Software security detection system and software security detection method

Abstract

The invention relates to the technical field of software security detection, in particular to a software security detection system and a software security detection method.The software security detection system comprises a code conversion unit, an initial detection unit, a log collection unit, a text processing unit, a feature extraction unit, an anomaly detection unit and an intelligent display unit; specifically, the code conversion unit is used for acquiring a binary code file corresponding to software to be detected, acquiring a byte stream corresponding to the binary file, converting the byte stream into a two-dimensional array, and mapping the two-dimensional array to obtain a grayscale image corresponding to the binary code file. According to the method, the binary code of the to-be-detected software is converted into the grayscale image and the Markov image, initial detection is carried out, potential security threats of the software code can be effectively captured, malicious behaviors or normal software behaviors can be identified from different dimensions through the multi-level detection means, and the detection precision and coverage are enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of software security detection, and in particular to a software security detection system and a software security detection method. Background Art

[0002] Software security refers to a series of technical, management and policy measures taken during software development, operation and maintenance to ensure that the software can run continuously, reliably and safely under various threats, and prevent security issues such as malicious attacks, vulnerability exploits, data leaks, etc.

[0003] Traditional systems often rely on a single static analysis or dynamic analysis method, such as detection only through code signature matching, behavior monitoring or feature extraction. This single detection method can easily be bypassed by malware by modifying the code or using anti-detection technology, resulting in low detection accuracy and limited coverage. When detecting malicious behavior, traditional systems usually only rely on static feature comparison or behavior monitoring, and lack in-depth analysis of software operation logs. Traditional systems usually rely on rules or feature matching for detection, which makes it difficult to process complex high-dimensional data and adapt to changes in new malware. Even machine learning-based detection systems usually rely on a large number of labeled samples for training, and model adjustment and optimization are usually difficult. Traditional systems often require a lot of manual intervention for analysis and judgment, especially when complex security incidents occur. Analysts need to manually retrieve logs, check files, match features, etc., which is inefficient and prone to human errors. Summary of the invention

[0004] The technical problem to be solved by the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a software security detection system and a software security detection method.

[0005] The technical solution adopted to solve the above technical problems is: a software security detection system, including a code conversion unit, an initial detection unit, a log collection unit, a text processing unit, a feature extraction unit, an anomaly detection unit and an intelligent display unit, specifically:

[0006] The code conversion unit is used to obtain a binary code file corresponding to the software to be detected, obtain a byte stream corresponding to the binary file, convert the byte stream into a two-dimensional array, map the two-dimensional array to obtain a grayscale image corresponding to the binary code file, and convert the byte stream corresponding to the binary file into a Markov image, and transmit the grayscale image and the Markov image to the initial detection unit;

[0007] The initial detection unit is used to receive the grayscale image and the Markov image transmitted by the code conversion unit, and perform initial detection on the grayscale image and the Markov image based on the pre-trained initial detection model to obtain the security detection initial label corresponding to the software to be detected, wherein the security detection initial label includes a malware label and a normal software label, and transmits the security detection initial label corresponding to the software to be detected to the log collection unit and the intelligent display unit;

[0008] The log collection unit is used to receive the initial security detection label corresponding to the software to be detected transmitted by the initial detection unit, and determine whether the initial security detection label corresponding to the software to be detected is a malware label. If it is a malware label, the log information of the software to be detected is collected to obtain the log information of the software to be detected, and the log information is transmitted to the text processing unit.

[0009] Preferably, the text processing unit is used to receive the log information transmitted by the log collection unit, convert the log information into log text, pre-process the log text to obtain a standard log text, and transmit the standard log text to the feature extraction unit;

[0010] The feature extraction unit is used to receive the standard log text transmitted by the text processing unit, and perform feature keyword segmentation on the standard log text to obtain a feature keyword segmentation sequence corresponding to the standard log text, obtain the number of word co-occurrences of the feature keyword segmentation sequence based on a word co-occurrence window, construct a word frequency bigram based on the feature keyword segmentations in the feature keyword segmentation sequence and the number of word co-occurrences corresponding to the feature keyword segmentations, construct a word frequency vector sequence of the feature keyword segmentation sequence based on the word frequency bigram, obtain a word frequency vector sequence corresponding to the standard log text based on the word frequency vector sequence of the feature keyword segmentation sequence, and transmit the word frequency vector sequence corresponding to the standard log text to the anomaly detection unit.

