Malicious software interception method for flexible gray calculation in host security protection

Abstract

The invention discloses a malicious software interception method for flexible gray calculation in host security protection, and relates to the technical field of network security. Obtaining an assembly language source file and an executable file of the target access software, and performing feature extraction to obtain a frequency feature, a semantic feature and a byte feature; updating a preset malicious software detection model according to the frequency features, the semantic features and the byte features to obtain a target malicious software detection model; simulating log data when the target access software is operated; generating a grayscale image according to the log data, and substituting the grayscale image into the target malicious software detection model to obtain the malicious level of the target access software; and performing related interception on the target access software according to the malicious level. According to the method, the frequency, semantic and byte features are extracted, the malicious software detection model is updated according to the features, the log data are acquired through the simulation running software, and the gray level image is generated for malicious software recognition, so that the interception efficiency of the malicious software is improved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method for intercepting malware using flexible grayscale calculation in host security protection. Background Technology

[0002] In the wave of digitalization, mainframes, as the core data storage and business operation carriers of enterprises, serve as the last line of defense for network security. However, current mainstream mainframe security protection systems primarily rely on a rigid "blacklist / whitelist" approach for malware interception. This approach is based on a passive defense logic built upon a "known threat database": it matches program signatures against a pre-set malware signature database (blacklist), and if a complete match is found, interception is triggered. For unknown programs not included in the blacklist, the only options are to allow them by default or block them directly, lacking an intermediate assessment of the program's risk level. With the rapid iteration of malware technology and increasingly complex attack methods, this black-and-white judgment logic has revealed irreconcilable systemic flaws.

[0003] Patent CN111259392A discloses a method and apparatus for intercepting malware based on a kernel module. The method determines that a kernel module loading notification has been detected, performs a legality check on the kernel module information, and obtains a legality check result. The legality check includes at least detecting the existence of an uninitialization function. If the legality check result is determined to be invalid, then it is determined that malware is loading a kernel module, and the malware is intercepted.

[0004] However, most auxiliary detection methods rely on static feature analysis, which identifies threats by extracting static information such as executable file byte features. This is insufficient to deal with malware countermeasures such as code obfuscation. When faced with unknown malware not included in the feature library, neither the "blacklist / whitelist" model nor traditional static analysis methods can effectively identify it, resulting in low interception efficiency and failing to meet the security protection needs of hosts against dynamic threats. Summary of the Invention

[0005] The purpose of this invention is to solve the problem that most existing malware interception methods still rely on static feature analysis or blacklist / whitelist models, which cannot cope with code obfuscation and have low interception efficiency when facing unknown malware. Therefore, this invention proposes a malware interception method based on flexible grayscale calculation in host security protection.

[0006] This invention proposes a method for intercepting malware using flexible grayscale calculation in host security protection, the method comprising:

[0007] Obtain the assembly language source files and executable files of the target access software;

[0008] Frequency features, semantic features, and byte features are obtained by performing feature extraction on the assembly language source file and the executable file;

[0009] The target parameters are obtained by substituting the frequency features, semantic features, and byte features into a preset parameter extraction model.

[0010] The target malware detection model is obtained by updating the preset malware detection model according to the target parameters;

[0011] Simulate the operation of the target access software and obtain the log data of the target access software during operation;

[0012] A grayscale image is generated based on the log data, and the grayscale image is substituted into the target malware detection model to obtain the malware level of the target access software; the malware level is divided into safe, normal and dangerous.

[0013] The target access software is blocked based on the level of malice.

[0014] Optionally, feature extraction of the assembly language source file and the executable file to obtain frequency features, semantic features, and byte features includes:

[0015] The assembly language source file is scanned line by line, and the operation instruction code sequence is extracted by referring to the code dictionary;

[0016] Feature extraction is performed on the operation instruction code sequence to obtain instruction opcode frequency features and instruction opcode semantic features;

[0017] The executable file is subjected to regular expression extraction to obtain byte sequences and readable characters;

[0018] Feature extraction is performed on the readable characters to obtain readable character frequency features and readable character semantic features;

[0019] Byte features are obtained by performing feature extraction on the byte sequence;

[0020] Frequency features are obtained by frequency fusion of the instruction opcode frequency features and the readable character frequency features;

[0021] The semantic features are obtained by semantic fusion of the semantic features of the instruction opcode and the semantic features of the readable characters.

