Genetic algorithm-based Mal-POBM malicious code adversarial sample generation method
Through the genetic algorithm-based method, the malicious code adversarial sample generation is optimized and modified, which solves the problem of slow convergence speed and difficulty in bypassing the malicious code detection engine in the existing technology, and achieves efficient and effective adversarial sample generation.
Patent Information
- Application Number
- CN202411491069.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-24
- Publication Date
- 2025-02-18
AI Technical Summary
The existing malicious code adversarial sample generation methods have problems such as slow convergence speed, low efficiency, difficulty in ensuring the consistency of original behavior and easy to fall into local optimal solutions, and it is difficult to effectively bypass the malicious code detection engine empowered by artificial intelligence technology.
Using a genetic algorithm-based method, nine operations are modified on the static characteristics of the original sample. On the premise of ensuring the consistency of the original behavior, the convergence speed and circumference are improved by optimizing, crossing, mutation and Cauchy probability catastrophe. Overrate.
It significantly improves the convergence speed and efficiency of malicious code counter-sample generation, ensures the consistency of the original behavior of counter-sample, and improves the ability to bypass malicious code detection engines.
Smart Images
Figure CN119475335A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of network security, and in particular relates to a method for generating Mal-POBM malicious code adversarial samples based on a genetic algorithm. Background Art
[0002] Adversarial samples are created by adding perturbations that are imperceptible to the human eye to the original image. These perturbations will cause the image recognition model to make incorrect judgments. Unlike image adversarial samples, malicious code adversarial samples not only need to bypass the detection model to escape, but also must ensure the executableness of the adversarial samples and the consistency of the original behavior. With the rapid development and popularization of the Internet, the number of malicious codes has increased dramatically, especially portable executable (PE) files on the Windows platform. Malicious codes include viruses, worms, remote access Trojans, zombies, ransomware, and other forms of attacks. However, the resurgence of the artificial intelligence (AI) craze in recent years has greatly boosted the malware's ability to avoid killing, spread, survive, communicate covertly, and strike accurately. The generation of malicious code adversarial samples is of great significance for evaluating and improving malicious code detection systems.
[0003] Many methods for generating adversarial samples of malicious code have a series of limitations. Since most malware detection engines are closed source, it is not feasible to use adversarial attacks based on white-box methods in actual networks, while adversarial attacks based on black-box methods are more practical in the real world. However, adversarial attacks based on black-box methods are difficult to bypass malicious code detection engines enabled by artificial intelligence technology due to the following deficiencies: (1) They are only applicable to specific types of data files (such as PDF), which limits the scope of practical application. (2) The convergence speed of generating malware adversarial samples is slow, and the process of generating adversarial samples on a large scale is time-consuming and inefficient. (3) It is difficult to ensure the consistency of the original behavior of the adversarial samples. (4) It is easy to fall into a local optimal solution, resulting in reduced bypass efficiency. Summary of the invention
[0004] In view of the shortcomings of the prior art, the present invention provides a Mal-POBM malicious code adversarial sample generation method based on a genetic algorithm. The static features of the original sample are modified through nine operations. Under the premise of ensuring the consistency of the original behavior, the convergence speed is greatly increased by optimizing the population. In the generation of adversarial samples, the diversity of the population is increased by crossover and mutation in the local adaptive probability, thereby increasing the probability of finding the optimal solution. When the population is trapped in the local optimal solution, the Cauchy probability is used to catastrophize the population to make it active again. The bypass rate of the adversarial sample is guaranteed by performing black box testing on the target model.
[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is:
[0006] The Mal-POBM malicious code adversarial sample generation method based on genetic algorithm includes:
[0007] The step of modifying the static characteristics of the original sample;
[0008] In adversarial sample generation, the step of optimizing the population by grouping; the step of performing crossover and mutation in local adaptive probability;
[0009] Steps to catastrophize a population using Cauchy probability.
[0010] Furthermore, the Mal-POBM malicious code adversarial sample generation method based on genetic algorithm includes the following steps:
[0011] Step 1: Generate the initial population:
[0012] Select the original sample of PE file and modify the static features of PE file: that is, perform static rewriting operation on PE file based on the layout of PE file; specifically, randomly generate a genome {a1, a2, a3, a4, ..., an} for each individual, and modify the static features of the individual according to the genome to obtain the first generation population after static rewriting;
[0013] Step 2: Detect the initial population through the malicious code detection model:
[0014] The first generation population is scored and tested through the malicious code detection model, and the detection process is optimized through the genetic algorithm GA, and the fitness is recorded;
[0015] Step 3: Generate the pending population:
[0016] Select individuals with fitness that meets the requirements from the initial population and put them into the dynamic sandbox to verify whether the original behavior is consistent. The individuals that retain the original behavior form a pending population.
