APT attribution analysis method and system based on large model semantic transformation

Abstract

The invention relates to the technical field of computer security, in particular to an APT attribution analysis method and system based on large model semantic transformation. The big language model can mine key features of software gene information and spontaneously form association mapping of feature elements in different semantic spaces; extracting a training data set and an evaluation data set for multiple times, training and evaluating the large language model based on the training data set and the evaluation data set extracted each time, updating a hyper-parameter candidate set through a hyper-parameter adaptive selection mechanism, and taking an optimal hyper-parameter obtained after model convergence as an optimal hyper-parameter combination of the large language model; and based on the optimal hyper-parameter combination, full-amount data set task fine tuning is carried out on the large language model by using sample information, so that the large language model learns APT attribution analysis reasoning logic. According to the method, the accuracy and efficiency of APT attribution analysis can be improved, the generalization ability of the model is enhanced, and the method can be applied to multiple application scenes such as network security defense and malicious software analysis.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to an APT attribution analysis method and system based on large model semantic transformation. Background Art

[0002] With the rapid development of artificial intelligence technology, large models (especially large pre-trained language models based on Transformer structure) have made significant breakthroughs in the field of natural language processing. These models have learned rich language knowledge and context understanding capabilities through pre-training on large-scale text data, and are able to perform complex language tasks such as text generation, sentiment analysis, question-answering systems, etc. However, when large models are applied to the field of network security, especially APT (advanced persistent threat) attribution analysis for malicious code, they face unique challenges. Malicious code usually exists in binary form, and its structure is completely different from natural language text, which makes it difficult for large models to directly understand and process it. The instructions, opcodes, addresses and other information in the binary code are highly specialized knowledge for human analysts, but are completely unfamiliar input formats for large models. Therefore, an effective conversion mechanism is needed to convert binary code into a data form that the large model can understand.

[0003] Traditional APT attribution analysis relies on methods such as signature matching, behavior monitoring, and expert experience. These methods are powerless in the face of evolving APT attacks. Signature matching relies on a feature library of known malicious code, but APT attackers often bypass detection through minor mutations; although behavior monitoring can capture abnormal behavior, it is difficult to accurately attribute it to a specific APT organization; expert experience is limited by the analyst's knowledge level and experience accumulation, and is difficult to apply on a large scale. APT attribution of malicious code is also limited by data scarcity and concealment. APT attacks are often highly customized and targeted, which makes the number of collected samples limited and difficult to represent all possible attack scenarios. At the same time, APT attackers usually use a variety of means to hide their attack sources and purposes, which increases the difficulty of attribution analysis. Summary of the invention

[0004] To this end, the present invention provides an APT attribution analysis method and system based on big model semantic transformation, which gradually transforms binary samples of malware into a data form that can be automatically understood and effectively processed by the big model, optimizes downstream APT classification tasks, and solves the problems of limited number of existing samples, difficulty in accurate attribution analysis and large-scale application.

[0005] According to the design scheme provided by the present invention, on the one hand, an APT attribution analysis method based on large model semantic transformation is provided, comprising:

[0006] Extracting malicious binary sample software gene vectors using a sliding window, and performing structured mapping on key feature software gene vectors to store software gene sample information using a specified data structure, wherein the software gene vectors are formed by sequentially connecting basic blocks of malicious binary sample code according to an assembly process;

[0007] Fine-tune the large language model based on a preset instruction template, and use the fine-tune large language model to retain and delete features in the software gene information to mine and extract key features in the software gene information, and spontaneously form association mappings between feature elements in different semantic spaces. The preset instruction template prompts the large language model to generate a predicted representation for the key features of the software gene information based on a prefix prompt word, and the association mapping adjusts the positions of adjacent feature elements based on the correlation between the feature elements.

[0008] Extracting training data sets and evaluation data sets from software gene sample information multiple times according to preset ratios, training and evaluating the large language model based on the training data sets and evaluation data sets extracted each time, and updating the hyperparameter candidate set through a hyperparameter adaptive selection mechanism, obtaining the best hyperparameter combination of the large language model according to the best hyperparameter obtained after convergence, the hyperparameter adaptive selection mechanism is used to adaptively select the best hyperparameter combination of the APT attribution analysis task in the hyperparameter space, the hyperparameter space is composed of a prefix prompt word length candidate set and a rank value candidate set, and the rank is a fine-tuning parameter set according to the weight matrix of the large language model;

[0009] Based on the optimal hyperparameter combination and using software gene sample information, the large language model is fine-tuned for the APT attribution analysis task, so that the large language model can learn the APT attribution analysis reasoning logic. The large language model after fine-tuning the APT attribution analysis task is used as the target model, and the APT malicious binary samples to be analyzed are input into the target model, and the attribution analysis of the APT malicious binary samples to be analyzed is obtained using the target model.

[0010] As the APT attribution analysis method based on the semantic transformation of the large model of the present invention, further, the malicious generation uses a sliding window to extract the malicious binary sample software gene vector, including:

[0011] Initialize the gene output sequence;

[0012] Traverse all basic blocks of the malicious binary sample code, append the current basic block assembly code to the end of the gene output sequence, determine whether the gene output sequence length exceeds the total code instruction number threshold, if not, continue to traverse the next code basic block, if exceeded, take the current gene output sequence as a complete software gene sequence, and use the code overlap coverage to determine the starting basic block of the next software gene, repeat the traversal process until all basic blocks in the malicious binary sample code are covered, so as to divide the malicious binary sample code into several software gene blocks with overlap coverage;

[0013] The BERT model is used to vectorize each software gene block, and the target address of the jump instruction is associated with the position encoding embedding vector to obtain a software gene vector of a specified dimension. The software gene vector of the specified dimension is semantically transformed based on the hash to obtain the software gene hash value after the semantic transformation.

[0014] As the APT attribution analysis method based on the semantic transformation of the large model of the present invention, further, the semantic transformation of the software gene vector is performed based on hash, including:

[0015] Use a clustering algorithm to cluster software gene vectors of specified dimensions, classify similar function vectors into one category, and use the centroid to represent each class after clustering;

[0016] A SHA-256 hash operation is performed on each centroid to convert the software gene vector of the specified dimension into 256 strings, and the CRC8 hash is used to reduce the 256 strings to a string of length 8 to obtain the semantically converted software gene hash value.