[0011] Preferably, the anomaly detection unit is used to receive the word frequency vector sequence corresponding to the standard log text transmitted by the feature extraction unit, and perform anomaly detection on the word frequency vector sequence corresponding to the standard log text based on a pre-trained anomaly detection model to obtain an anomaly detection label corresponding to the software to be detected, wherein the anomaly detection model adopts an improved support vector machine model, and optimizes the parameters to be optimized of the support vector machine model based on an optimization algorithm, and transmits the anomaly detection label corresponding to the software to be detected to the intelligent display unit;

[0012] The intelligent display unit is used to receive the security detection initial label corresponding to the software to be detected transmitted by the initial detection unit and the abnormal detection label corresponding to the software to be detected transmitted by the abnormal detection unit, and display the security detection initial label and abnormal detection label corresponding to the software to be detected on a preset display terminal.

[0013] Preferably, converting the byte stream corresponding to the binary file into a Markov image comprises:

[0014] Construct a 256×256 matrix, each element of the matrix represents the frequency of two bytes, and initialize each element in the matrix to 0, wherein the coordinates (i, j) of each element of the matrix represent the frequency of a byte pair combination, wherein i and j range from 0 to 255;

[0015] Based on a preset sliding window, two consecutive bytes are read each time, wherein the two bytes are processed as a tuple, and the combination of the two bytes represents a coordinate point in a 256×256 matrix;

[0016] Each coordinate point in the matrix is ​​added with 1 according to the frequency of the byte pair to obtain a byte frequency table;

[0017] Calculate a byte probability table of the byte stream corresponding to the binary file based on the byte frequency table;

[0018] The byte probability table is logarithmically transformed to obtain a Markov image.

[0019] Preferably, the calculation formula of the byte probability is as follows:

[0020]

[0021] Among them, BPT ij represents the probability of the i-th row and j-th column in the matrix, BFT ij represents the frequency distribution of the i-th row and j-th column in the matrix, S i Represents the total frequency of the i-th row in the matrix;

[0022] The calculation formula for pixels in the Markov image is as follows:

[0023]

[0024] Among them, GI ij It represents the pixel obtained by converting the element in the i-th row and j-th column of the byte probability table into a grayscale value, p(i,j) represents the element value in the i-th row and j-th column of the byte probability table, c represents a preset constant parameter, and L represents the number of gray levels.

[0025] Preferably, the initial detection model includes a feature extraction module, a feature fusion module and a classification module, the feature extraction module uses two ResNet50s to respectively extract the first feature map of the grayscale image and the second feature map of the Markov image, the feature fusion module is used to calculate the first weight map and the second weight map of the first feature map through average pooling and maximum pooling operations, and reduce the dimension through the convolution kernel, and activate through the activation function to obtain the third weight map of the first weight map and the second weight map, splice the third weight map and the second feature map to obtain a gray-Markov feature map, obtain the fourth weight map of the gray-Markov feature map through the channel attention module, and activate the fourth weight map and the gray-Markov feature map through the activation function to obtain a fused feature, wherein the channel attention module uses the ECANet model, and the classification module uses the Sigmoid activation function to perform binary classification on the fused feature.

[0026] Preferably, the parameters to be optimized of the support vector machine model are optimized based on an optimization algorithm, including:

[0027] Mapping the parameters to be optimized of the support vector machine model to the individual positions of the optimization algorithm, wherein the parameters to be optimized include the parameters of the kernel function and the penalty parameters, taking the classification error rate of the support vector machine model as the fitness value of the optimization algorithm, and initializing the individual population and the maximum number of iterations of the optimization algorithm;

[0028] Each of the individuals performs an exploration operation and a development operation, and determines the next behavior operation according to the results of the exploration operation and the development operation, wherein the next behavior operation includes the exploration operation and the development operation. After a round of searching, according to the fitness value of each of the individuals obtained, the optimal fitness value is stored in the optimal solution individual position;

[0029] During the iterative optimization process, iteration is performed according to the fitness value of the individual to determine whether the number of iterations meets the maximum number of iterations. If so, the iteration is terminated and the parameters corresponding to the best individual position are output, and the optimal parameters to be optimized are output. The support vector machine model is improved based on the optimal parameters to be optimized. Otherwise, the above operations are repeated.