[0017] Step 4: In the undetermined population, group and optimize the population:
[0018] Adopting the elite strategy, select individuals close to the cutoff point according to the elite ratio v, and enter the next generation population without any modification; select individuals far from the cutoff point according to the elimination ratio w and eliminate them directly; for individuals between the two, crossover and mutation are performed according to the adaptive probability, and then put into the next generation population;
[0019] Step 5: Place the individuals in the next generation population into the dynamic sandbox for dynamic verification:
[0020] First, verify whether the original behavior is consistent. If it is inconsistent, eliminate it directly. If it is consistent, then determine whether the overall fitness of the population has changed compared with the previous few times. If there is a change, return to step 2; otherwise, put the sample into the target model for black-box verification. During black-box verification, if the expected result is not achieved, perform a catastrophe on the population through the Cauchy probability to mutate the population, and return to step 2 again; if it meets expectations, end, and verify that the individual that meets expectations is the final adversarial sample.
[0021] Furthermore, PE files include three layouts: file header, chapter table and data layout. The file header contains basic information of the executable file, the chapter table describes the characteristics of each file chapter, and the data layout contains the actual data related to each chapter; they define the layout of the file and how it is loaded and executed by the operating system.
[0022] Furthermore, in step 1, specifically: randomly generate a genome {a1, a2, a3, a4, ..., an} for each individual, and modify the static characteristics of the individual according to the genome to obtain the statically rewritten first-generation population.
[0023] Furthermore, in step 2, the malicious code detection model MalConv is used as the adversarial target model, the initial population is put into the target model, and the following mathematical definition is made:
[0024] x: Use x to represent the input sample;
[0025] f(x): The maliciousness scoring function f(x) is used to represent the maliciousness score of the input sample x by the MalConv model, f(x)∈[0,1];
[0026] F(x): The detection result is represented by the malicious judgment function F(x), which is specifically used to indicate whether the input sample x is malicious code for the MalConv model. F(x)∈{“-”,“+”}, “-” represents that the input sample is a benign sample, and “+” represents that the input sample is a malicious sample.
[0027] Furthermore, in step 2, when the first generation population is scored by the malicious code detection model, it is combined with the genetic algorithm GA to obtain the following mapping: sample x is used as an individual in the genetic algorithm, the atomic operation a that rewrites the sample is used as a gene, and the malicious code detection model's detection score f(x) for the sample is used as the fitness, and the fitness value range is [0,1], with a cutoff point of 0.5.
[0028] Compared with the prior art, the present invention has the following advantages:
[0029] (1) The static features of the original sample are modified through nine operations. Under the premise of ensuring the consistency of the original behavior, the population is optimized to greatly increase the convergence speed; (2) In the generation of adversarial samples, the population is grouped and optimized, and the diversity of the population is increased by crossover and mutation in the local adaptive probability, thereby increasing the probability of finding the optimal solution. (3) When the population is trapped in the local optimal solution, the Cauchy probability is used to perform a catastrophic change on the population to make it active again. The bypass rate of the adversarial sample is guaranteed by performing black box testing on the target model. (4) The present invention can accurately and quickly generate malicious code adversarial samples, which is of great significance for evaluating and improving malicious code detection systems. BRIEF DESCRIPTION OF THE DRAWINGS
[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.
[0031] Figure 1 This is a schematic diagram of the PE file format;
[0032] Figure 2 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION
[0033] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.
[0034] Definition of terms:
[0035] Genetic Algorithm (GA) is a heuristic search algorithm and belongs to the category of natural evolutionary algorithm (EA). Genetic algorithm generates solutions for optimization and search problems by simulating operations such as mutation and crossover in the natural selection process. The main feature of this algorithm is that it operates directly on the target object, uses probability and statistics to obtain the optimal solution, does not require specific rules, and can adaptively adjust and optimize the search direction.
[0036] Population: In genetic algorithms, a population is a set of individuals that represent a range of potential solutions to a problem space. In this context, a population may contain two types of individuals: malicious file population and benign file population.
[0037] Malicious file population: This refers to those individuals in the population that represent malicious files (such as viruses, Trojans, etc.).
[0038] Benign file population: These refer to those individuals in the population that represent benign files (ie, non-malicious files).
[0039] The Mal-POBM malicious code adversarial sample generation method based on genetic algorithm mainly designs the following aspects:
[0040] Modify the static features of the original sample;
[0041] In adversarial sample generation, the population is grouped and optimized; the diversity of the population is increased by crossover and mutation in local adaptive probability, thereby increasing the probability of finding the optimal solution;
[0042] When the population is trapped in a local optimal solution, the Cauchy probability is used to cause a catastrophic change in the population to make it active again.