[0022] Optionally, feature extraction of the operation instruction code sequence to obtain instruction opcode frequency features and instruction opcode semantic features includes:

[0023] The first frequency feature set is obtained by calculating the frequency and proportion of each opcode in the operation instruction code sequence;

[0024] The co-occurrence pattern of N opcodes in the operation instruction code sequence is calculated to obtain a second frequency feature set; the co-occurrence pattern is a combination of N consecutive opcodes appearing simultaneously in a specific order;

[0025] The frequency of occurrence of each functional class in the operation instruction code sequence is calculated to obtain a third frequency feature set; the functional classes include data transmission class, control flow class, and computation class;

[0026] The first frequency feature set, the second frequency feature set, and the third frequency feature set are normalized and then concatenated to obtain the instruction opcode frequency feature.

[0027] The operation instruction code sequence is divided into subsequence sets by using control flow parameters as boundaries; the control flow parameters include function calls, function returns, and unconditional jumps;

[0028] Substituting the subsequence set into the semantic feature extraction model yields the semantic features of the instruction opcode.

[0029] Optionally, substituting the subsequence set into the semantic feature extraction model to obtain the instruction opcode semantic features includes:

[0030] For each subsequence in the subsequence set, the matching degree between the subsequence and each semantic template in the preset semantic template set is calculated, and the semantic template with the highest matching degree is obtained as the first semantic feature; the preset semantic template set stores the semantic information corresponding to different operation instruction code sequences;

[0031] The control flow attributes of the subsequence are extracted to obtain the second semantic feature; the control flow attributes include branch count, loop depth, and function call density.

[0032] The instruction opcode semantic features are obtained based on the first semantic feature and the second semantic feature.

[0033] Optionally, feature extraction of the readable characters to obtain readable character frequency features and readable character semantic features includes:

[0034] Calculate the frequency of occurrence of each character in the readable characters and sort them according to a preset rule to obtain the frequency characteristics of the readable characters;

[0035] Substituting the readable characters into the semantic recognition model yields the semantic features of the readable characters.

[0036] Optionally, substituting the frequency features, semantic features, and byte features into a preset parameter extraction model to obtain target parameters includes:

[0037] Substituting the frequency features into a lightweight gradient booster yields the frequency principal components.

[0038] Substituting the semantic features into the RF model yields semantically important features;

[0039] The frequency principal components and the semantically important features are concatenated and normalized using the maximum and minimum values ​​to obtain the first fused feature.

[0040] Substitute the first fusion feature and the byte feature into the Gaussian process to obtain the target parameters.

[0041] Optionally, the method further includes training a pre-defined malware detection model:

[0042] Obtain historical normal software access logs and historical malware access logs;

[0043] The historical normal software access logs and the historical malicious software access logs are converted into grayscale images to obtain normal grayscale images and abnormal grayscale images, respectively.

[0044] The normal grayscale image and the abnormal grayscale image are used as training data and substituted into the feature extraction model to obtain the target output features;

[0045] The target output features are substituted into a Bayesian network for training to obtain a preset malware detection model. The training objective is to train the conditional probabilities of each node in the Bayesian network using the target output features obtained from the training data, so that the accuracy of malware detection reaches a preset threshold.

[0046] Optionally, generating a grayscale image based on the log data includes:

[0047] Extract the relevant runtime data for each API from the log data; the relevant runtime data includes the name, parameters, and return value;

[0048] Each API's identity tag is obtained by connecting its relevant runtime data with underscores; the identity tag is a unique behavioral identifier for each API.

[0049] The call frequency is obtained by retrieving the number of calls to the same API name, and the API call data is obtained by concatenating the call frequency with the identity tag.

[0050] Normalize all API call data to a preset range to obtain normalized data;

[0051] Normalized data is fixed into a two-dimensional square matrix of a preset size, and the two-dimensional square matrices corresponding to all API call data are fused to obtain a fusion matrix;

[0052] A grayscale image is obtained by correcting the data in the fusion matrix using a preset matrix template.

[0053] Optionally, updating the preset malware detection model based on the target parameters to obtain the target malware detection model includes:

[0054] The target malware detection model is obtained by updating the weights of the Bayesian network in the preset malware detection model according to the target parameters.

[0055] Optionally, the working principle of the feature extraction model includes:

[0056] Obtain input features, perform convolution operation on the input features to obtain first convolution features, and perform pooling processing on the first convolution features to obtain first pooling features;

[0057] The first pooling feature is convolved to obtain the second convolutional feature, and the second convolutional feature is pooled to obtain the second pooling feature.