[0017] As the APT attribution analysis method based on the semantic transformation of the large model of the present invention, further, the malicious binary sample software gene vector is extracted by using a sliding window, and it also includes:

[0018] Using scripts and automated tools to batch extract software gene features from malicious binary samples, the software gene features include: import table function name software gene features, string software gene features, function block software gene features and metadata software gene features, the function block software gene features include software gene hash values, the metadata include malicious binary sample file attributes, file hash, resource information, timestamp, digital signature, compiler type, compile time, compile options and compiler version;

[0019] The software gene feature score is used to obtain the feature score of each software gene, and the key features in the malicious binary sample are selected according to the software gene feature score to perform structured mapping of the key features of the software gene. The software gene feature score calculation formula is expressed as: Among them, #apt is the number of APT organizations where the software gene feature is located, #count is the total number of times the software gene feature appears in all malicious binary sample data, and #samples is the number of malicious binary samples where the software gene feature is located.

[0020] As the APT attribution analysis method based on the semantic transformation of the large model of the present invention, further, fine-tuning training of the large language model is performed based on the preset instruction template, including:

[0021] The self-attention mechanism is used to perform semantic transformation on the input software gene feature elements, the implicit self-attention weights between the input software gene feature elements and the target APT elements are calculated, and high-value software gene feature elements are marked according to the implicit self-attention weights;

[0022] The self-attention weight between high-value software gene feature elements and low-value software gene feature elements is calculated. If the self-attention weight is greater than the preset threshold, the low-value software gene feature element is retained, and the key feature elements of the software gene are mined through multiple rounds of screening.

[0023] As the APT attribution analysis method based on the semantic transformation of the large model of the present invention, further, fine-tuning the large language model based on the preset instruction template also includes:

[0024] The self-attention weights between each feature element after fine-tuning the instruction are used to measure the degree of attention and mutual dependence between it and other feature elements;

[0025] The positions of the feature elements are adjusted according to the attention levels and interdependencies between the feature elements, so that the related feature elements are adjacent in position, and a list of software gene elements after feature optimization is obtained.

[0026] As the APT attribution analysis method based on the semantic transformation of the large model of the present invention, further, fine-tuning the large language model based on the preset instruction template also includes:

[0027] The feature-optimized software gene element list is paired with the original input software gene feature element list, and the sequence-to-sequence model is trained using the encoder and decoder built based on the Transformer model to automatically mine the information features of software gene samples using the trained sequence-to-sequence model.

[0028] On the other hand, the present invention also provides an APT attribution analysis system based on large model semantic transformation, comprising: a feature extraction module, an instruction fine-tuning module, an optimal hyperparameter selection module and an APT attribution analysis module, wherein:

[0029] A feature extraction module is used to extract malicious binary sample software gene vectors using a sliding window, and to perform structured mapping on key feature software gene vectors so as to store software gene sample information using a specified data structure, wherein the software gene vectors are formed by sequentially connecting basic blocks of malicious binary sample code according to an assembly process;

[0030] An instruction fine-tuning module is used to fine-tune the large language model based on a preset instruction template, and use the fine-tuned large language model to retain and delete features in the software gene information to mine and extract key features in the software gene information, and spontaneously form association mappings between various feature elements in different semantic spaces. The preset instruction template prompts the large language model to generate a predicted representation for the key features of the software gene information based on the prefix prompt word, and the association mapping adjusts the positions of adjacent feature elements based on the correlation between the feature elements;

[0031] The best hyperparameter selection module is used to extract training data sets and evaluation data sets from software gene sample information multiple times according to preset proportions, train and evaluate the large language model based on the training data sets and evaluation data sets extracted each time, and update the hyperparameter candidate set through the hyperparameter adaptive selection mechanism, and obtain the best hyperparameter combination of the large language model based on the best hyperparameter obtained after convergence. The hyperparameter adaptive selection mechanism is used to adaptively select the best hyperparameter combination of the APT attribution analysis task in the hyperparameter space, and the hyperparameter space is composed of a prefix prompt word length candidate set and a rank value candidate set, and the rank is a fine-tuning parameter set according to the weight matrix of the large language model;

[0032] The APT attribution analysis module is used to fine-tune the APT attribution analysis task on the large language model based on the optimal hyperparameter combination and using the software gene sample information, so that the large language model learns the APT attribution analysis reasoning logic, and uses the large language model after fine-tuning the APT attribution analysis task as the target model, so as to input the APT malicious binary sample to be analyzed into the target model, and use the target model to obtain the attribution analysis of the APT malicious binary sample to be analyzed.

[0033] Beneficial effects of the present invention:

[0034] The present invention uses a series of semantic conversion technologies based on high semantic value to gradually convert binary samples of malware into data forms that can be automatically understood and effectively processed by large models, thereby optimizing downstream APT classification tasks, improving the accuracy and efficiency of APT attribution analysis, and enhancing the generalization ability of the model. It can not only effectively remove noise and retain the most representative gene features, but also accurately identify and annotate high-value elements through fine-tuning training and semantic conversion of large models, and innovatively solve the problem of information leakage. In the implicit structured semantic analysis stage, the utilization efficiency of information is further enhanced by optimizing element arrangement and redesigning element representation; and the classification performance of the model is improved by using semantic generalization reasoning technology and optimization algorithms, giving the model zero-sample learning ability, so that it has stronger generalization ability and adaptability in practical applications, and can be applied to multiple application scenarios such as network security defense and malware analysis, providing a new and efficient solution for the attribution analysis of advanced persistent threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a schematic diagram of the APT attribution analysis process based on the semantic transformation of the large model in the embodiment;

[0036] Figure 2 This is a schematic diagram of the software gene extraction process in the embodiment;

[0037] Figure 3 This is a schematic diagram of the malicious code gene structural association mapping process based on high semantic value conversion in the embodiment;

[0038] Figure 4 The pseudo code of feat_score_ns3 algorithm in the embodiment is shown;

[0039] Figure 5 The first and second versions of the feat_score_ns3 algorithm formulas in the embodiment are compared;

[0040] Figure 6 Comparison of the second and third version formulas of TF-IDF and feat_score_ns3 algorithms in the embodiment;

[0041] Figure 7 It is a schematic diagram of the principle of the automatic element value labeling mechanism based on the self-attention weight calculation of the fine-tuned large model in the embodiment;

[0042] Figure 8 It is a schematic diagram of the principle of the element retention mechanism based on the self-attention weight calculation of the fine-tuned large model in the embodiment;

[0043] Fig. 9 This is a schematic diagram of the sample high semantic value element screening process based on large model instruction fine-tuning in the embodiment;

[0044] Fig.10 This is the principle of the element position rearrangement mechanism based on the fine-tuned large model self-attention weight in the embodiment;

[0045] Fig.11 This is a schematic diagram of a JSON sample after adjustment in the implicit structured semantic analysis stage in the embodiment;

[0046] Fig.12 It is a schematic diagram of the automatic learning process of the large model feature mining and sequence rearrangement mechanism in the embodiment;

[0047] Fig.13 The figure is a schematic diagram of the iterative process of hyperparameter selection based on priority queue and random small sample evaluation in the embodiment. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0049] For advanced persistent threat (APT) attribution analysis, see Figure 1 As shown, an APT attribution analysis method based on large model semantic transformation is provided, including:

[0050] S101. Extract malicious binary sample software gene vectors using a sliding window, and perform structured mapping on key feature software gene vectors to store software gene sample information using a specified data structure, wherein the software gene vectors are formed by sequentially connecting basic blocks of malicious binary sample codes according to an assembly process.