[0030] Preferably, the position update formula of the exploration operation is as follows:

[0031] X(t+1)=X(t)·σ+r·)Xbest-I·X(t);

[0032] Among them, X(t+1) and X(t) represent the individual positions at the t+1th and tth iterations of the exploration operation, σ represents the wavelet function perturbation factor, r represents a random number in the interval [0,1], Xbest represents the individual position of the optimal solution, and I represents a random number in the interval [0,2].

[0033] Preferably, the position update formula of the development operation is as follows:

[0034]

[0035] in, and represents the position of the individual at the t+1th and tth iterations of the development operation, ub local and lb local represents the upper and lower bounds of the j-th dimension variable updated with the number of iterations, Rmv represents the interaction between the current individual and the random individual, bf represents the benefit factor, which is randomly selected as 1 or 2.

[0036] The technical solution adopted to solve the above technical problems is: a software security detection method, which is applicable to the software security detection system, including:

[0037] Obtain a binary code file corresponding to the software to be detected, obtain a byte stream corresponding to the binary file, and convert the byte stream into a grayscale image and a Markov image;

[0038] Performing initial detection on the grayscale image and the Markov image to obtain an initial security detection label corresponding to the software to be detected;

[0039] Determine whether the initial security detection label corresponding to the software to be detected is a malware label, and if it is a malware label, collect the log information of the software to be detected to obtain the log information of the software to be detected;

[0040] Convert the log information into log text, preprocess the log text to obtain standard log text, and obtain a word frequency vector sequence corresponding to the standard log text;

[0041] Based on the pre-trained anomaly detection model, anomaly detection is performed on the word frequency vector sequence corresponding to the standard log text to obtain the anomaly detection label corresponding to the software to be detected, and the security detection initial label and anomaly detection label corresponding to the software to be detected are displayed on a preset display terminal.

[0042] The beneficial effects of the present invention are as follows: (1) The present invention can effectively capture the potential security threats of the software code by converting the binary code of the software to be detected into a grayscale image and a Markov image and performing an initial detection. This multi-level detection method can identify malicious behavior or normal software behavior from different dimensions, thereby enhancing the accuracy and coverage of the detection. When the software is initially determined to be malicious software, the system further mines clues of malicious behavior by collecting and analyzing the log information of the software. The log information is important evidence in the software operation process. By preprocessing the log text, extracting keywords and analyzing word frequency, potential abnormal patterns or security risks can be discovered. (2) The present invention uses a support vector machine model based on an optimization algorithm for anomaly detection. The system can intelligently identify potential threats in the log. The advantage of SVM is that it can process high-dimensional data and can still show high detection performance when there are fewer samples. By tuning the model through the optimization algorithm, the accuracy and efficiency of detection can be further improved; (3) The present invention integrates the initial detection label and the abnormal detection label through the intelligent display unit and presents them on the preset display terminal, making the detection result more intuitive and easy to understand. The user can quickly obtain the security status of the software, whether it is normal or abnormal, and can provide clear feedback to facilitate subsequent processing and decision-making. In addition, through a comprehensive automated detection process, from code conversion, preliminary detection, log collection to final abnormality detection and display, the system can complete complex security analysis tasks without too much manual intervention, greatly improving the detection efficiency and automation level. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A schematic diagram of the system architecture of the overall system in an embodiment of the present invention;

[0044] Figure 2 A schematic flow chart of the steps of an overall method in an embodiment of the present invention.

[0045] Figure numerals: 1. code conversion unit; 2. initial detection unit; 3. log collection unit; 4. text processing unit; 5. feature extraction unit; 6. anomaly detection unit; 7. intelligent display unit. DETAILED DESCRIPTION

[0046] Embodiment 1, as Figure 1 As shown, the software security detection system proposed in the present invention includes a code conversion unit 1, an initial detection unit 2, a log collection unit 3, a text processing unit 4, a feature extraction unit 5, an anomaly detection unit 6 and an intelligent display unit 7. Specifically:

[0047] The code conversion unit 1 is used to obtain the binary code file corresponding to the software to be detected, obtain the byte stream corresponding to the binary file, convert the byte stream into a two-dimensional array, map the two-dimensional array to obtain a grayscale image corresponding to the binary code file, and convert the byte stream corresponding to the binary file into a Markov image, and transmit the grayscale image and the Markov image to the initial detection unit 2;