[0058] The third convolutional feature is obtained by performing a convolution operation on the second pooling feature;

[0059] The first convolutional feature, the second convolutional feature, and the third convolutional feature are fused to obtain the output feature of the feature extraction model.

[0060] The beneficial effects of this invention are:

[0061] This invention proposes a malware interception method based on flexible grayscale measurement in host security protection. First, it obtains the assembly language source file and executable file of the target access software and extracts three types of features: frequency, semantics, and byte count. This comprehensively captures the multi-dimensional attributes of the software, laying a precise foundation for subsequent detection. These features are then substituted into a preset parameter extraction model to obtain target parameters, updating the malware detection model. This ensures the model always adapts to the characteristics of the software being detected, significantly improving the targeting and accuracy of the detection. Next, log data is obtained by simulating software operation and grayscale images are generated. Using the updated target model, three levels of malware severity—safe, general, and dangerous—are determined, clearly quantifying the software's risk level. Finally, based on the clearly defined malware severity level, relevant interception is performed. This method avoids false interception of safe software and accurately blocks the malicious behavior of dangerous software, improving the efficiency of malware interception. Attached Figure Description

[0062] The invention will now be further described with reference to the accompanying drawings.

[0063] Figure 1 A flowchart illustrating a method for intercepting malware using flexible grayscale calculation in host security protection, provided by an embodiment of the present invention;

[0064] Figure 2This is a flowchart for extracting frequency features, semantic features, and byte features according to an embodiment of the present invention. Detailed Implementation

[0065] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0066] Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0067] This invention provides a method for intercepting malware using flexible grayscale calculation in host security protection. See also... Figure 1 , Figure 1 This is a flowchart illustrating a method for intercepting malware using flexible grayscale calculation in host security protection, provided by an embodiment of the present invention. The method includes the following steps:

[0068] S101, Obtain the assembly language source file and executable file of the target access software;

[0069] S102, extract frequency features, semantic features, and byte features from assembly language source files and executable files;

[0070] S103, Substitute frequency features, semantic features and byte features into the preset parameter extraction model to obtain target parameters;

[0071] S104, Update the preset malware detection model according to the target parameters to obtain the target malware detection model;

[0072] S105, Simulate running the target access software and obtain the log data of the target access software during runtime;

[0073] S106. Generate a grayscale image based on the log data, and substitute the grayscale image into the target malware detection model to obtain the malware level of the target access software.

[0074] S107, intercept the target access software according to the level of malice;

[0075] The malice level is divided into three categories: safe, normal, and dangerous.

[0076] This invention provides a method for intercepting malware using flexible grayscale measurement in host security protection. It extracts three types of features—frequency, semantics, and bytes—corresponding to the assembly language source files and executable files of the target access software. These features are then substituted into a preset parameter extraction model to obtain target parameters, which are used to update the malware detection model. This allows the model to always adapt to the characteristics of the software being detected, significantly improving the targeting and accuracy of the detection. Furthermore, by simulating the running of the software to obtain log data and generating grayscale images, the updated target model is used to determine the level of malfunction, further improving the efficiency of malware interception.

[0077] In one implementation, the target access software is software that requires malware analysis; the malfunction level is divided into safe, normal, and dangerous; when the malfunction level is safe, it is allowed directly without affecting the user's normal use; when the malfunction level is normal, the user is prompted with a risk (such as a pop-up warning), and the user chooses whether to continue using it; when the malfunction level is dangerous, it is automatically and forcibly blocked and the software is deleted.

[0078] In one implementation, the assembly language source file and executable file of the target access software are extracted, and frequency features, semantic features and byte features are extracted. The three types of features complement each other, which can not only cover static file attributes, but also dig out the code logic intent, significantly reducing missed detections and false detections caused by single features.

[0079] In one implementation, malware continuously iterates, and detection models with fixed parameters become ineffective over time. To address this issue, target parameters are generated through a feature extraction model, the detection model is updated, and the core parameters of the detection model are dynamically adjusted to improve detection accuracy.

[0080] In one implementation, some malware employs a strategy of being harmless at rest but causing harm after execution. Static detection is often ineffective. By simulating runtime logs, the dynamic intent of the software can be directly reflected, and malicious behavior will leave traces in the logs. Converting the log data into grayscale images for analysis can improve the accuracy of detection.

