus detection model training device performs the virus detection model training method described in any possible implementation method of the first aspect.

[0016] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores instructions. When the instructions in the computer-readable storage medium are executed by a processor of a virus detection model training device, the virus detection model training device can execute the virus detection model training method described in any possible implementation of the first aspect.

[0017] These and other aspects of the present application will become more readily apparent from the following description.

[0018] The above solution provides at least the following beneficial effects: In the embodiments of the present application, in the prior art, during the evolution of the Mirai virus, function names and partial symbolic information within the Mirai virus are often deleted, resulting in some functions lacking function attribute information, which can prevent virus detection software from timely and accurately detecting the Mirai virus. Compared to the prior art, in the embodiments of the present application, first, because functions within the Mirai virus may lack function attribute information, the virus detection model training device identifies the first function lacking function attribute information from the function call graph generated by the executable file and verifies whether the executable file corresponding to the first function is a virus file. This allows for targeted function detection, improving the efficiency of Mirai virus detection. Second, because the multiple executable files to which the first function belongs may contain a third function that is most similar to the first function and has complete function attribute information, the virus detection model training device adds the attribute information of the third function as the attribute information of the first function to the first function call graph, thereby accurately restoring the portion of the first function that lacks function attribute information.

[0019] In addition, in the process of restoring the missing function information of the first function, the virus detection model training apparatus determines at least one second function in the plurality of functions of the plurality of executable files, which has a function symbol similarity greater than a first threshold with the first function; the virus detection model training apparatus selects a third function from the at least one second function, so as to perform hierarchical search on the third function, thereby improving the efficiency of restoring the missing function information of the first function. Furthermore, the virus detection model training apparatus can perform virus detection on the corresponding executable file of the first function whose missing function information is restored, thereby improving the detection efficiency. Finally, for the executable file belonging to the virus, the virus detection model is trained to facilitate the subsequent detection speed of the virus, thereby achieving accurate detection of the Mirai virus in the Internet of Things device. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0021] Figure 1 A schematic diagram of a virus detection model detection system provided by an embodiment of the present application;

[0022] Figure 2 A structural schematic diagram of a virus detection model training apparatus provided by an embodiment of the present application;

[0023] Figure 3 A flowchart of a virus detection model training method provided by an embodiment of the present application;

[0024] Figure 4 A flowchart of a virus detection model training method provided by an embodiment of the present application;

[0025] Figure 5 A flowchart of a virus detection model training method provided by an embodiment of the present application;

[0026] Figure 6 A flowchart of a virus detection model training method provided by an embodiment of the present application;

[0027] Figure 7 A structural schematic diagram of another virus detection model training apparatus provided by an embodiment of the present application. DETAILED DESCRIPTION

[0028] The term "and / or", used in the present application, only describes the association relationship of the associated objects, and indicates that there can be three relationships, for example, A and / or B can represent the three cases of A alone, A and B together, and B alone.

[0029] The terms "first" and "second" and the like in the description of the present application and the drawings are used to distinguish different objects or to distinguish different treatments of the same object, and are not used to describe the specific order of the objects.

[0030] In addition, the terms "include" and "have" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but can optionally include other steps or units not listed, or can optionally include other steps or units inherent to the process, method, product or device.

[0031] It should be noted that in the embodiments of the present application, the words "exemplary" or "for example" are used to represent an example, illustration or description. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the words "exemplary" or "for example" are intended to present the relevant concept in a specific manner.

[0032] In the description of the present application, the meaning of "a plurality of" is two or more, unless otherwise specified.

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the terms in the embodiments of the present application will be explained below.

[0034] 1、Embedded device

[0035] An embedded device is a special computer system used to build an embedded system. IEEE (Institute of Electrical and Electronics Engineers) defines an embedded device as a device used to control, monitor or assist the operation of machines and devices.

[0036] 2、Internet of things (IOT)

[0037] IOT is a network that enables all ordinary physical objects that can be independently addressed to interconnect and interoperate based on information carriers such as the Internet, broadcast television networks, and traditional telecommunications networks. IOT has important features such as ordinary object device, autonomous terminal interconnection, and intelligent ubiquitous service.

[0038] 3、DDoS

[0039] A Distributed Denial of Service (DDoS) attack is a malicious act that disrupts the normal traffic of a target server, service, or network by flooding it with massive Internet traffic. DDoS attacks use multiple compromised computer systems as sources of attack traffic to achieve attack effects. The machines exploited by DDoS include computers, other networked resources (such as IoT devices).

[0040] 4. Mirai virus

[0041] The Mirai virus is a malware that turns IOT devices into remotely controllable devices by remotely controlling them, thus making them part of a botnet, which enables large-scale distributed denial of service attacks. It mainly targets network consumer devices such as IP cameras and home routers Mirai botnet. The Mirai virus was first discovered in August 2016 by the MalwareMustDie research group.

[0042] 5. Function call graph

[0043] A function call graph is a control flow graph that represents the calling relationships between subroutines in a computer program. Each node in the function call graph represents a process, and each edge (f, g) represents a process f calling a process g. Therefore, a cycle in the graph represents a recursive process call.