[0048] The initial detection unit 2 is used to receive the grayscale image and the Markov image transmitted by the code conversion unit 1, and perform initial detection on the grayscale image and the Markov image based on the pre-trained initial detection model to obtain the security detection initial label corresponding to the software to be detected, wherein the security detection initial label includes a malware label and a normal software label, and transmits the security detection initial label corresponding to the software to be detected to the log collection unit 3 and the intelligent display unit 7;

[0049] The log collection unit 3 is used to receive the initial security detection label corresponding to the software to be detected transmitted by the initial detection unit 2, and determine whether the initial security detection label corresponding to the software to be detected is a malware label. If it is a malware label, the log information of the software to be detected is collected to obtain the log information of the software to be detected, and the log information is transmitted to the text processing unit 4.

[0050] In the present invention, binary file refers to computer programs usually stored in binary form. Binary files contain data of executable code. By obtaining and analyzing these files, it is possible to check whether there is malicious behavior in them; byte stream is a data representation method, which means representing data in bytes (8 bits); in image processing, images are often represented in the form of two-dimensional arrays, where each array element represents the color or grayscale value of a pixel; grayscale images are images without color, only different brightness of gray, and are usually used to represent the intensity of images; Markov images are image representation methods based on Markov chain models, which are used to describe the dependency relationship between pixels, and are usually used to describe the probabilistic relationship between each pixel point in an image, helping to identify the characteristics of the image; detailed information records generated when the software is running, usually containing data such as errors, warnings or operation steps, may help analyze the behavior of the software, especially in malware analysis, log information can often reveal potential malicious behavior.

[0051] In an optional embodiment, the text processing unit 4 is used to receive the log information transmitted by the log collection unit 3, convert the log information into log text, preprocess the log text to obtain standard log text, and transmit the standard log text to the feature extraction unit 5.

[0052] It should be noted that to extract information from log sources, it is first necessary to extract relevant original log data from log sources such as system logs, application logs, and server logs. These log data may be in text format, binary format, or stored in a database; converting to a readable text format means that if the log information is stored in binary or other non-text formats, it needs to be converted into a standard text format. Common methods include decoding binary data into strings, or parsing formats such as JSON into text; preprocessing is a key step in data cleaning and preparation. The purpose is to standardize, denoise, and format the log text for subsequent analysis. The preprocessing of log text usually includes the following steps: removing irrelevant content, removing stop words, unifying time formats, time zone processing, removing extra spaces, converting special characters, and standardizing log levels.

[0053] In an optional embodiment, the feature extraction unit 5 is used to receive the standard log text transmitted by the text processing unit 4, and perform feature keyword segmentation on the standard log text to obtain a feature keyword segmentation sequence corresponding to the standard log text, obtain the number of word co-occurrences of the feature keyword segmentation sequence based on the word co-occurrence window, construct a word frequency bigram based on the feature keyword segmentations in the feature keyword segmentation sequence and the number of word co-occurrences corresponding to the feature keyword segmentations, construct a word frequency vector sequence of the feature keyword segmentation sequence based on the word frequency bigram, obtain the word frequency vector sequence corresponding to the standard log text based on the word frequency vector sequence of the feature keyword segmentation sequence, and transmit the word frequency vector sequence corresponding to the standard log text to the anomaly detection unit 6.

[0054] It should be noted that the method of obtaining the word co-occurrence count of a feature keyword word segmentation sequence based on a word co-occurrence window includes: determining a fixed co-occurrence window size for defining the conditions under which two words are considered to co-occur in a text. The co-occurrence window size refers to the maximum number of words between two words in a text. For example, if the window size is w=2w=2, then within a window, the two words must be no more than 2 words apart to be considered co-occurring; using a sliding window technique to traverse the entire word segmentation sequence, specifically, starting from each position in the text, forming a window, and scanning all word pairs in the window; for each word pair that appears in the window, counting their co-occurrence counts, and a word pair counting table (or dictionary) can be constructed to record the co-occurrence counts of each word pair; counting their co-occurrence counts for all word pairs obtained from the window scan, and finally, the co-occurrence counts of each word pair can be represented as a counting matrix or a sparse matrix, and each element of the matrix represents the co-occurrence count of the corresponding word pair.