[0081] In one embodiment, see Figure 2 , Figure 2 A flowchart for extracting frequency features, semantic features, and byte features is provided, including:

[0082] S1021, Scan the text segment of the assembly language source file line by line and extract the operation instruction code sequence by referring to the code dictionary;

[0083] S1022, Perform feature extraction on the operation instruction code sequence to obtain instruction opcode frequency features and instruction opcode semantic features;

[0084] S1023, Extract the byte sequence and readable characters from the executable file using regular expressions;

[0085] S1024, Perform feature extraction on readable characters to obtain readable character frequency features and readable character semantic features;

[0086] S1025, Perform feature extraction on the byte sequence to obtain byte features;

[0087] S1026, frequency features are obtained by frequency fusion of instruction opcode frequency features and readable character frequency features;

[0088] S1027, semantic features are obtained by semantic fusion of instruction opcode semantic features and readable character semantic features.

[0089] One implementation extracts features from different levels, such as assembly instructions, the byte sequence of the executable file, and readable characters, to comprehensively capture the characteristics of the file. Assembly instructions reflect the logical operations of the program, the byte sequence reflects the binary structure, and readable characters may contain key information such as strings. These multi-dimensional features can complement each other, reducing the limitations of a single feature.

[0090] In one implementation, frequency features and semantic features are extracted from the operation instruction codes and readable characters respectively, and then fused together. This can more accurately characterize the behavior patterns and inherent meaning of the file. Frequency features reflect the regularity of element occurrence, and semantic features reflect the semantic associations of elements. After fusion, the accuracy of file property analysis can be improved.

[0091] In one implementation, the fused frequency and semantic features can more clearly present the unique patterns of files. In scenarios such as malicious code detection and program reverse engineering, this can help identify groups of files with similar characteristics or discover abnormal file patterns.

[0092] In one implementation, scanning the text segment line by line involves scanning the content of the .text portion; extracting features from the byte sequence involves extracting the order in which different strings appear; fusing the frequency features of the instruction opcode and the frequency features of readable characters involves performing principal component analysis to reduce the dimensionality of the instruction opcode and readable character frequency features and then fusing them; and fusing the semantic features of the instruction opcode and the semantic features of readable characters involves concatenating the semantic features of the instruction opcode and the semantic features of readable characters.

[0093] In one embodiment, feature extraction of the operation instruction code sequence to obtain instruction opcode frequency features and instruction opcode semantic features includes:

[0094] The first frequency feature set is obtained by calculating the frequency and proportion of each opcode in the operation instruction code sequence;

[0095] The second frequency feature set is obtained by calculating the co-occurrence pattern of N opcodes in the operation instruction code sequence; the co-occurrence pattern is the combination of N consecutive opcodes appearing simultaneously in a specific order;

[0096] The third frequency feature set is obtained by calculating the frequency of occurrence of each functional class in the operation instruction code sequence; the functional classes include data transmission class, control flow class, and operation class;

[0097] The first frequency feature set, the second frequency feature set, and the third frequency feature set are normalized and then concatenated to obtain the instruction opcode frequency feature.

[0098] The sequence of operation instruction codes is divided into subsequence sets by using control flow parameters as boundaries; control flow parameters include function calls, function returns, and unconditional jumps;

[0099] Substituting the subsequence set into the semantic feature extraction model yields the semantic features of the instruction opcode.

[0100] In one implementation, the first frequency feature set intuitively reflects the most core and frequent basic operations in the program through the occurrence frequency and proportion of a single opcode; the second frequency feature set captures the local correlation patterns between instructions through the co-occurrence patterns of N opcodes; and the third frequency feature set summarizes from the functional category dimension, revealing the program's emphasis on macro-level functions such as data processing, flow control, and computational logic, reflecting the program's core functional attributes.

[0101] In one implementation, the subsequence is segmented using control flow parameters (function call, return, unconditional jump) as boundaries, which naturally fits the logical structure of the program and ensures that the segmented subsequence has semantic integrity. By processing the subsequence through a semantic feature extraction model (such as Transformer, LSTM, etc.), the logical meaning behind the instruction sequence can be captured.

[0102] In one implementation, the frequency features of the instruction opcode are obtained by normalizing the first frequency feature set, the second frequency feature set, and the third frequency feature set and then concatenating them. This is achieved through L2 normalization.

[0103] In one implementation, frequency features are good at capturing program behavior habits, while semantic features are good at revealing the program's logical intent. The combination of the two not only retains the highly interpretable statistical features, but also introduces semantic features that can reflect deep logic, providing more comprehensive feature support for tasks such as malicious code detection, program reverse analysis, and code clone identification, and in particular, it can improve the ability to identify programs that have been obfuscated or transformed.