[0044] 6. Graph kernel

[0045] In structural mining, a graph kernel is a kernel function that computes an inner product on graphs. Graph kernels can be intuitively understood as functions that measure the similarity of graphs. Graph kernels allow kernelized learning algorithms (such as support vector machines) to work directly on graphs without the need for feature extraction to convert them into fixed-length real-valued feature vectors. Graph kernels have applications in bioinformatics, cheminformatics (as a kind of molecular kernel), and social network analysis.

[0046] 7. Support vector machine

[0047] In machine learning, a support vector machine (SVM, also known as support vector network) is a supervised learning model with related learning algorithms that analyze data for classification and regression analysis. Vladimir Vapnik and colleagues developed SVM at AT&T Bell Labs (Boser et al. 1992, Guyon et al. 1993, Vapnik et al. 1997). SVM is one of the most robust prediction methods, based on the learning framework or VC theory proposed by Vapnik (1982, 1995) and Chervonenkis (1974). Given a set of training examples, each marked as belonging to one of two categories, an SVM training algorithm builds a model that assigns new examples into one category or the other, making it a non-probabilistic binary linear classifier (although Platt exists to scale to use SVM in a probabilistic classification setting). SVM maps training examples into points in space, maximizing the width of the gap between the two categories. New examples are then mapped into that same space and predicted to belong to a category on which side of the gap they fall.

[0048] 8. Basic Local Alignment Search Tool (BLAST)

[0049] In bioinformatics, BLAST is an algorithm and program used to compare primary biological sequence information, such as amino acid sequences of proteins or nucleotides of DNA and / or RNA sequences. BLAST searches enable researchers to compare a subject protein or nucleotide sequence (called a query) to a library or database of sequences and identify database sequences that are similar to the query sequence above a certain threshold. For example, after discovering a previously unknown gene in mice, scientists will typically perform a BLAST search on the human genome to see if humans carry a similar gene; BLAST will identify sequences in the human genome similar to the mouse gene based on sequence similarity.

[0050] 9. Shortest Path

[0051] In graph theory, the shortest path problem is the problem of finding a path between two vertices (or nodes) in a graph such that the sum of the weights of its constituent edge is minimized. The problem of finding the shortest path between two intersections on a road map can be modeled as a special case of the shortest path problem in graphs, where vertices correspond to intersections and edges correspond to road segments, each with a length that includes a weighted component.

[0052] The above is an explanation of the noun, and next, the prior art of the embodiments of the present application is introduced.

[0053] With the development of Internet technology, Internet of Things devices begin to be widely used. However, the security protection measures of Internet of Things devices are not perfect, resulting in a large number of Mirai viruses invading Internet of Things devices.

[0054] The source code of the Mirai virus is open source, embodied in the form of a binary executable file, which makes the Mirai virus easy to evolve quickly. In the evolution process of the Mirai virus, the function name and part of the symbol information in the Mirai virus may be deleted, thereby making it difficult to accurately detect the Mirai virus.

[0055] In addition, since the Internet of Things ecosystem is applied to various architectures (such as MIPS, ARM), it is also difficult for experts to directly develop rules to produce a unified detection method.

[0056] Part of the code segment in the Mirai malicious sample is composed of statically linked standard library functions, and the remaining part is composed of custom functions. However, it is very difficult to directly restore the symbol information. In related technologies, rules or machine learning-based methods are used to restore type information, but there is no satisfactory result.

[0057] Therefore, how to detect the Mirai virus in the Internet of Things device is a technical problem that needs to be solved at present.

[0058] In order to solve the technical problems in the related art, the virus detection model training method provided in the embodiments of the present application includes the following steps: a virus detection model training device obtains a plurality of executable files, each executable file in the plurality of executable files including at least one function; the virus detection model training device determines a plurality of function call graphs based on the plurality of executable files; one executable file corresponds to one function call graph; the virus detection model training device determines a first function call graph in the plurality of function call graphs, the first function call graph being a first function including missing function attribute information; the virus detection model training device determines at least one second function in the plurality of functions of the plurality of executable files, the function symbol similarity of the at least one second function to the first function being greater than a first threshold; the virus detection model training device determines a third function in the at least one second function, the function symbol segment similarity of the third function to the first function being the greatest; the function symbol segment includes at least one function symbol; the virus detection model training device adds the function attribute information of the third function to the first function as the attribute information of the first function in the first function call graph, and determines a second function call graph; the virus detection model training device compares the function information in the second function call graph with the function information in a virus database, and determines whether the executable file corresponding to the first function call graph is a virus file, and if so, trains a virus detection model based on the second function call graph.

[0059] In the prior art, during the evolution of the Mirai virus, the function names and some of the function's symbolic information in the Mirai virus are often deleted, resulting in some functions that lack function attribute information, which in turn prevents virus detection software from timely and accurately detecting the Mirai virus. Compared to the prior art, in the embodiments of the present application, first, because the functions in the Mirai virus may lack function attribute information, the virus detection model training device determines the first function that lacks function attribute information from the function call graph generated by the executable file, and verifies whether the executable file corresponding to the first function is a virus file. In this way, functions can be detected in a targeted manner, improving the efficiency of detecting the Mirai virus. Secondly, because the multiple executable files to which the first function belongs may contain a third function that is most similar to the first function and has complete function attribute information, the virus detection model training device adds the attribute information of the third function as the attribute information of the first function to the first function call graph. In this way, the portion of the first function that lacks function information can be accurately restored.