[0055] In an optional embodiment, the anomaly detection unit 6 is used to receive the word frequency vector sequence corresponding to the standard log text transmitted by the feature extraction unit 5, and perform anomaly detection on the word frequency vector sequence corresponding to the standard log text based on a pre-trained anomaly detection model to obtain an anomaly detection label corresponding to the software to be detected, wherein the anomaly detection model adopts an improved support vector machine model, and optimizes the parameters to be optimized of the support vector machine model based on an optimization algorithm, and transmits the anomaly detection label corresponding to the software to be detected to the intelligent display unit 7.

[0056] It should be noted that the optimization algorithm is an algorithm used to find the optimal values ​​of model parameters. In machine learning, the goal of the optimization algorithm is to adjust the parameters of the model so that the model can predict or classify most accurately. In the support vector machine (SVM), the optimization goal is usually to maximize the classification boundary or minimize the misclassification; the word frequency vector refers to a vector representation in text data, in which each element corresponds to the frequency of occurrence of a specific word in the log text. The word frequency vector is usually used in natural language processing (NLP) and text analysis, and can convert text data into a numerical form that can be processed by machine learning algorithms.

[0057] In an optional embodiment, the intelligent display unit 7 is used to receive the security detection initial label corresponding to the software to be detected transmitted by the initial detection unit 2 and the abnormal detection label corresponding to the software to be detected transmitted by the abnormal detection unit 6, and display the security detection initial label and the abnormal detection label corresponding to the software to be detected on a preset display terminal.

[0058] It should be noted that the preset display terminal refers to a display device configured in the system for displaying the detection results, which is usually a display, a screen or a graphical user interface (GUI) for displaying the information received from each detection unit.

[0059] Embodiment 2, the software security detection system proposed by the present invention, compared with embodiment 1, this embodiment further includes: converting the byte stream corresponding to the binary file into a Markov image, including:

[0060] Construct a 256×256 matrix, where each element of the matrix represents the frequency of two bytes. Initialize each element in the matrix to 0, where the coordinates i, j of each element of the matrix represent the frequency of a byte pair combination, where i and j range from 0 to 255;

[0061] Based on a preset sliding window, two consecutive bytes are read each time, wherein the two bytes are processed as a tuple, and the combination of the two bytes represents a coordinate point in a 256×256 matrix;

[0062] Each coordinate point in the matrix is ​​added with 1 according to the frequency of the byte pair to obtain a byte frequency table;

[0063] Calculate a byte probability table of the byte stream corresponding to the binary file based on the byte frequency table;

[0064] The byte probability table is logarithmically transformed to obtain a Markov image.

[0065] In this embodiment, the byte probability table is calculated based on the byte frequency table, which records the probability of occurrence of each byte pair. The probability is obtained by dividing the frequency value by the total byte logarithm. The logarithmic transformation is a mathematical method that converts a value into its logarithm, usually using the natural logarithm (log). This transformation is usually used to compress the data range, making high-frequency values ​​less significant, thereby highlighting low-frequency or less common events.

[0066] In an optional embodiment, the calculation formula of the byte probability is as follows:

[0067]

[0068] Among them, BPT ij represents the probability of the i-th row and j-th column in the matrix, BFT ij represents the frequency distribution of the i-th row and j-th column in the matrix, S i Represents the total frequency of the i-th row in the matrix;

[0069] The calculation formula for pixels in a Markov image is as follows:

[0070]

[0071] Among them, GI ij It represents the pixel obtained by converting the element in the i-th row and j-th column of the byte probability table into a grayscale value, p(i,j) represents the element value in the i-th row and j-th column of the byte probability table, c represents a preset constant parameter, and L represents the number of gray levels.

[0072] In an optional embodiment, the initial detection model includes a feature extraction module, a feature fusion module and a classification module. The feature extraction module uses two ResNet50s to extract the first feature map of the grayscale image and the second feature map of the Markov image respectively. The feature fusion module is used to calculate the first weight map and the second weight map of the first feature map through average pooling and maximum pooling operations, and reduce the dimension through the convolution kernel, and activate through the activation function to obtain a third weight map of the first weight map and the second weight map, splice the third weight map and the second feature map to obtain a grayscale-Markov feature map, obtain the fourth weight map of the grayscale-Markov feature map through the channel attention module, and activate the fourth weight map and the grayscale-Markov feature map through the activation function to obtain a fused feature, wherein the channel attention module uses the ECANet model, and the classification module uses the Sigmoid activation function to perform binary classification on the fused feature.