[0051] Specifically, the malicious binary sample software gene vector is extracted by sliding window for malicious generation, which can be designed to include:

[0052] Initialize the gene output sequence;

[0053] Traverse all basic blocks of the malicious binary sample code, append the current basic block assembly code to the end of the gene output sequence, determine whether the gene output sequence length exceeds the total code instruction number threshold, if not, continue to traverse the next code basic block, if exceeded, take the current gene output sequence as a complete software gene sequence, and use the code overlap coverage to determine the starting basic block of the next software gene, repeat the traversal process until all basic blocks in the malicious binary sample code are covered, so as to divide the malicious binary sample code into several software gene blocks with overlap coverage;

[0054] The BERT model is used to vectorize each software gene block, and the target address of the jump instruction is associated with the position encoding embedding vector to obtain a software gene vector of a specified dimension. The software gene vector of the specified dimension is semantically transformed based on the hash to obtain the software gene hash value after the semantic transformation.

[0055] The bottom-level perspective of geneization regards software genes as binary fragments with functions or information on the software body. The concept is inspired by biological genes. Software genes represent software code as a sequence of available basic units. Software genes are composed of a continuum of multiple basic blocks, each of which can be a code block or other logical unit. A software gene can be formed by connecting the assembly codes of these basic blocks in sequence.

[0056] Software gene extraction algorithm such as Figure 2 As shown in Figure 1, the code is divided into several software genes with a certain degree of overlap by means of sliding windows. The degree of overlap can be adjusted according to specific needs. A larger degree of overlap helps capture more code context, but it also increases computational complexity.

[0057] The extracted software genes can not only represent the local features of the code, but also reflect the overall logical structure of the code due to the overlap. This representation method provides a new entry point for subsequent code analysis, software test coverage, vulnerability mining, and malicious classification.

[0058] During the APT determination process, each malware sample needs to be segmented into long gene blocks. The purpose of this step is to divide the malware sample into smaller units for subsequent analysis and processing. The segmented blocks need to undergo symbol replacement to reduce the size of the vocabulary. For example, both [eax+var_9h] and [eax+var_3h] are rewritten as [eax+var_xxx], and [eax+var_xxx] is added to the vocabulary as a new word. After symbol replacement, the final vocabulary size is about 2000. This can significantly reduce the computational complexity in subsequent processing and improve analysis efficiency.

[0059] For each gene block, a large language model similar to BERT (Bidirectional Encoder Representations from Transformers) can be used for training. BERT is a pre-trained language model based on the Transformer encoder, which can learn the contextual representation of text through self-supervised learning. In the APT judgment task, autoregressive learning is performed by using the MLM (Masked Language Model) task. The principle of MLM is to predict the masked target word based on the context of the input sentence. In this way, the model can learn the contextual information of the instruction sequence in the gene block, thereby obtaining a more accurate vectorized representation.

[0060] BERT's architecture uses the Transformer encoding layer, which includes a multi-head self-attention mechanism and a feedforward neural network. For each gene block, at most the first 512 words are retained, and each instruction and instruction operand after symbol replacement are target words. In this way, a high-dimensional vector representation of each gene block can be obtained for subsequent analysis and judgment.

[0061] In the vectorized representation of gene blocks, the target address of jump instructions needs to be specially processed. In this embodiment, the target address of the jump instruction can be associated with the embedding vector of the position code, that is, word_embedding=

[0062] For jump instruction addresses that exceed the 512-word range, use the special word JUMP_ADDR_EXCEEDED. For jump instruction addresses within the 512-word range, use JUMP_ADDR_<dest_position_id> To indicate that<dest_position_id> Indicates the position of the gene block to which the jump instruction will jump. For example, JUMP_ADDR_12 means that the jump instruction will jump to the 12th position of the gene block. By associating the target address of the jump instruction with the position encoding, BERT can better capture the jump relationship and control flow information within the gene block. This helps the model understand the semantic structure and execution flow of the code. For jump instruction addresses that exceed the range of 512 words, BERT uses the special word JUMP_ADDR_EXCEEDED to represent them. This processing method can effectively handle gene blocks longer than 512 words, avoiding the problem of information loss.

[0063] There is a natural semantic gap between the large language model and the above-mentioned software gene vector. For example, the software gene vector is a floating point vector with a dimension of 512, while the input of the large language model is generally a token. In order to make up for this semantic gap and enable the large language model to use the software gene vector to perform downstream malicious code analysis tasks (such as APT attribution tasks), in the embodiment of this case, the software gene vector is semantically transformed based on hashing, and the algorithm flow of semantic transformation may include:

[0064] Use a clustering algorithm to cluster software gene vectors of specified dimensions, classify similar function vectors into one category, and use the centroid to represent each class after clustering;

[0065] A SHA-256 hash operation is performed on each centroid to convert the software gene vector of the specified dimension into 256 strings, and the 256 strings are reduced to a string of length 8 using CRC8 hash to obtain the semantically converted software gene vector representation.

[0066] By creating a data structure in JSON format, all 8-bit software gene representations of the sample are contained in the form of strings. Once a JSON dataset containing function hash value strings is available, it can be used as the input of a large language model for fine-tuning. During the fine-tuning process, the model learns to associate function hash values ​​(i.e., compact representations of function vectors) with related APT organizations. On the fine-tuned model, all function hash values ​​of a new sample are provided to enable the model to generate the most likely corresponding APT organization.

[0067] Through gene technology, software code is converted into a usable sequence of basic units, which can accurately characterize the local features and overall logical structure of the code; the sliding window method is used to extract software genes, the algorithm is efficient, and more code context can be captured by adjusting the overlap; large language models such as BERT are used to vectorize software gene blocks, which can learn the contextual information of instruction sequences and improve the accuracy of analysis; the software gene vector is converted into a format that can be understood by the large language model through the hash algorithm, which solves the semantic gap problem between binary code and large model input.