[0104] In one implementation, the co-occurrence pattern is a combination of n consecutive opcodes appearing simultaneously in a specific order in the opcode sequence.

[0105] In one embodiment, substituting the subsequence set into the semantic feature extraction model to obtain the instruction opcode semantic features includes:

[0106] For each subsequence in the subsequence set, the matching degree between the subsequence and each semantic template in the preset semantic template set is calculated, and the semantic template with the highest matching degree is obtained as the first semantic feature; the preset semantic template set stores the semantic information corresponding to different operation instruction code sequences;

[0107] The control flow attributes of the subsequence are extracted to obtain the second semantic features; the control flow attributes include the number of branches, the loop depth, and the function call density.

[0108] The semantic features of the instruction opcode are obtained based on the first semantic feature and the second semantic feature.

[0109] In one implementation, the first semantic feature directly associates the semantic meaning of the subsequence with a preset semantic template, and quickly locates the functional attributes of the subsequence using the known template, thus improving the efficiency and accuracy of semantic understanding. The second semantic feature focuses on control flow attributes, supplementing semantic information from the perspective of program structure. For example, a high loop depth may correspond to iterative calculation, and multiple branches may correspond to conditional judgment logic. These attributes are structural features that are difficult to cover by template matching. The combination of the two features not only captures the functional intent of the subsequence, but also reflects its execution structure, thus achieving a three-dimensional characterization of semantics.

[0110] In one implementation, each semantic template in the preset semantic template set is trained from historical data; the preset semantic template set covers the semantics of common operation sequences and can quickly match subsequences of known patterns; while the control flow attribute, as a structured feature, has stronger anti-interference ability against mutated or obfuscated code; when the subsequence matches the template with a low degree of matching, the control flow attribute can still provide effective semantic clues, avoiding the limitations of single template matching.

[0111] In one implementation, the instruction opcode semantic features are obtained based on the first semantic features and the second semantic features by converting the preset semantic template with the highest matching degree into one-hot encoding, embedding vectors and other quantized features as the first semantic features, and standardizing control flow attributes such as branch count and loop depth to form the second semantic features. The two are then fused by concatenation, weighting or neural networks to obtain the instruction opcode semantic features. The instruction opcode semantic features take into account both the functional semantics and structural attributes of the subsequence.

[0112] In one embodiment, feature extraction of readable characters to obtain readable character frequency features and readable character semantic features includes:

[0113] Calculate the frequency of each character in the readable characters and sort them according to a preset rule to obtain the frequency characteristics of the readable characters;

[0114] The semantic features of readable characters are obtained by substituting readable characters into the semantic recognition model.

[0115] In one implementation, the sorting is determined by technical personnel according to preset rules; the semantic recognition model is a commonly used model on the market, such as Word2Vec, GloVe, and other word embedding models.

[0116] In one embodiment, substituting frequency features, semantic features, and byte features into a preset parameter extraction model to obtain target parameters includes:

[0117] Substituting the frequency features into a lightweight gradient booster yields the principal frequency components.

[0118] Substituting semantic features into the RF model yields semantically important features;

[0119] The frequency principal components and semantically important features are concatenated and normalized using the maximum and minimum values ​​to obtain the first fused feature;

[0120] Substitute the first fusion feature and the byte feature into the Gaussian process to obtain the target parameters.

[0121] In one implementation, a lightweight gradient booster is used to extract the principal frequency components from the frequency features, which can efficiently filter out the character frequency patterns that have the greatest impact on the target, such as the special character combinations that appear frequently in malware; and a random forest (RF) is used to extract important features from the semantic features, which can accurately capture the key semantic associations of readable characters. Both methods can eliminate redundant features and reduce interference from invalid information.

[0122] In one implementation, the frequency principal components and semantically important features are first concatenated and normalized to eliminate dimensional differences, and then the two types of core information, statistical regularity and semantic meaning, are integrated. Then, the byte features are substituted into a Gaussian process to achieve complementary fusion of three-dimensional features of character statistics, character semantics, and binary structure, so that the target parameters can more comprehensively reflect the essential attributes of the file.

[0123] In one implementation, the lightweight gradient booster adapts to the statistical properties of frequency features and has high training efficiency; the random forest is good at handling the nonlinear correlation of semantic features and has strong anti-overfitting ability; the Gaussian process has probabilistic output characteristics and can provide uncertainty assessment while outputting target parameters. The collaboration of the three not only adapts to the characteristics of each link, but also improves the accuracy and reliability of parameter extraction through the complementary advantages of the models.