[0073] It should be noted that ResNet50 is a classic convolutional neural network architecture with 50 layers. ResNet (Residual Networks) solves the gradient vanishing and degradation problems of deep neural networks during training by introducing residual blocks. ResNet50 is used to extract deep features of images, and is used here to extract features of two different input images respectively. The channel attention mechanism is a mechanism used in deep learning to dynamically adjust the importance of each channel (the depth of the feature map). By calculating the importance of each channel, the network can focus on channels that are more important to the classification task and ignore irrelevant or unimportant channels. The grayscale-Markov feature map refers to a fused feature map obtained by splicing the third weight map and the second feature map (the feature map extracted from the Markov image). This fused feature map combines the features of the grayscale image and the Markov image and can provide more information. The sigmoid function is often used in binary classification tasks to compress the output value to the (0,1) interval, indicating the probability that the input belongs to a certain category. In binary classification tasks, the output result is usually mapped to 0 or 1 to indicate the prediction of the category.

[0074] In an optional embodiment, optimizing the parameters to be optimized of the support vector machine model based on an optimization algorithm includes:

[0075] The parameters to be optimized of the support vector machine model are mapped to the individual positions of the optimization algorithm. The parameters to be optimized include the parameters of the kernel function and the penalty parameters. The classification error rate of the support vector machine model is used as the fitness value of the optimization algorithm. The individual population and the maximum number of iterations of the optimization algorithm are initialized.

[0076] Each individual performs exploration and development operations, and determines the next action based on the results of the exploration and development operations. The next action includes exploration and development operations. After a round of search, the optimal fitness value is stored in the optimal solution individual position based on the fitness value of each individual.

[0077] In the iterative optimization process, iteration is performed according to the fitness value of the individual to determine whether the number of iterations meets the maximum number of iterations. If so, the iteration is terminated and the parameters corresponding to the best individual position are output, and the optimal parameters to be optimized are output. The support vector machine model is improved based on the optimal parameters to be optimized. Otherwise, the above operations are repeated.

[0078] In an optional embodiment, the position update formula of the exploration operation is as follows:

[0079] X(t+1)=X(t)·σ+r·(Xbest-I·X(t));

[0080] Among them, X(t+1) and X(t) represent the individual positions at the t+1th and tth iterations of the exploration operation, σ represents the wavelet function perturbation factor, r represents a random number in the interval [0,1], Xbest represents the individual position of the optimal solution, and I represents a random number in the interval [0,2].

[0081] In an optional embodiment, the position update formula of the development operation is as follows:

[0082]

[0083] in, and represents the position of the individual at the t+1th and tth iterations of the development operation, ub local and lb local represents the upper and lower bounds of the j-th dimension variable updated with the number of iterations, Rmv represents the interaction between the current individual and the random individual, bf represents the benefit factor, which is randomly selected as 1 or 2.

[0084] Embodiment three, as Figure 2 As shown, the software security detection method proposed by the present invention is applicable to a software security detection system, including:

[0085] S1. Obtain the binary code file corresponding to the software to be detected, obtain the byte stream corresponding to the binary file, and convert the byte stream into a grayscale image and a Markov image;

[0086] S2, performing initial detection on the grayscale image and the Markov image to obtain an initial security detection label corresponding to the software to be detected;

[0087] S3, determining whether the initial security detection label corresponding to the software to be detected is a malware label, and if it is a malware label, collecting log information of the software to be detected to obtain the log information of the software to be detected;

[0088] S4, converting the log information into log text, preprocessing the log text to obtain a standard log text, and obtaining a word frequency vector sequence corresponding to the standard log text;

[0089] S5. Perform anomaly detection on the word frequency vector sequence corresponding to the standard log text based on the pre-trained anomaly detection model to obtain the anomaly detection label corresponding to the software to be detected, and display the security detection initial label and anomaly detection label corresponding to the software to be detected on a preset display terminal.