[0068] In order to solve the semantic gap problem between binary code and large model input (i.e., large language models cannot directly parse binary code fragments), in the embodiment of this case, the semantic gap problem is solved by genetically analyzing the binary code and converting the genetic information into structured data that the large model can understand, so that it can be used by subsequent large model fine-tuning. In addition, in order to improve the accuracy of malicious sample attribution, a high semantic value screening algorithm is selected for genetic information in a large number of experimental comparative analyses. The final screening algorithm can effectively remove noisy genetic features and retain genetic features that are representative of the data distribution relative to the target APT, such as retaining important information such as key function names in the function import table and representative keywords in the string, which improves the accuracy of sample attribution in actual testing.

[0069] From the perspective of characteristics, different from the software gene vector at the bottom level, the software gene at the macro level should have the following characteristics:

[0070] 1. Modularity: A software gene is usually an independent functional module that can perform specific tasks.

[0071] 2. Reusability: Software genes can be reused in different software systems.

[0072] 3. Inheritance: When developing new software, you can inherit and expand the genes of existing software to add functions or improve performance.

[0073] 4. Adaptability: Software genes can be modified and adjusted according to needs to adapt to different software environments or needs.

[0074] In the embodiment of this case, the software genes from the bottom-level perspective and the macroscopic perspective are integrated, and the malicious code geneization technology based on high semantic value conversion is used to generate software genes with high semantic value by identifying the potential code features with the above characteristics in the malicious code and genetizing these features, thus laying the foundation for downstream malicious code analysis tasks.

[0075] Software gene features that meet the above characteristics can be divided into the following four categories:

[0076] 1. Software gene based on import table function name: The import table is a list of external functions and libraries required by malware at runtime. The import table contains the address information and function names of external functions that the program needs to call at runtime. The import table of malicious code can reveal its behavior, such as the system API functions used, thereby inferring its malicious activities. In the geneization of high semantic value of the import table, not all import table functions will be geneized, but import table function names with high semantic value will be selected. In the embodiment of this case, the feat_score_ns3 algorithm can be used to sort the import table function name features by semantic value, and only retain the import table function names with high semantic value.

[0077] 2. String-based software genes: In binary samples of malware, string data can provide clues to its functions, targets, and potential behaviors, such as the URL or IP address of the command and control server, specific file paths and registry keys, keys used in encryption and encoding functions, error messages and debugging information, user agent strings, and other network protocol elements. By comparing the effects of key feature selection algorithms such as feat_score_ns3 algorithm, TF-IDF algorithm, and entropy-based algorithm on small data sets, the feat_score_ns3 algorithm can be selected as the selection of string-based software gene features.

[0078] 3. Function block-based software gene: The function block software gene is the genetic hash value of the above-mentioned underlying perspective.

[0079] 4. Software genes based on sample metadata: In addition to the above three types of software genes, metadata is also considered as software genes because it contains a series of important information about malicious code samples. The information it contains includes file attributes, file hashes, resource information, timestamps, digital signatures, compiler types, compilation times, compilation options, compiler versions, etc.

[0080] like Figure 3 As shown in the figure, by writing scripts and using automated tools to batch extract software gene information of malicious code samples and save them as data structures in JSON format, it is a malicious code gene structural association mapping based on high semantic value conversion. Among them, the high semantic value gene extraction module uses the feat_score_ns3 algorithm to effectively extract relevant key features based on the uniqueness of the feature distribution of malicious code samples. Compared with traditional TF-IDF-based or entropy-based algorithms, it can better improve the accuracy of downstream malicious code analysis tasks, such as APT attribution tasks.

[0081] The pseudo code of feat_score_ns3 algorithm is as follows Figure 4As shown in the figure, the core formula has been verified through multiple rounds of experiments and there are three versions in total. Figure 5 As shown, the upper part is the first version of the formula, and the lower part is the second version of the formula. In the figure, #apt refers to the number of APT families in which the feature appears, #count refers to the total number of times the feature appears in all samples, and #samples refers to the number of samples in which the feature appears. There are two features in the figure above, feature A and feature B. Feature A appears in 10 APT families, the number of feature appearances is 40, and the number of samples in which it appears is 10. Feature B appears in 2 APT families, the number of feature appearances is 8, and the number of samples in which it appears is 4. In this example, feature A appears 4 times in each sample on average, and feature B appears 3 times in each sample on average, and the statistics are almost the same. However, feature A appears in more APT families than feature B. Therefore, it can be considered that feature B is a better feature because it is more specific than feature B. However, the first version of the formula mistakenly selects feature A as the better feature because the average number of appearances in the formula dominates. In order to solve this problem, the second version of the formula introduces a logarithmic function to reduce the importance of this term, thereby correctly selecting feature B as the better feature.

[0082] However, the second version of the formula above will make the same mistake as the commonly used TF-IDF feature selection algorithm in some scenarios. The third version of the formula is to correct this mistake. Figure 6As shown in the figure, the top is TF-IDF, the middle is the second version of the formula, and the bottom is the third version of the formula. #count_k is the number of times the feature appears in the target APT family, K is the number of times all features appear in the APT family, #total_apt is the total number of APT families, and the rest of the statistics are the same as the previous example. #apt refers to how many APT families the feature appears in, #count refers to the total number of times the feature appears in all samples, and #samples refers to how many samples the feature appears in. In this example, there are also two features, feature A and feature B. Feature A appears in 80 APT families, while there are only 270 APT families. Feature A covers nearly 30% of APT families, while feature B only appears in 5 APT families. Obviously, feature B is more specific and should be selected as a better feature, but the TF-IDF formula is expressed in the form of a product, which will overemphasize the number of times it appears in the target APT family, and therefore will mistakenly select feature A as a better feature. Although the second version of the formula uses addition to reduce the defects of TF-IDF, the logarithmic penalty of the second term alone is still not enough to reduce the interference of high-frequency features. To solve these problems, the third version of the formula multiplies the second term by a penalty coefficient of 0.001, which penalizes high-frequency features and correctly selects feature B as the better feature.

[0083] In the embodiment of this case, by importing various software genes such as table function names, strings, function blocks, sample metadata, etc., the key features of malicious code are fully covered; and the feat_score_ns3 algorithm is used to screen the features with high semantic value, thereby improving the accuracy of downstream malicious code analysis tasks, and the extracted software gene information is saved as a data structure in JSON format to facilitate subsequent analysis and processing.

[0084] S102, fine-tuning the large language model based on the preset instruction template, and using the fine-tuned large language model to retain and delete features in the software gene information to mine and extract key features in the software gene information, and spontaneously form association mappings between feature elements in different semantic spaces, wherein the preset instruction template prompts the large language model to generate a predicted representation for the key features of the software gene information based on a prefix prompt word, and the association mapping adjusts the positions of adjacent feature elements based on the correlation between the feature elements.