[0060] Furthermore, during the process of restoring the missing function information of the first function, the virus detection model training device identifies at least one second function from multiple functions in multiple executable files whose function symbol similarity with the first function is greater than a first threshold. The virus detection model training device then selects a third function from the at least one second function. This hierarchical search for the third function improves the efficiency of restoring the missing function information of the first function. Furthermore, the virus detection model training device can perform virus detection on the executable file corresponding to the first function whose missing function information has been restored, thereby improving detection efficiency. Finally, for executable files that are viruses, training a virus detection model facilitates subsequent virus detection and achieves accurate detection of the Mirai virus in IoT devices.

[0061] The virus detection model training method can be applied to the virus detection model detection system. Figure 1 A virus detection model detection system provided in an embodiment of the present application is described in detail. Figure 1 As shown, the virus detection model detection system includes: a function preparation unit 11, a virus detection model training device 12, and a virus detection device 13.

[0062] The function preparation unit 11 is configured to obtain multiple executable files and send the multiple executable files to the virus detection model training device 12.

[0063] The virus detection model training device 12 includes a function processing unit 121 and a model training module 122 .

[0064] The function processing unit 121 includes: an architecture identification unit 1211 , a function call graph generation unit 1212 , a function restoration unit 1213 , and a function pruning unit 1214 .

[0065] The architecture identification unit 1211 is configured to identify the architecture of the executable file, where the architecture domain includes MIPS architecture and ARM architecture.

[0066] The function call graph generating unit 1212 is configured to determine a plurality of function call graphs based on a plurality of executable files.

[0067] The function restoration unit 1213 is configured to: determine a third function among the functions in the multiple function call graphs, which has the greatest similarity with the function symbol segment of the first function, and add the function attribute information of the third function as the attribute information of the first function to the first function call graph.

[0068] The function pruning unit 1214 is configured to delete N functions in the second function call graph that are called the least number of times by the previous and subsequent functions, to obtain a third function call graph.

[0069] The model training module 122 is configured to: determine the function execution flow in the third function call graph through the Shortest Path method, input the functions in the third function call graph into the initial network model for training based on machine learning of the support vector machine (SVM), and determine the virus detection model.

[0070] The virus detection device 13 is configured to verify whether the target executable file is a virus file based on the virus detection model and the target executable file.

[0071] The basic hardware structure of the virus detection model training device in the virus detection model training system includes Figure 2 The components included in the virus detection model training device 200 are shown below. Figure 2 Taking the virus detection model training device 200 shown as an example, the hardware structure of the virus detection model training device 200 is introduced.

[0072] like Figure 2 As shown, the virus detection model training device 200 includes at least one processor 201, a communication line 202, and at least one communication interface 204, and may also include a memory 203. The processor 201, the memory 203 and the communication interface 204 may be connected via the communication line 202.

[0073] The processor 201 can be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to perform the operations of the embodiments of the present application, such as one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs).

[0074] The communication line 202 can include a path for transmitting information between the components described above.

[0075] The communication interface 204, which is configured to communicate with other devices or communication networks, can use any transceiver device, such as an Ethernet, a radio access network (RAN), a WLAN, and the like.

[0076] The memory 203 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, a magnetic disk storage or other magnetic storage devices, or any other medium capable of storing desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.

[0077] In a possible design, the memory 203 can exist independently of the processor 201, that is, the memory 203 can be an external memory of the processor 201, and the memory 203 can be connected to the processor 201 through the communication line 202, used to store execution instructions or application program codes, and controlled by the processor 201 to perform, to implement the virus detection model training method provided in the embodiments of the present application. In another possible design, the memory 203 can also be integrated with the processor 201, that is, the memory 203 can be an internal memory of the processor 201, for example, the memory 203 is a cache, and can be used to temporarily store some data and instruction information and the like.

[0078] As a possible implementation manner, the processor 201 can include one or more CPUs, for example, the CPUs 0 and 1 in FIG. 1. Figure 2 As another possible implementation manner, the virus detection model training apparatus 200 can include multiple processors, for example, the processors 201 and 207 in FIG. 1. Figure 2 As still another possible implementation manner, the virus detection model training apparatus 200 can further include an output device 205 and an input device 206.

[0079] The virus detection model training method provided in the embodiments of the present application will be described in detail below, in combination with the accompanying drawings. Figure 3 As shown in FIG. 1, the virus detection model training method includes the following steps. Figure 3

[0080] S301, the virus detection model training apparatus acquires a plurality of executable files.

[0081] Each of the plurality of executable files includes at least one function.

[0082] Optionally, the plurality of executable files include Mirai samples and Benign samples.

[0083] In a possible implementation manner, the virus detection model training apparatus acquires the Mirai samples from an online virus analysis platform, and acquires the Benign samples from an operating system of Linux and a software package of GNU, so as to ensure that the data of the executable files are non-threatening.