[0043] Combination Figure 1 ,The Mal-POBM malicious code adversarial sample generation method based on genetic algorithm, specifically, includes the following steps:
[0044] Step 1: Generate the initial population:
[0045] The original sample of PE file is selected, and the static characteristics of the PE file are modified: that is, the PE file is statically rewritten based on the layout of the PE file; specifically, a genome {a1, a2, a3, a4, ..., an} is randomly generated for each individual, and the static characteristics of the individual are modified according to the genome to obtain the first generation population after static rewriting.
[0046] PE file format is as follows Figure 1 As shown, it consists of a number of headers and sections that tell the dynamic linker how to map the file into memory.
[0047] The layout of a PE file refers to how the data in the file is organized. Generally speaking, a PE file includes three layouts: file header, chapter table, and data layout. The file header contains basic information about the executable file, the chapter table describes the characteristics of each file chapter, and the data layout contains the actual data associated with each chapter; they define the layout of the file and how it is loaded and executed by the operating system. Examples of sections include .text (code section), .data (data section), .rdata (read-only data section), etc.
[0048] "Static" means that the operation is performed when the file is not running, that is, the contents of the file are modified directly, rather than dynamically modified when the program is running.
[0049] Step 2: Detect the initial population through the malicious code detection model:
[0050] The malicious code detection model is used to score and detect the initial population, and the detection process is optimized through the genetic algorithm GA, and the fitness is recorded.
[0051] As a preferred implementation, in step 2, the malicious code detection model MalConv is used as the adversarial target model. The main function of the target model MalConv is to score the inserted PE file to determine whether the file is a malicious file or a benign file.
[0052] The initial population is put into the target model and the following mathematical definition is made:
[0053] x: Use x to represent the input sample;
[0054] f(x): The maliciousness scoring function f(x) is used to represent the maliciousness score of the input sample x by the MalConv model, f(x)∈[0,1];
[0055] F(x): The detection result is represented by the malicious judgment function F(x), which is specifically used to indicate whether the input sample x is malicious code for the MalConv model. F(x)∈{“-”,“+”}, “-” represents that the input sample is a benign sample, and “+” represents that the input sample is a malicious sample; the detection score interval uses 0.5 as the dividing point, that is, when f(x)∈[0,0.5), F(x)=“-”; when f(x)∈[0.5,1.0], F(x)=“+”.
[0056] The ultimate goal of the present invention is to predict adversarial sample instances based on a malicious code detection model based on machine learning, and the following situations may occur: (1) When the input sample x is a benign sample, but f(x)∈[0,0.5), F(x)=“+”. (2) When the input sample x is a malicious sample, but f(x)∈[0.5,1.0], F(x)=“-”.
[0057] In this step 2, when the malicious code detection model is used to score the initial population, it is combined with the genetic algorithm GA to obtain the following mapping: sample x is used as an individual in the genetic algorithm, the atomic operation a that rewrites the sample is used as a gene, and the malicious code detection model uses the sample detection score f(x) as the fitness, and the fitness value range is [0, 1], with a cutoff point of 0.5. (At this time, the sample detection result F(x) represents the population - malicious file population, benign file population)
[0058] Step 3: Generate the pending population:
[0059] Individuals with fitness that meets the requirements are selected from the initial population and placed in a dynamic sandbox to verify whether the original behavior is consistent. Individuals that retain the original behavior form a pending population.
[0060] Step 4: In the undetermined population, group and optimize the population:
[0061] Adopting the elite strategy, individuals close to the dividing point are selected according to the elite ratio v, and enter the next-generation population without any modification; individuals far from the dividing point are selected according to the elimination ratio w and eliminated directly; for individuals between the two, crossover and mutation are performed according to the adaptive probability u, and then put into the next-generation population.
[0062] Elite ratio v: The elite ratio refers to the ratio of elite individuals selected in the population. Elite individuals refer to the individuals with the best performance (i.e., the highest fitness) in the current population. These elite individuals are directly passed to the next generation to ensure that the algorithm does not lose excellent solutions.
[0063] Elimination ratio w: The elimination ratio refers to the proportion of individuals that will be eliminated in the population. These individuals are usually the worst performing individuals (i.e., the lowest fitness) in the current population. These individuals are eliminated to make room for better individuals.
[0064] Crossover and mutation are operations on the genome. Crossover refers to exchanging genes at corresponding positions in the genomes of two parents to produce new offspring. Mutation refers to the transformation of a gene in the genome of a parent into another gene.
[0065] Adaptive probability u: Adaptive probability means that the probability of crossover and mutation is different at different stages of the population. This probability can be adjusted dynamically according to the performance of the population. In the early stage of the population, the probability is higher, and vice versa. For example, if the performance of individuals in the population is very similar (i.e. lack of diversity), the probability of mutation will be increased to introduce more diversity.
[0066] In this embodiment, the final detection result F(x) represents the population - malicious file population and benign file population.