[0085] Through the instruction fine-tuning of the large language model, it aims to use the trained large model to transform the input features into high semantic value through the self-attention mechanism, analyze the implicit self-attention weight relationship between the input elements and the target APT elements, retain high-weight elements through multiple rounds of screening mechanisms, reduce redundant features, thereby realizing automatic mining of high semantic value features, and ultimately improving the accuracy and efficiency of prediction.

[0086] Specifically, fine-tuning the large language model based on the preset instruction template can be designed to include:

[0087] The self-attention mechanism is used to perform semantic transformation on the input software gene feature elements, the implicit self-attention weights between the input software gene feature elements and the target APT elements are calculated, and high-value software gene feature elements are marked according to the implicit self-attention weights;

[0088] The self-attention weight between high-value software gene feature elements and low-value software gene feature elements is calculated. If the self-attention weight is greater than the preset threshold, the low-value software gene feature element is retained, and the key feature elements of the software gene are mined through multiple rounds of screening.

[0089] The model first calculates the self-attention weights between each input element and the target APT element. These weights can reflect the correlation between elements and their importance to the prediction results. By calculating the self-attention weights, it is possible to identify which input elements have a higher contribution to the prediction of the APT category. Figure 7 As shown in the figure, after fine-tuning, the network parameters of the last few attention layers of the large model can automatically calculate the correlation between the input elements. In this process, the weights of all elements relative to the target APT can be obtained. This weight is obtained by calculating the average weight of the last three self-attention layers. For example, Figure 7 There are two elements, element 3 and element 4, whose relevance to APT is relatively low, 0.01 and 0.02 respectively, and they can be marked as low-value elements, while the remaining elements can be marked as high-value elements and retained.

[0090] Although some elements may be considered as low-value elements after the element values ​​are automatically marked, in the embodiment of this case, these elements are not directly deleted. Instead, an element retention mechanism is proposed, that is, if the correlation between these low-value elements and other high-value elements is also relatively high, they have a chance to be retained.

[0091] In order to implement this mechanism, in the embodiment of this case, after the element value of the self-attention analysis is marked, the self-attention weight between the low-value elements and the high-value elements is further analyzed. If the self-attention weight of a low-value element and at least one high-value element exceeds the preset threshold, the low-value element will be retained. This mechanism ensures that while retaining important information, the correlation between elements is also taken into account, thereby further improving the accuracy and efficiency of the prediction.

[0092] For example Figure 7Elements 3 and 4 in are marked as low-value elements in the self-attention analysis, but this does not mean that they will definitely be deleted. If the correlation between these elements and other high-value elements is also high, they have a chance to be retained.

[0093] like Figure 8 As shown, in the first stage of self-attention analysis, element 3 is marked as a low-value element and may be deleted, but through analysis it is found that its self-attention weight with element 1 is as high as 0.4, so it will be retained.

[0094] The semantic transformation process based on large model fine-tuning training is as follows Fig. 9 As shown in the figure, the large model is fine-tuned using the original samples and APT labels, and the corresponding low-value feature elements are retained or deleted based on the self-attention weight to obtain sample data with high semantic value after feature screening.

[0095] In the embodiments of this case, by using the trained large language model and transforming the input features through the self-attention mechanism, it is possible to automatically mine high semantic value features, thereby improving the accuracy and efficiency of prediction; by calculating the self-attention weights between the input elements and the target APT elements, the input elements that have a high contribution to the prediction results are automatically identified, thereby realizing the automatic labeling of element values; after the element values ​​are automatically labeled, the low-value elements are not directly deleted, but the self-attention weights between the low-value elements and the high-value elements are further analyzed, and the low-value elements with a high correlation with the high-value elements are retained by the element retention mechanism, thereby further improving the accuracy and efficiency of prediction. Different from the general technology of directly fine-tuning the large model and then performing APT classification, in the embodiments of this case, the large model is first fine-tuned, and then the fine-tuned large model is used to mine high semantic value features, and then further training and fine-tuning are performed based on these features, thereby realizing more refined and accurate APT classification.

[0096] The structured semantic analysis process is defined as two technologies: one is semantic analysis technology based on explicit structure, and the other is semantic analysis technology based on implicit structure. Explicit structured semantic analysis technology requires manually designed neural networks or manually designed rule engines to characterize the structured association relationship of the internal semantic space of the sample between malicious code elements and the semantic mapping of the semantic space for downstream tasks. Implicit structured semantic analysis technology automatically forms the association and mapping between various elements in different semantic spaces in the internal parameters and network structure of the large model through the training and fine-tuning process of the large model itself. Unlike explicit technology, implicit structured semantic analysis technology does not characterize the structured association relationship of the internal semantic space of the sample between malicious code elements and the semantic mapping of the semantic space for downstream tasks through manually designed neural networks or manually designed rule engines. Implicit structured semantic analysis technology spontaneously forms the association and mapping between various elements in different semantic spaces in the internal parameters and network structure of the large model through the training and fine-tuning process of the large model itself during the large model fine-tuning training stage.

[0097] In the embodiment of this case, the self-attention weights between each feature element after instruction fine-tuning are used to measure the degree of attention and mutual dependence between the feature elements and other feature elements; the positions of the feature elements are adjusted according to the degree of attention and mutual dependence between the feature elements so that the related feature elements are adjacent in position, thereby obtaining a list of software gene elements after feature optimization.

[0098] By analyzing the self-attention weights between the various feature elements after fine-tuning the instructions, we can reveal how closely these elements are related to each other. Specifically, the self-attention mechanism measures the degree of attention each element pays to other elements through a weight matrix, thereby revealing their interdependence during data processing. By analyzing these weights, it is possible to identify elements that are highly correlated but relatively far apart in the data representation.

[0099] In the process of improving the efficiency of these elements, in the embodiment of this case, these closely related but far-flung elements are moved to positions close to each other. This process not only optimizes the arrangement of elements, but also improves the accuracy of the APT classification task. This method of adjusting the position of elements enables related elements to work together more effectively in subsequent processing, thereby improving the performance of the entire system. Fig.10 As shown in the figure, the self-attention correlation between element 1 and element 95 is high, but their positions are far away. Therefore, by moving these two elements to adjacent positions, the information utilization efficiency can be improved for the subsequent training optimization.

[0100] In order to solve the JSON representation problem between heterogeneous elements, in the embodiment of this case, the representation of strings and import table function names is redesigned and adjusted. Specifically, for functions and strings with high correlation, a special JSON dictionary structure called "api_and_string" can be used to represent their correlation. For elements that have a high similarity in correlation but belong to the same type (for example, only import table function names or strings), the "api_only" or "string_only" structure is used to represent them respectively.