[0084] For example, as shown in Table 1, the virus detection model training apparatus acquires 12091 Mirai samples with signed information of MIPS architecture from the online virus analysis platform, acquires 6672 Mirai samples without signed information of MIPS architecture from the online virus analysis platform, acquires 21330 Mirai samples with signed information of ARM architecture from the online virus analysis platform, and acquires 7363 Mirai samples without signed information of ARM architecture from the online virus analysis platform.​

[0085] For example, as shown in Table 1, the virus detection model training apparatus obtains 4167 Benign samples of MIPS architecture unsigned information from the Linux operating system and the GNU software package; and obtains 1025 Benign samples of ARM architecture unsigned information from the Linux operating system and the GNU software package.

[0086] Table 1, executable file information

[0087]

[0088]

[0089] S302, the virus detection model training apparatus determines a plurality of function call graphs based on a plurality of executable files.

[0090] Each executable file corresponds to a function call graph.

[0091] In one possible implementation, the virus detection model training apparatus generates a control flow graph based on the executable file through the angr software, and the control flow graph is used to represent the calling relationship between functions. The virus detection model training apparatus obtains the entry and jump point of the function at the assembly language level through the disassembly tool, and generates the function call graph corresponding to the executable file according to the calling relationship between functions, the entry of the function, and the jump point.

[0092] It should be explained that, because executable files of different architectures are different after backend optimization, a unified analysis tool cannot be used to analyze the executable files. In order to solve the above problem, in the related art, an intermediate representation (IR) is set to avoid the difference between executable files of different architectures caused by backend optimization in a cross-architecture scenario, and to realize unified analysis of the analysis tool. However, because of the defects of low accuracy and information loss in the process of intermediate representation conversion in the related art, the accuracy of the analysis tool in analyzing the executable files is seriously reduced. Therefore, the virus detection model training apparatus in the embodiments of the present application identifies the type of the architecture of the executable file, and generates a binary file according to the type of the architecture.

[0093] Optionally, the virus detection model training apparatus compiles executable files of different architectures into binary files based on the open source standard library of C language, and generates a control flow graph through the angr software. The functions in the control flow graph are represented by binary, and the virus detection model training apparatus obtains the name of the custom function through the malware binary file containing the symbol information.

[0094] It needs to be explained that since each function is composed of a plurality of instructions, each instruction includes an operator and an operand, and the semantics of the instruction is mainly concentrated on the operator, therefore, the virus detection model training apparatus reduces the complexity of the instruction by deleting the operand to simplify the instruction.

[0095] Optionally, the virus detection model training apparatus classifies the operators according to the semantic similarity of the operators.

[0096] Illustratively, the virus detection model training apparatus uses M to represent MOV, MOVS, and MVN in the MOV-class operator, and uses B to represent the JMP-class (jump type) operator.

[0097] S303, the virus detection model training apparatus determines a first function call graph in the plurality of function call graphs.

[0098] Among them, the first function call graph is a first function including missing function attribute information.

[0099] Optionally, the function attribute information includes the name of the function and the function symbol information.

[0100] It needs to be explained that in the related art, in the evolution process of the Mirai virus, the function name and part of the symbol information of the function in the Mirai virus may be deleted to obtain some functions with missing function attribute information. Therefore, the virus detection model training apparatus finds all the first functions with missing function attribute information, facilitates the subsequent restoration of the missing function attribute information of the first function, and determines whether the executable file corresponding to the first function is a virus file.

[0101] S304, the virus detection model training apparatus determines at least one second function in the plurality of functions of the plurality of executable files, the function symbol similarity of which with the first function is greater than a first threshold.

[0102] In one possible implementation, the virus detection model training apparatus obtains the category of the function symbol of the plurality of functions of the plurality of executable files and the number of function symbols corresponding to the category of the function symbol, compares the number of function symbols corresponding to the category of the function symbol of the plurality of functions of the plurality of executable files with the number of function symbols corresponding to the category of the function symbol of the first function, determines the function symbol similarity of each function in the plurality of executable files with the first function, and selects at least one second function with a similarity greater than a first threshold.

[0103] S305, the virus detection model training apparatus determines a third function in the at least one second function, the function symbol segment similarity of which with the first function is the greatest.

[0104] The function symbol section includes at least one function symbol.

[0105] In S306, the virus detection model training apparatus adds the function attribute information of the third function to the first function call graph as the attribute information of the first function, and determines the second function call graph.

[0106] In a possible implementation, the virus detection model training apparatus compares the function attribute information of the third function with the attribute information of the first function, determines the function attribute information missing in the first function, and adds the function attribute information missing in the first function to the first function in the first function call graph to determine the second function call graph.

[0107] In S307, the virus detection model training apparatus compares the function information in the second function call graph with the function information in the virus database, and determines whether the executable file corresponding to the first function call graph is a virus file.

[0108] In a possible implementation, if the virus detection model training apparatus finds the function information in the second function call graph in the virus database, the executable file corresponding to the first function call graph is a virus file; if the virus detection model training apparatus does not find the function information in the second function call graph in the virus database, the executable file corresponding to the first function call graph is a non-virus file.