[0067] Step 5: Place the individuals in the next generation population into the dynamic sandbox for dynamic verification:
[0068] First, verify whether the original behavior is consistent. If it is inconsistent, eliminate it directly. If it is consistent, then determine whether the overall fitness of the population has changed compared with the previous few times. If there is a change, return to step 2; otherwise, put the sample into the target model for black-box verification. During black-box verification, if the expected result is not achieved, perform a catastrophe on the population through the Cauchy probability to mutate the population, and return to step 2 again; if it meets expectations, end, and verify that the individual that meets expectations is the final adversarial sample.
[0069] The present invention is the first to apply the Cauchy probability as a catastrophe formula to the generation of malicious code adversarial samples, and uses the Cauchy probability as the basis of Cauchy mutation to the population catastrophe.
[0070] Of course, the above description is not a limitation of the present invention, and the present invention is not limited to the above examples. Any changes, modifications, additions or substitutions made by ordinary technicians in this technical field within the essential scope of the present invention should fall within the protection scope of the present invention.
Claims
1. The Mal-POBM malicious code adversarial sample generation method based on genetic algorithm is characterized by: include: Steps to modify the static features of the original PE file sample; In adversarial sample generation, the step of optimizing the population by grouping; the step of performing crossover and mutation in local adaptive probability; Steps to catastrophize a population using Cauchy probability.
2. According to the genetic algorithm-based Mal-POBM malicious code adversarial sample generation method of claim 1, it is characterized in that: The following steps are involved: Step 1: Generate the initial population: Select the original sample of PE file and modify the static features of PE file: that is, perform static rewriting operation on PE file based on the layout of PE file; Step 2: Detect the initial population through the malicious code detection model: The first generation population is scored and tested through the malicious code detection model, and the detection process is optimized through the genetic algorithm GA, and the fitness is recorded; Step 3: Generate the pending population: Select individuals with fitness that meets the requirements from the initial population and put them into the dynamic sandbox to verify whether the original behavior is consistent. The individuals that retain the original behavior form a pending population. Step 4: In the undetermined population, group and optimize the population: Adopting the elite strategy, select individuals close to the cutoff point according to the elite ratio v, and enter the next generation population without any modification; select individuals far from the cutoff point according to the elimination ratio w and eliminate them directly; for individuals between the two, crossover and mutation are performed according to the adaptive probability, and then put into the next generation population; Step 5: Place the individuals in the next generation population into the dynamic sandbox for dynamic verification: First, verify whether the original behavior is consistent. If it is inconsistent, eliminate it directly. If it is consistent, then determine whether the overall fitness of the population has changed compared with the previous few times. If there is a change, return to step 2; otherwise, put the sample into the target model for black-box verification. During black-box verification, if the expected result is not achieved, perform a catastrophe on the population through the Cauchy probability to mutate the population, and return to step 2 again; if it meets expectations, end, and verify that the individual that meets expectations is the final adversarial sample.
3. The method for generating Mal-POBM malicious code adversarial samples based on genetic algorithm according to claim 2 is characterized in that: PE files include three layouts: file header, chapter table and data layout. The file header contains basic information of the executable file, the chapter table describes the characteristics of each file chapter, and the data layout contains the actual data related to each chapter; they define the layout of the file and how it is loaded and executed by the operating system.
4. The method for generating Mal-POBM malicious code adversarial samples based on genetic algorithm according to claim 2 is characterized in that: In step 1, specifically: randomly generate a genome {a1, a2, a3, a4, ..., an} for each individual, and modify the static characteristics of the individual according to the genome to obtain the statically rewritten first-generation population.
5. The method for generating Mal-POBM malicious code adversarial samples based on genetic algorithm according to claim 4 is characterized in that: In step 2, the malicious code detection model MalConv is used as the adversarial target model, the initial population is put into the target model, and the following mathematical definition is made: x: Use x to represent the input sample; f(x): The maliciousness scoring function f(x) is used to represent the maliciousness score of the input sample x by the MalConv model, f(x)∈[0,1]; F(x): The malicious judgment function F(x) is used to represent the detection result. Specifically, it is used to indicate whether the input sample x of the MalConv model is malicious code. F(x)∈{"-","+"}, "-" represents that the input sample is a benign sample, and "+" represents that the input sample is a malicious sample.
6. The method for generating Mal-POBM malicious code adversarial samples based on genetic algorithm according to claim 5 is characterized in that: In step 2, when the initial population is scored by the malicious code detection model, it is combined with the genetic algorithm GA to obtain the following mapping: sample x is used as an individual in the genetic algorithm, the atomic operation a that rewrites the sample is used as a gene, and the malicious code detection model's detection score f(x) for the sample is used as the fitness. The fitness value range is [0,1], and the cutoff point is 0.5.
Citation Information
Cited By
Unified management method and device for multi-protocol Internet of Things equipment
CN120455563A
A unified management method and device of a multi-protocol internet of things device
CN120455563B