[0101] In this way, the complex relationships between different types of elements can be more clearly reflected in the JSON representation, while ensuring the simplicity and readability of the data structure. This improvement not only helps the accuracy of data processing and analysis, but also enhances the robustness and reliability of the system in dealing with complex APT classification tasks. The JSON structure is as follows Fig.11 As shown, we can see that the adjusted distance between api_1 and api_3 in the api_only array is farther.

[0102] Through the training and fine-tuning process of the large model, the association and mapping between elements in different semantic spaces are spontaneously formed; there is no need to manually design neural networks or rule engines, which improves the degree of automation. The positions of elements are moved according to their mutual relationships, and the arrangement of elements is optimized. By redesigning and adjusting the representation of strings and import table function names, the complex associations between different types of elements can be more clearly reflected, enhancing the robustness and reliability of the system.

[0103] The feature retention and deletion based on self-attention analysis and the rearrangement of element positions are completed with the knowledge of APT information in advance, so there is a problem of information leakage. To solve this problem, a sequence-to-sequence model can be trained by pairing the original input element list with the element list after feature optimization and feeding it into a transformer encoder and decoder. After training, the transformer can be used to automatically mine features without APT information leakage on the training data. The process is as follows Fig.12 As shown in the figure, by learning a sequence-to-sequence task model, the problem of information leakage in the process of feature retention and deletion and element position rearrangement is cleverly solved.

[0104] S103, extracting training data sets and evaluation data sets from the software gene sample information multiple times according to a preset ratio, training and evaluating the large language model based on the training data sets and evaluation data sets extracted each time, and updating the hyperparameter candidate set through the hyperparameter adaptive selection mechanism, obtaining the best hyperparameter combination of the large language model according to the best hyperparameter obtained after convergence, the hyperparameter adaptive selection mechanism is used to adaptively select the best hyperparameter combination of the APT attribution analysis task in the hyperparameter space, the hyperparameter space is composed of a prefix prompt word length candidate set and a rank value candidate set, and the rank is a fine-tuning parameter set according to the weight matrix of the large language model;

[0105] In the design of the hyperparameter candidate set, candidate sequences are set for the prefix hint word length of the P-TUNING strategy and the rank parameter of the LORA technology. A management method based on the priority queue mechanism is used to more efficiently explore and evaluate hyperparameter combinations. Specifically, each hyperparameter combination is regarded as an element in the priority queue and is assigned a dynamically calculated weight value. This weight value comprehensively considers the actual accuracy of the element at the current time t and the frequency of its evaluation to achieve a balance between exploration and utilization.

[0106] The system selects an element from the head of the queue with a probability of P (e.g. 0.9) each time, and uniformly randomly selects elements from the entire queue with a probability of 1-P (e.g. 0.1). This probability-based selection method ensures the use of high-quality elements while not forgetting to explore other potential elements.

[0107] For the selected element, the system will sample the entire data set once, and sample the training and evaluation sets at a very small ratio (for example, 1%). The large model to be fine-tuned is configured according to the hyperparameters of the selected element, and the rank size of LORA and the length parameter of P-TUNNING are configured respectively. After the configuration is completed, it is randomly trained on the sampled data set until convergence, and evaluated on the evaluation set to obtain the APT classification accuracy at time t. The accuracy calculation formula is as follows:

[0108]

[0109] Among them, #Correct is the number of samples for which the model predicts APT correctly on the evaluation set, and #Error is the number of samples for which the model predicts APT incorrectly on the evaluation machine.

[0110] Then, the accuracy of the element at time t is updated to its weight. The specific update formula is as follows:

[0111]

[0112] in is the weight of the i-th element at time t, rt is the actual accuracy of the element at time t, n i (t) is the number of times the element is selected for weight evaluation until time t. This formula balances the exploitation and exploration mechanisms, that is, if n i If (t) is large, it means that the element has been explored many times, thus reducing its update rate. i (t) is small, it means that the element has not been fully explored, and its benefit (i.e. ) will amplify its influence on its weight and accelerate convergence.

[0113] After the weight of the selected element is updated, it is put back into the priority queue and its position in the priority queue is adjusted according to the weight. This round of iteration ends.

[0114] like Fig.13 As shown in the figure, in order to improve the accuracy of malicious code APT classification tasks, the efficient parameter fine-tuning technology based on LORA (Low-Rank Adaptation of Large Language Models) is used, and P-TUNING is used as the prefix prompt word selection strategy to improve the classification performance through synergy. In view of the significant impact of the prefix prompt word length in P-TUNING on the optimization effect, the P-TUNING prefix prompt word length adaptive selection algorithm can automatically determine the optimal P-TUNING prompt word length, while taking into account the selection of LORA rank parameters, to achieve dual optimization of hyperparameter selection. By introducing a priority queue mechanism to manage hyperparameter combinations, training and evaluation on the full data set are avoided. Each hyperparameter combination is regarded as a queue element and is assigned a dynamically calculated weight value. The weight comprehensively considers the actual accuracy and evaluation frequency, balancing exploration and utilization.

[0115] S104. Fine-tune the APT attribution analysis task on the large language model based on the optimal hyperparameter combination and using the software gene sample information, so that the large language model learns the APT attribution analysis reasoning logic, and uses the large language model after fine-tuning the APT attribution analysis task as the target model, so that the APT malicious binary sample to be analyzed is input into the target model, and the attribution analysis of the APT malicious binary sample to be analyzed is obtained using the target model.

[0116] The software gene sample information is used to fine-tune the large language model under the optimal hyperparameter combination, so that the large language model can learn the reasoning logic of the APT attribution analysis task; the fine-tuned large language model is used as the target model deployed in the specified network, and the trained target model is used to perform generalized reasoning on new and unseen samples. For example, the name of the system call function of a sample is GetNetworkName, but there is no system call function of this name in the training set. However, although there is no identical system call function name in the training set, there are similar function names, such as GetNetName. Since the model also has similar parameter structures for the intermediate semantic expressions of GetNetworkName and GetNetName, although the large model of this sample has not been seen in the training data set, it can derive similar classification results (for example, the same APT organization) through semantic generalization.

[0117] The same example may also appear in string features. Suppose there is a new sample whose string features include www.darkmoon.com, which means that it is very likely to visit the website to perform some remote operations. However, in the training set, there is no identical string in the data set of the large model, but there are similar strings in the training set, such as darkmoon.com. In this case, the intermediate semantic expressions of the two strings by the large model are also similar, so semantic generalization reasoning can be performed, so that the model can infer that the APT of the two samples is the same.