[0109] In S308, if yes, the virus detection model training apparatus trains the virus detection model based on the second function call graph.

[0110] In a possible implementation, the virus detection model training apparatus inputs the functions in the second function call graph into an initial network model for training based on machine learning of a support vector machine (SVM) to determine the virus detection model.

[0111] The above scheme at least has the following beneficial effects:

[0112] In the prior art, during the evolution of the Mirai virus, the function name and part of the symbol information of the function in the Mirai virus are usually deleted, obtaining a function with missing function attribute information, so that the virus detection software cannot timely and accurately detect the Mirai virus. Compared with the prior art, in the embodiment of the present application, first, since the function in the Mirai virus may be a function with missing function attribute information, the virus detection model training apparatus determines a first function with missing function attribute information from the function call graph generated by the executable file, and verifies whether the executable file corresponding to the first function is a virus file. In this way, the function can be detected specifically, and the efficiency of detecting the Mirai virus is improved. Secondly, since the first function belongs to a plurality of executable files, there may be a third function with complete function attribute information that is most similar to the first function. Therefore, the virus detection model training apparatus adds the attribute information of the third function to the first function call graph as the attribute information of the first function, so that the part of the missing function information of the first function can be accurately restored.

[0113] In addition, in the process of restoring the missing function information of the first function, the virus detection model training apparatus determines at least one second function with a function symbol similarity greater than a first threshold from a plurality of functions of a plurality of executable files; the virus detection model training apparatus selects a third function from the at least one second function, so that the third function is found in stages, and the efficiency of restoring the missing function information of the first function is improved. Furthermore, the virus detection model training apparatus can perform virus detection on the corresponding executable file of the first function with the missing function information restored, and the detection efficiency is improved. Finally, for the executable file belonging to the virus, the virus detection model is trained to facilitate the speed of subsequent virus detection, and the Mirai virus in the Internet of Things device is accurately detected.

[0114] In combination Figure 3 As Figure 4 shown, the process of determining at least one second function with a function symbol similarity greater than a first threshold from a plurality of functions of a plurality of executable files by the virus detection model training apparatus can be implemented by the following S401-S403.

[0115] S401, the virus detection model training apparatus compares the function symbol of the first function with the function symbol of each function in the plurality of executable files according to the BLAST algorithm.

[0116] The function symbol includes: the category of the function symbol and the number of the function symbol, and the category of the function symbol and the number of the function symbol are one-to-one correspondence.

[0117] It should be noted that in bioinformatics, the Basic Local Alignment Search Tool (BLAST) is an algorithm and program used to compare primary biological sequence information. This application is based on the BLAST algorithm in bioinformatics. The virus detection model training device improves the BLAST algorithm and applies the improved BLAST algorithm to function mapping for missing function symbol information, quickly finding functions similar to the first function.

[0118] In bioinformatics, the BLAST algorithm supports queries on raw DNA nucleotide sequences (i.e., a total of four elements: A, T, C, and G) and protein sequences, supporting a limited number of bases or nucleotides (20 in total). The improved BLAST algorithm, implemented in the virus detection model training device, now supports 26 elements, mapping function names after instruction simplification. BLAST queries in bioinformatics use index seeds, corresponding to simplified instruction sequences. The virus detection model training device uses single instruction, multiple data (SIMD) to increase the speed of index seed reading.

[0119] It should be explained that before comparing the function symbol of the first function with the function symbols of each function in the multiple executable files, the virus detection model training device parses each function in the multiple executable files to obtain the category and number of function symbols for each function. Furthermore, the virus detection model training device constructs a first memory pool based on the category and number of function symbols for each function. The first memory pool includes a target function, the category of the function symbol corresponding to the target function, and the number of function symbols in that category.

[0120] In one possible implementation, the virus detection model training device inputs the category and number of function symbols of the first function into the BLAST query software, and compares the function symbol of the first function with the function symbol of each function in multiple executable files in the first memory pool.

[0121] Optionally, the virus detection model training device inputs the categories and function symbols of multiple function symbols into a separate thread pool.

[0122] S402: The virus detection model training apparatus determines the function symbol similarity between the first function and each function.

[0123] Illustratively, the similarity between the first function and function A is 80%; the similarity between the first function and function B is 90%; the similarity between the first function and function C is 63%; and the similarity between the first function and function D is 75%.

[0124] S403: The virus detection model training apparatus selects at least one second function from multiple functions of multiple executable files, the second function having a function symbol similarity with the first function greater than a first threshold.

[0125] Exemplarily, when the first threshold is 68%, since function A, function B, and function D are all greater than the first threshold, at least one second function includes: function A, function B, and function D; since function C is less than the first threshold, at least one second function does not include: function C.

[0126] The above solution provides at least the following beneficial effects: In the embodiment of the present application, the virus detection model training device uses the BLAST algorithm to quickly and accurately search for multiple second functions that are similar in function sign to the first function, thereby improving the efficiency of matching queries. Because the function sign similarity between the second function and the first function is greater than the first threshold, the search range for the function most similar to the first function is narrowed.