[0090] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited thereto, and various changes can be made within the knowledge scope of technicians in the relevant technical field without departing from the purpose of the present invention.

Claims

1. Software security detection system, characterized in that: The system comprises a code conversion unit (1), an initial detection unit (2), a log collection unit (3), a text processing unit (4), a feature extraction unit (5), an anomaly detection unit (6) and an intelligent display unit (7), specifically: The code conversion unit (1) is used to obtain a binary code file corresponding to the software to be detected, obtain a byte stream corresponding to the binary file, convert the byte stream into a two-dimensional array, map the two-dimensional array to obtain a grayscale image corresponding to the binary code file, and convert the byte stream corresponding to the binary file into a Markov image, and transmit the grayscale image and the Markov image to the initial detection unit (2); The initial detection unit (2) is used to receive the grayscale image and the Markov image transmitted by the code conversion unit (1), and perform initial detection on the grayscale image and the Markov image based on a pre-trained initial detection model to obtain a security detection initial label corresponding to the software to be detected, wherein the security detection initial label includes a malware label and a normal software label, and transmits the security detection initial label corresponding to the software to be detected to the log collection unit (3) and the intelligent display unit (7); The log collection unit (3) is used to receive the security detection initial label corresponding to the software to be detected transmitted by the initial detection unit (2), and determine whether the security detection initial label corresponding to the software to be detected is a malware label. If it is a malware label, the log information of the software to be detected is collected to obtain the log information of the software to be detected, and the log information is transmitted to the text processing unit (4).

2. The software security detection system according to claim 1, characterized in that: The text processing unit (4) is used to receive the log information transmitted by the log collection unit (3), convert the log information into log text, pre-process the log text to obtain a standard log text, and transmit the standard log text to the feature extraction unit (5); The feature extraction unit (5) is used to receive the standard log text transmitted by the text processing unit (4), and perform feature keyword segmentation on the standard log text to obtain a feature keyword segmentation sequence corresponding to the standard log text, obtain the number of word co-occurrences of the feature keyword segmentation sequence based on a word co-occurrence window, construct a word frequency tuple based on the feature keyword segments in the feature keyword segmentation sequence and the number of word co-occurrences corresponding to the feature keyword segments, construct a word frequency vector sequence of the feature keyword segmentation sequence based on the word frequency tuple, obtain a word frequency vector sequence corresponding to the standard log text based on the word frequency vector sequence of the feature keyword segmentation sequence, and transmit the word frequency vector sequence corresponding to the standard log text to the anomaly detection unit (6).

3. The software security detection system according to claim 2, characterized in that: The anomaly detection unit (6) is used to receive the word frequency vector sequence corresponding to the standard log text transmitted by the feature extraction unit (5), and perform anomaly detection on the word frequency vector sequence corresponding to the standard log text based on a pre-trained anomaly detection model to obtain an anomaly detection label corresponding to the software to be detected, wherein the anomaly detection model adopts an improved support vector machine model, and optimizes the parameters to be optimized of the support vector machine model based on an optimization algorithm, and transmits the anomaly detection label corresponding to the software to be detected to the intelligent display unit (7); The intelligent display unit (7) is used to receive the security detection initial label corresponding to the software to be detected transmitted by the initial detection unit (2) and the abnormal detection label corresponding to the software to be detected transmitted by the abnormal detection unit (6), and display the security detection initial label and the abnormal detection label corresponding to the software to be detected on a preset display terminal.

4. The software security detection system according to claim 1, characterized in that: Converting the byte stream corresponding to the binary file into a Markov image includes: Construct a 256×256 matrix, each element of the matrix represents the frequency of two bytes, and initialize each element in the matrix to 0, wherein the coordinates (i, j) of each element of the matrix represent the frequency of a byte pair combination, wherein i and j range from 0 to 255; Based on a preset sliding window, two consecutive bytes are read each time, wherein the two bytes are processed as a tuple, and the combination of the two bytes represents a coordinate point in a 256×256 matrix; Each coordinate point in the matrix is ​​added with 1 according to the frequency of the byte pair to obtain a byte frequency table; Calculate a byte probability table of the byte stream corresponding to the binary file based on the byte frequency table; The byte probability table is logarithmically transformed to obtain a Markov image.