[0118] For features whose functions are given by meaningful names, similar names often have similar meanings. The large model can make similar intermediate semantic expressions based on the similarity of the target feature and the feature names of the training set data through semantic generalization reasoning, thereby deriving the same APT classification.

[0119] Therefore, it can be considered that the large model has a certain zero-sample learning ability. That is, the features in the sample do not need to appear in all of the training sets, only similar parts need to appear in the training set for the large model to obtain the correct intermediate semantic expression through semantic generalization reasoning.

[0120] In the embodiment of this case, by converting binary samples into software genes with high semantic value, complex machine language codes are deconstructed into a series of parseable and representable basic units. These software genes not only retain the key semantic information of the code, but also exist in a structured form, which is convenient for subsequent processing. This process effectively elevates binary samples from the machine language level to a form closer to natural language processing, laying the foundation for analysis using large language models. The BERT model can be used to vectorize the software genes, and a hash conversion algorithm can be introduced to convert the software gene vectors into an input format that can be understood and processed by the large language model. This conversion process not only retains the semantic information of the software genes, but also realizes the mapping from binary code to text vectors, building a solid bridge between binary samples and large language models.

[0121] Through software gene technology, malicious binary samples are converted into software genes with high semantic value. These genes can accurately characterize the local features and overall logical structure of the code, thereby significantly improving the ability to capture the behavioral characteristics of malicious code. The feat_score_ns3 algorithm can be used to screen software genes with high semantic value, remove noise features, retain the most representative gene features, and further improve the accuracy of the analysis.

[0122] The sliding window algorithm is used for software gene extraction. The algorithm is highly efficient and can balance computational complexity and context capture capabilities by adjusting the overlap. In addition, the hash algorithm is used to convert the software gene vector into a format that can be understood by the large language model, which reduces the amount of calculation and speeds up the processing. The self-attention mechanism of the large model automatically annotates the element value and rearranges the position based on the relationship between the elements, reducing manual intervention, realizing the automation of feature mining and optimization, and improving the efficiency of the overall analysis process.

[0123] The trained large model is used to perform semantic generalization reasoning on unseen samples, and the correct APT classification is performed based on the intermediate semantic expression of similar features, so that the model has a certain zero-sample learning ability and significantly enhances the generalization ability of the model. By introducing the efficient parameter fine-tuning technology based on LORA and the P-TUNING prefix prompt word selection strategy, the parameters of the large model are optimized collaboratively, so that the model can adapt to different APT scenarios more accurately, and the robustness and generalization performance of the model are improved.

[0124] The extracted software gene information is saved as a data structure in JSON format to facilitate subsequent analysis and processing. At the same time, by redesigning the representation of strings and import table function names, the complex associations between different types of elements are more clearly reflected, enhancing the flexibility and scalability of the system. Through the implicit training process of the large model, the associations and mappings between elements in different semantic spaces are automatically formed, without the need to manually design complex neural networks or rule engines, which improves the automation and intelligence level of the system.

[0125] By introducing sequence-to-sequence learning tasks, the problem of information leakage in the process of feature retention and deletion and element position rearrangement can be solved, making the feature mining and optimization process safer and more reliable.

[0126] Furthermore, based on the above method, an embodiment of the present invention also provides an APT attribution analysis system based on large model semantic transformation, comprising: a feature extraction module, an instruction fine-tuning module, an optimal hyperparameter selection module and an APT attribution analysis module, wherein:

[0127] A feature extraction module is used to extract malicious binary sample software gene vectors using a sliding window, and to perform structured mapping on key feature software gene vectors so as to store software gene sample information using a specified data structure, wherein the software gene vectors are formed by sequentially connecting basic blocks of malicious binary sample code according to an assembly process;

[0128] An instruction fine-tuning module is used to fine-tune the large language model based on a preset instruction template, and use the fine-tuned large language model to retain and delete features in the software gene information to mine and extract key features in the software gene information, and spontaneously form association mappings between various feature elements in different semantic spaces. The preset instruction template prompts the large language model to generate a predicted representation for the key features of the software gene information based on the prefix prompt word, and the association mapping adjusts the positions of adjacent feature elements based on the correlation between the feature elements;

[0129] The best hyperparameter selection module is used to extract training data sets and evaluation data sets from software gene sample information multiple times according to preset proportions, train and evaluate the large language model based on the training data sets and evaluation data sets extracted each time, and update the hyperparameter candidate set through the hyperparameter adaptive selection mechanism, and obtain the best hyperparameter combination of the large language model based on the best hyperparameter obtained after convergence. The hyperparameter adaptive selection mechanism is used to adaptively select the best hyperparameter combination of the APT attribution analysis task in the hyperparameter space, and the hyperparameter space is composed of a prefix prompt word length candidate set and a rank value candidate set, and the rank is a fine-tuning parameter set according to the weight matrix of the large language model;

[0130] The APT attribution analysis module is used to fine-tune the APT attribution analysis task on the large language model based on the optimal hyperparameter combination and using the software gene sample information, so that the large language model learns the APT attribution analysis reasoning logic, and uses the large language model after fine-tuning the APT attribution analysis task as the target model, so as to input the APT malicious binary sample to be analyzed into the target model, and use the target model to obtain the attribution analysis of the APT malicious binary sample to be analyzed.

[0131] The entire malicious sample APT attribution analysis task undergoes a series of semantic transformations based on high semantic value, and the original input binary samples that cannot be automatically understood by the machine are gradually transformed into data forms with high semantic value that can be automatically understood by the machine and closely associated with downstream tasks, so as to better optimize downstream analysis tasks (such as APT classification tasks or TTP identification tasks), providing a new and efficient solution for the attribution analysis of advanced persistent threats.

[0132] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0133] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0134] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0135] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0136] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. An APT attribution analysis method based on large model semantic transformation, characterized in that: Include: Extracting malicious binary sample software gene vectors using a sliding window, and performing structured mapping on key feature software gene vectors to store software gene sample information using a specified data structure, wherein the software gene vectors are formed by sequentially connecting basic blocks of malicious binary sample code according to an assembly process; Fine-tune the large language model based on a preset instruction template, and use the fine-tune large language model to retain and delete features in the software gene information to mine and extract key features in the software gene information, and spontaneously form association mappings between feature elements in different semantic spaces. The preset instruction template prompts the large language model to generate a predicted representation for the key features of the software gene information based on a prefix prompt word, and the association mapping adjusts the positions of adjacent feature elements based on the correlation between the feature elements. Extracting training data sets and evaluation data sets from software gene sample information multiple times according to preset ratios, training and evaluating the large language model based on the training data sets and evaluation data sets extracted each time, and updating the hyperparameter candidate set through a hyperparameter adaptive selection mechanism, obtaining the best hyperparameter combination of the large language model based on the best hyperparameter obtained after convergence, the hyperparameter adaptive selection mechanism is used to adaptively select the best hyperparameter combination of the APT attribution analysis task in the hyperparameter space, the hyperparameter space is composed of a prefix prompt word length candidate set and a rank value candidate set, and the rank is a fine-tuning parameter set according to the weight matrix of the large language model; Based on the optimal hyperparameter combination and using software gene sample information, the large language model is fine-tuned for the APT attribution analysis task, so that the large language model can learn the APT attribution analysis reasoning logic. The large language model after fine-tuning the APT attribution analysis task is used as the target model, and the APT malicious binary samples to be analyzed are input into the target model, and the attribution analysis of the APT malicious binary samples to be analyzed is obtained using the target model.