[0127] Combine Figure 3 ,like Figure 5 As shown, the process of the virus detection model training apparatus determining the third function in at least one second function that has the greatest similarity to the function symbol segment of the first function can be specifically implemented through the following S501-S503.

[0128] S501. The virus detection model training device compares a function symbol segment in a first function with a function symbol segment of at least one second function according to the Smith-Waterman algorithm.

[0129] In one possible implementation, the virus detection model training device treats the function symbol segments composed of the same function symbols in the first function as the same function symbol segment. In this way, when the virus detection model training device compares function symbol segments with multiple identical function symbols, it only needs to compare any one of them, thereby reducing the number of comparisons performed by the virus detection model training device and improving the comparison efficiency.

[0130] S502: The virus detection model training apparatus determines the similarity between the function symbol segments of the first function and each second function.

[0131] Exemplarily, the similarity between the function symbol segment m in the first function and the function segment a in function A is 95%; the similarity between the function symbol segment m in the first function and the function segment b in function B is 95.6%; and the similarity between the function symbol segment m in the first function and the function segment d in function D is 94%.

[0132] S503: The virus detection model training apparatus selects a third function from the at least one second function, which has the greatest similarity to the function symbol segment of the first function.

[0133] In a possible implementation, the virus detection model training apparatus queries the third function from the second memory pool through an SSE4 (Streaming SIMD Extensions 4) matrix parallel instruction.

[0134] It should be noted that the SSE4 is used to accelerate reading and writing of matrix data.

[0135] For example, the virus detection model training apparatus selects the function B with the largest similarity to the function symbol segment of the first function from the functions A, the function B, and the function D as the third function.

[0136] The above scheme at least has the following beneficial effects: in the embodiment of the application, the virus detection model training apparatus compares the function symbol segment in the first function with the function symbol segment of at least one second function through the Smith-Waterman algorithm. Compared with the one-by-one comparison of the function symbols of the virus in the prior art, the comparison efficiency is improved, and the third function with the largest similarity to the function symbol segment of the first function can be determined more quickly and accurately.

[0137] In a possible implementation, after S306, the second function call graph includes M functions, M is a positive integer, and the virus detection model training apparatus prunes the functions in the second function call graph. Next, the process in which the virus detection model training apparatus prunes the functions in the second function call graph is introduced. As a possible embodiment of the application, the process is introduced in combination with Figure 3 As shown in Figure 6 , the above process can be implemented through the following S601-S603.

[0138] S601, the virus detection model training apparatus obtains the number of times each function in the M functions is called by the functions before and after the function.

[0139] It should be noted that, as shown in Figure 1 , the functions in the function call graph are connected through arrows, the starting end of the arrow is the called function, and the pointing end of the arrow is the calling function.

[0140] In a possible implementation, the virus detection model training apparatus obtains the first number of functions in the M functions starting from the to-be-detected function (i.e., the function calling the to-be-detected function) and the second number of functions passing through the to-be-detected function (i.e., the function called by the to-be-detected function) from the second function call graph, and determines the number of times the current function in the M functions is called by the functions before and after the function according to the first number and the second number.

[0141] Optionally, the M functions include network communication type functions.

[0142] S602, the virus detection model training apparatus deletes N functions in the second function call graph that are called least frequently by preceding and subsequent functions, to obtain a third function call graph.

[0143] wherein N is less than M, and N is a positive integer.

[0144] It should be explained that the malicious executable files of Mirai and its variants are inconsistent with Trojans, and the functions called by the malicious executable files of Mirai and its variants are mostly high-frequency functions. Therefore, the virus detection model training apparatus deletes N functions in the second function call graph that are called least frequently by preceding and subsequent functions.

[0145] S603, the virus detection model training apparatus trains the functions in the third function call graph in an initial network model based on a support vector machine (SVM) machine learning, to determine a virus detection model.

[0146] Optionally, the virus detection model training apparatus determines a function execution flow in the third function call graph by a Shortest Path method.

[0147] The above scheme at least brings the following beneficial effects: in the embodiments of the present application, the virus detection model training apparatus prunes the functions in the second function call graph, to obtain an accurate virus detection model.

[0148] It can be seen that the above mainly introduces the technical scheme provided by the embodiments of the present application from the perspective of method. In order to realize the above functions, it contains the hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the modules and algorithm steps of the examples described in the embodiments disclosed in the present text, the embodiments of the present application can be realized in the form of hardware or the combination of hardware and computer software. Whether a certain function is executed in the form of hardware or computer software driven hardware depends on the specific application and design constraints of the technical scheme. Professional technicians can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0149] The embodiments of the present application can divide the virus detection model training apparatus into functional modules according to the above method examples, for example, each functional module can be divided according to each function, or two or more functions can be integrated in one processing module. The above integrated module can be realized in the form of hardware or software functional module. Optionally, the division of modules in the embodiments of the present application is illustrative, and is only a logical functional division. When actually implemented, there can be another division method.

[0150] As Figure 7As shown, a structural schematic diagram of a virus detection model training apparatus 70 provided by an embodiment of the present application is shown. The virus detection model training apparatus 70 comprises an acquisition unit 701 and a processing unit 702.