5. The software security detection system according to claim 4, characterized in that: The calculation formula of the byte probability is as follows: Among them, BPT ij represents the probability of the i-th row and j-th column in the matrix, BFT ij represents the frequency distribution of the i-th row and j-th column in the matrix, S i Represents the total frequency of the i-th row in the matrix; The calculation formula for pixels in the Markov image is as follows: Among them, GI ij It represents the pixel obtained by converting the element in the i-th row and j-th column of the byte probability table into a grayscale value, p(i,j) represents the element value in the i-th row and j-th column of the byte probability table, c represents a preset constant parameter, and L represents the number of gray levels.

6. The software security detection system according to claim 1, characterized in that: The initial detection model includes a feature extraction module, a feature fusion module and a classification module. The feature extraction module uses two ResNet50s to respectively extract the first feature map of the grayscale image and the second feature map of the Markov image. The feature fusion module is used to calculate the first weight map and the second weight map of the first feature map through average pooling and maximum pooling operations, and perform dimensionality reduction through a convolution kernel and activation through an activation function to obtain a third weight map of the first weight map and the second weight map, and splice the third weight map and the second feature map to obtain a gray-Markov feature map. The fourth weight map of the gray-Markov feature map is obtained through a channel attention module, and the fourth weight map and the gray-Markov feature map are activated through an activation function to obtain a fused feature, wherein the channel attention module uses an ECANet model, and the classification module uses a Sigmoid activation function to perform binary classification on the fused feature.

7. The software security detection system according to claim 3, characterized in that: Optimize the parameters to be optimized of the support vector machine model based on the optimization algorithm, including: Mapping the parameters to be optimized of the support vector machine model to the individual positions of the optimization algorithm, wherein the parameters to be optimized include the parameters of the kernel function and the penalty parameters, taking the classification error rate of the support vector machine model as the fitness value of the optimization algorithm, and initializing the individual population and the maximum number of iterations of the optimization algorithm; Each of the individuals performs an exploration operation and a development operation, and determines the next behavior operation according to the results of the exploration operation and the development operation, wherein the next behavior operation includes the exploration operation and the development operation. After a round of searching, according to the fitness value of each of the individuals obtained, the optimal fitness value is stored in the optimal solution individual position; During the iterative optimization process, iteration is performed according to the fitness value of the individual to determine whether the number of iterations meets the maximum number of iterations. If so, the iteration is terminated and the parameters corresponding to the best individual position are output, and the optimal parameters to be optimized are output. The support vector machine model is improved based on the optimal parameters to be optimized. Otherwise, the above operations are repeated.

8. The software security detection system according to claim 7, characterized in that: The position update formula of the exploration operation is as follows: X(t+1)=X(t)·σ+r·(Xbest-I·X(t)); Among them, X(t+1) and X(t) represent the individual positions at the t+1th and tth iterations of the exploration operation, σ represents the wavelet function perturbation factor, r represents a random number in the interval [0,1], Xbest represents the individual position of the optimal solution, and I represents a random number in the interval [0,2].

9. The software security detection system according to claim 8, characterized in that: The position update formula for the development operation is as follows: in, and represents the position of the individual at the t+1th and tth iterations of the development operation, ub local and lb local represents the upper and lower bounds of the j-th dimension variable updated with the number of iterations, Rmv represents the interaction between the current individual and the random individual, bf represents the benefit factor, which is randomly selected as 1 or 2.

10. A software security detection method, which is applicable to the software security detection system according to any one of claims 1 to 9, characterized in that: include: Obtain a binary code file corresponding to the software to be detected, obtain a byte stream corresponding to the binary file, and convert the byte stream into a grayscale image and a Markov image; Performing initial detection on the grayscale image and the Markov image to obtain an initial security detection label corresponding to the software to be detected; Determine whether the initial security detection label corresponding to the software to be detected is a malware label, and if it is a malware label, collect the log information of the software to be detected to obtain the log information of the software to be detected; Convert the log information into log text, preprocess the log text to obtain standard log text, and obtain a word frequency vector sequence corresponding to the standard log text; Based on the pre-trained anomaly detection model, anomaly detection is performed on the word frequency vector sequence corresponding to the standard log text to obtain the anomaly detection label corresponding to the software to be detected, and the security detection initial label and anomaly detection label corresponding to the software to be detected are displayed on a preset display terminal.

Images