2. The APT attribution analysis method based on large model semantic transformation according to claim 1 is characterized in that: Use sliding windows to extract malicious binary sample software gene vectors, including: Initialize the gene output sequence; Traverse all basic blocks of the malicious binary sample code, append the current basic block assembly code to the end of the gene output sequence, determine whether the gene output sequence length exceeds the total code instruction number threshold, if not, continue to traverse the next code basic block, if exceeded, take the current gene output sequence as a complete software gene sequence, and use the code overlap coverage to determine the starting basic block of the next software gene, repeat the traversal process until all basic blocks in the malicious binary sample code are covered, so as to divide the malicious binary sample code into several software gene blocks with overlap coverage; The BERT model is used to vectorize each software gene block, and the target address of the jump instruction is associated with the position encoding embedding vector to obtain a software gene vector of a specified dimension. The software gene vector of the specified dimension is semantically transformed based on the hash to obtain the software gene hash value after the semantic transformation.

3. The APT attribution analysis method based on large model semantic transformation according to claim 2 is characterized in that: Semantic transformation of software gene vectors based on hashing, including: Use a clustering algorithm to cluster software gene vectors of specified dimensions, classify similar function vectors into one category, and use the centroid to represent each class after clustering; A SHA-256 hash operation is performed on each centroid to convert the software gene vector of the specified dimension into 256 strings, and the CRC8 hash is used to reduce the 256 strings to a string of length 8 to obtain the semantically converted software gene hash value.

4. The APT attribution analysis method based on large model semantic transformation according to claim 2 is characterized in that: Using sliding windows to extract malicious binary sample software gene vectors, also includes: Using scripts and automated tools to batch extract software gene features from malicious binary samples, the software gene features include: import table function name software gene features, string software gene features, function block software gene features and metadata software gene features, the function block software gene features include software gene hash values, the metadata include malicious binary sample file attributes, file hash, resource information, timestamp, digital signature, compiler type, compile time, compile options and compiler version; The software gene feature score is used to obtain the feature score of each software gene, so as to select the key features in the malicious binary sample according to the software gene feature score, and perform structured mapping on the key features of the software gene. The software gene feature score calculation formula is expressed as: Among them, #apt is the number of APT organizations where the software gene feature is located, #count is the total number of times the software gene feature appears in all malicious binary sample data, and #samples is the number of malicious binary samples where the software gene feature is located.

5. The APT attribution analysis method based on large model semantic transformation according to claim 1 is characterized in that: Fine-tune the large language model based on the preset instruction template, including: The self-attention mechanism is used to perform semantic transformation on the input software gene feature elements, the implicit self-attention weights between the input software gene feature elements and the target APT elements are calculated, and high-value software gene feature elements are marked according to the implicit self-attention weights; The self-attention weight between high-value software gene feature elements and low-value software gene feature elements is calculated. If the self-attention weight is greater than the preset threshold, the low-value software gene feature element is retained, and the key feature elements of the software gene are mined through multiple rounds of screening.

6. The APT attribution analysis method based on large model semantic transformation according to claim 1 or 5, characterized in that: Fine-tune the large language model based on the preset instruction template, and also include: The self-attention weights between each feature element after fine-tuning the instruction are used to measure the degree of attention and mutual dependence between it and other feature elements; The positions of the feature elements are adjusted according to the attention levels and interdependencies between the feature elements, so that the related feature elements are adjacent in position, and a list of software gene elements after feature optimization is obtained.

7. The APT attribution analysis method based on large model semantic transformation according to claim 6 is characterized in that: Fine-tune the large language model based on the preset instruction template, and also include: The feature-optimized software gene element list is paired with the original input software gene feature element list, and the sequence-to-sequence model is trained using the encoder and decoder built based on the Transformer model to automatically mine the information features of software gene samples using the trained sequence-to-sequence model.

8. An APT attribution analysis system based on large model semantic transformation, characterized in that: It includes: feature extraction module, instruction fine-tuning module, optimal hyperparameter selection module and APT attribution analysis module, among which: A feature extraction module is used to extract malicious binary sample software gene vectors using a sliding window, and to perform structured mapping on key feature software gene vectors so as to store software gene sample information using a specified data structure, wherein the software gene vectors are formed by sequentially connecting basic blocks of malicious binary sample code according to an assembly process; An instruction fine-tuning module is used to fine-tune the large language model based on a preset instruction template, and use the fine-tuned large language model to retain and delete features in the software gene information to mine and extract key features in the software gene information, and spontaneously form association mappings between various feature elements in different semantic spaces. The preset instruction template prompts the large language model to generate a predicted representation for the key features of the software gene information based on the prefix prompt word, and the association mapping adjusts the positions of adjacent feature elements based on the correlation between the feature elements; The best hyperparameter selection module is used to extract training data sets and evaluation data sets from software gene sample information multiple times according to preset proportions, train and evaluate the large language model based on the training data sets and evaluation data sets extracted each time, and update the hyperparameter candidate set through the hyperparameter adaptive selection mechanism, and obtain the best hyperparameter combination of the large language model based on the best hyperparameter obtained after convergence. The hyperparameter adaptive selection mechanism is used to adaptively select the best hyperparameter combination of the APT attribution analysis task in the hyperparameter space, and the hyperparameter space is composed of a prefix prompt word length candidate set and a rank value candidate set, and the rank is a fine-tuning parameter set according to the weight matrix of the large language model; The APT attribution analysis module is used to fine-tune the APT attribution analysis task on the large language model based on the optimal hyperparameter combination and using the software gene sample information, so that the large language model learns the APT attribution analysis reasoning logic, and uses the large language model after fine-tuning the APT attribution analysis task as the target model, so as to input the APT malicious binary sample to be analyzed into the target model, and use the target model to obtain the attribution analysis of the APT malicious binary sample to be analyzed.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images