[0151] The acquisition unit 701 is configured to acquire a plurality of executable files, each executable file in the plurality of executable files comprising at least one function; the processing unit 702 is configured to determine a plurality of function call graphs based on the plurality of executable files; one executable file corresponds to one function call graph; the processing unit 702 is further configured to determine a first function call graph in the plurality of function call graphs, the first function call graph being a first function comprising missing function attribute information; the processing unit 702 is further configured to determine at least one second function in a plurality of functions of the plurality of executable files, the at least one second function having a function symbol similarity to the first function greater than a first threshold; the processing unit 702 is further configured to determine a third function in the at least one second function, the third function having a greatest function symbol segment similarity to the first function; the function symbol segment comprises at least one function symbol; the processing unit 702 is further configured to add function attribute information of the third function to the first function call graph as attribute information of the first function, and determine a second function call graph; the processing unit 702 is further configured to compare function information in the second function call graph with function information in a virus database, and determine whether an executable file corresponding to the first function call graph is a virus file; and the processing unit 702 is further configured to, if so, train a virus detection model based on the second function call graph.

[0152] Optionally, the processing unit 702 is further configured to: compare the function symbol of the first function with function symbols of each function in the plurality of executable files according to a BLAST algorithm, to determine function symbol similarities of the first function to each function; the function symbol comprises: a category of the function symbol and a number of the function symbol, the category of the function symbol corresponding to the number of the function symbol one by one; and select at least one second function from the plurality of functions of the plurality of executable files, the at least one second function having a function symbol similarity to the first function greater than the first threshold.

[0153] Optionally, the processing unit 702 is further configured to: compare the function symbol segment in the first function with function symbol segments of the at least one second function according to a Smith-Waterman algorithm, to determine function symbol segment similarities of the first function to each second function; and select a third function from the at least one second function, the third function having a greatest function symbol segment similarity to the first function.

[0154] Optionally, the second function call graph includes M functions, M is a positive integer; the obtaining unit 701 is further configured to: obtain the number of times each function in the M functions is called by the preceding and subsequent functions; the processing unit 702 is further configured to: delete N functions with the least number of times of being called by the preceding and subsequent functions in the second function call graph to obtain a third function call graph; wherein N is less than M, and N is a positive integer; based on the support vector machine SVM machine learning, the functions in the third function call graph are input into the initial network model for training to determine the virus detection model.

[0155] The processing unit 702 can be a processor or a controller. It can implement or execute various exemplary logical blocks, modules, and circuits described in combination with the disclosure of the present application. The processor can also be a combination of implementation functions, such as one or more microprocessor combinations, DSP and microprocessor combinations, etc. The communication unit can be a transceiver circuit or a communication interface, etc. The storage module can be a memory. When the processing unit 702 is a processor, the communication unit is a communication interface, and the storage module is a memory, the virus detection model training device involved in the embodiments of the present application can be the virus detection model training device shown in the Figure 2

[0156] Through the description of the above embodiments, those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above division of functional modules is exemplified, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the network node is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, module and network node described above can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0157] The embodiments of the present application also provide a computer readable storage medium, which stores instructions, when a computer executes the instructions, the computer executes each step in the method process shown in the foregoing method embodiments.

[0158] The embodiments of the present application also provide a chip, which includes a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to realize the virus detection model training method in the foregoing method embodiments.

[0159] The embodiments of the present application provide a computer program product containing instructions, when the instructions are run on a computer, the computer executes the virus detection model training method in the foregoing method embodiments.

[0160] ​The computer readable storage medium, for example, can be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a register, a hard disk, an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes a floppy disk, a flexible disk, an optical disk, a hard disk, a solid state drive (SSD), a magnetic tape, or a compact disk. In some embodiments of the present application, the computer readable storage medium can be a tangible medium configured to store data that is readable by a computer system. In other embodiments of the present application, the computer readable storage medium can be integral to the computer system. In another embodiment of the present application, the computer readable storage medium can be a combination of one or more of the foregoing. The computer readable storage medium can be coupled to the processor such that the processor can read information from, and write information to, the computer readable storage medium. In the alternative, the computer readable storage medium can be integral to the processor. The computer readable storage medium can be a non-transitory computer readable storage medium. The application program can be downloaded to the computer from an external computer or external storage device or to an internal storage device from an external computer or external storage device through a network, for example, the Internet, a local area network (LAN), a wide area network (WAN) such as the Internet, mobile, cellular, wireless, Bluetooth, or Wi-Fi network. For example, the application program can execute on a server that is in communication with a client computer through a network such as the Internet. The application program can pass information in the form of a data packet in conjunction with a computer readable storage medium described above. A data packet is a piece of data that is transferred from one device to another. A computer system can transmit a data packet including the application program code over a network.

[0161] Since the apparatus, device, computer readable storage medium, computer program product in the embodiments of the present application can be applied to the above-mentioned method, the technical effects that can be obtained are also referred to the above-mentioned method embodiments, which will not be described here in detail.

[0162] The above merely illustrates the specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any change or replacement within the technical scope disclosed in the present application should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A virus detection model training method, characterized in that: The method comprises: Obtaining a plurality of executable files, each of the plurality of executable files comprising at least one function; Determining a plurality of function call graphs based on the plurality of executable files; one executable file corresponds to one function call graph; Determine a first function call graph among the multiple function call graphs, the first function call graph being a first function including missing function attribute information; determining at least one second function among the plurality of functions of the plurality of executable files, the second function having a function symbol similarity with the first function greater than a first threshold; Determine a third function among the at least one second function that has the greatest similarity to a function symbol segment of the first function; the function symbol segment includes at least one function symbol; adding the function attribute information of the third function as the attribute information of the first function to the first function call graph to determine a second function call graph; comparing function information in the second function call graph with function information in a virus database to determine whether the executable file corresponding to the first function call graph is a virus file; If so, a virus detection model is trained based on the second function call graph.

2. The method according to claim 1, characterized in that The determining of at least one second function among the multiple functions of the multiple executable files, the function symbol similarity of which to the first function is greater than a first threshold, includes: Comparing the function symbol of the first function with the function symbol of each function in the plurality of executable files according to a BLAST algorithm to determine a similarity between the function symbols of the first function and each function; the function symbol includes: a category of the function symbol and a number of the function symbols, the category of the function symbol and the number of the function symbols corresponding one to one; The at least one second function whose function sign similarity with the first function is greater than the first threshold is selected from the plurality of functions in the plurality of executable files.

3. The method according to claim 2, characterized in that The determining of a third function having the greatest similarity to a function symbol segment of the first function among the at least one second function includes: comparing, according to the Smith-Waterman algorithm, the function symbol segments in the first function with the function symbol segments of the at least one second function, to determine a similarity between the function symbol segments of the first function and each of the second functions; The third function having the greatest similarity to the function symbol segment of the first function is selected from the at least one second function.

4. The method according to any one of claims 1 to 3, characterized in that The second function call graph includes M functions, where M is a positive integer; The step of training a virus detection model based on the second function call graph includes: Obtain the number of times each of the M functions is called by the previous and next functions; Delete N functions in the second function call graph that are called the least number of times by the previous and next functions, to obtain a third function call graph; wherein N is less than M and N is a positive integer; Based on support vector machine (SVM) machine learning, the functions in the third function call graph are input into an initial network model for training to determine the virus detection model.

5. A virus detection model training device, characterized in that: The device comprises: an acquisition unit and a processing unit: The acquiring unit is configured to acquire a plurality of executable files, each of the plurality of executable files including at least one function; The processing unit is configured to determine a plurality of function call graphs based on the plurality of executable files; one executable file corresponds to one function call graph; The processing unit is further configured to determine a first function call graph among the plurality of function call graphs, the first function call graph being a first function including missing function attribute information; The processing unit is further configured to determine at least one second function among the plurality of functions in the plurality of executable files, the second function having a function symbol similarity with the first function greater than a first threshold; The processing unit is further configured to determine a third function, among the at least one second function, having the greatest similarity to a function symbol segment of the first function; the function symbol segment including at least one function symbol; The processing unit is further configured to add the function attribute information of the third function as the attribute information of the first function to the first function call graph to determine a second function call graph; The processing unit is further configured to compare the function information in the second function call graph with the function information in the virus database to determine whether the executable file corresponding to the first function call graph is a virus file; The processing unit is further configured to, if yes, train a virus detection model based on the second function call graph.

6. The device according to claim 5, characterized in that The processing unit is further configured to: Comparing the function symbol of the first function with the function symbol of each function in the plurality of executable files according to the BLAST algorithm to determine the similarity between the function symbols of the first function and each function; The function symbol includes: the category of the function symbol and the number of the function symbols, and the category of the function symbol corresponds to the number of the function symbols in a one-to-one manner; The at least one second function whose function sign similarity with the first function is greater than the first threshold is selected from the plurality of functions in the plurality of executable files.

7. The device according to claim 6, characterized in that The processing unit is further configured to: comparing, according to the Smith-Waterman algorithm, the function symbol segments in the first function with the function symbol segments of the at least one second function, to determine a similarity between the function symbol segments of the first function and each of the second functions; The third function having the greatest similarity to the function symbol segment of the first function is selected from the at least one second function.

8. The device according to any one of claims 5 to 7, characterized in that: The second function call graph includes M functions, where M is a positive integer; The acquisition unit is further configured to: acquire the number of times each of the M functions is called by the preceding and following functions; The processing unit is further configured to: Delete N functions in the second function call graph that are called the least number of times by the previous and next functions, to obtain a third function call graph; wherein N is less than M and N is a positive integer; Based on support vector machine (SVM) machine learning, the functions in the third function call graph are input into an initial network model for training to determine the virus detection model.

9. A virus detection model training device, characterized in that: include: A processor and a memory; wherein the memory is used to store computer-executable instructions, and when the virus detection model training device is running, the processor executes the computer-executable instructions stored in the memory, so that the virus detection model training device performs the virus detection model training method according to any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium includes instructions, which, when executed by the virus detection model training device, enable the computer to execute the virus detection model training method according to any one of claims 1 to 4.

Images