[0124] In one embodiment, the method further includes training a pre-defined malware detection model:

[0125] Obtain historical normal software access logs and historical malware access logs;

[0126] The historical normal software access logs and historical malicious software access logs were converted into grayscale images to obtain normal grayscale images and abnormal grayscale images, respectively.

[0127] Normal grayscale images and abnormal grayscale images are used as training data and substituted into the feature extraction model to obtain the target output features;

[0128] The target output features are substituted into a Bayesian network for training to obtain a preset malware detection model. The training objective is to train the conditional probabilities of each node in the Bayesian network using the target output features obtained from the training data, so that the accuracy of malware detection reaches a preset threshold.

[0129] In one implementation, target output features are extracted from normal and abnormal grayscale images through a feature extraction model. This can accurately capture the differences between the two types of images, providing a highly discriminative feature base for subsequent classification and reducing interference from invalid features.

[0130] In one implementation, the Bayesian network is built based on a probabilistic graphical model. During training, it explicitly learns the conditional probabilities of each node (features and malicious / normal labels). During detection, it can output the probability value that the software is malicious. It can not only judge the result, but also explain which features lead to the judgment of maliciousness. Compared with black box models, it is easier to manually verify and trace the fault. The preset threshold is determined by technical personnel.

[0131] In one embodiment, generating a grayscale image from log data includes:

[0132] Extract the relevant runtime data for each API from the log data; the relevant runtime data includes the name, parameters, and return value;

[0133] Each API's identity tag is obtained by connecting its relevant runtime data with underscores; the identity tag is a unique behavioral identifier for each API.

[0134] The call frequency is obtained by retrieving the number of calls to the same API name, and the API call data is obtained by concatenating the call frequency with the identity tag.

[0135] Normalize all API call data to a preset range to obtain normalized data;

[0136] Normalized data is fixed into a two-dimensional square matrix of a preset size, and the two-dimensional square matrices corresponding to all API call data are fused to obtain a fusion matrix;

[0137] A grayscale image is obtained by correcting the data in the fusion matrix using a preset matrix template.

[0138] In one implementation, the preset range is between 0 and 255; the data correction is to map the data of the fusion matrix onto the preset matrix template, and when there are positions where no data is mapped, zeros are added; if the data length exceeds the template length, principal component analysis is performed on the data in that column, and then the data is compressed until it does not exceed the template length; the size of the preset matrix template is determined by the technical personnel.

[0139] In one implementation, an identity label is generated by connecting the API name, parameters, and return value with underscores. This can accurately distinguish different call behaviors of the same API and avoid behavior confusion. Combined with API call data formed by call frequency, the quantitative dimensions of behavior are further enriched. The API call data is normalized to a preset range, eliminating the interference caused by differences in API call frequency and parameter value range, so that the data has a unified and comparable scale, laying the foundation for subsequent matrix processing.

[0140] In one embodiment, updating the preset malware detection model according to the target parameters to obtain the target malware detection model includes:

[0141] The target malware detection model is obtained by updating the weights of the Bayesian network in the preset malware detection model based on the target parameters.

[0142] In one implementation, the Bayesian network is updated by updating the target parameters, and the accuracy of malware detection is further improved by combining the characteristics of malware in a static state.

[0143] In one embodiment, the feature extraction model works by:

[0144] Obtain the input features, perform a convolution operation on the input features to obtain the first convolutional features, and perform pooling processing on the first convolutional features to obtain the first pooling features;

[0145] The first pooling feature is convolved to obtain the second convolutional feature, and the second convolutional feature is pooled to obtain the second pooling feature.

[0146] The third convolutional feature is obtained by performing a convolution operation on the second pooling feature;

[0147] The first, second, and third convolutional features are fused to obtain the output features of the feature extraction model.

[0148] In one implementation, directly fusing convolutional features can retain more spatial and sequence correlation information, avoid the loss of details caused by excessive compression of deep features, and multi-level feature fusion enables the model to obtain both low-level details and high-level abstractions, thereby improving the extraction of detailed features during malware runtime and enhancing the accuracy of malware identification.

[0149] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A method for intercepting malware using flexible grayscale calculation in host security protection, characterized in that, The method includes: Obtain the assembly language source files and executable files of the target access software; Frequency features, semantic features, and byte features are obtained by performing feature extraction on the assembly language source file and the executable file; The target parameters are obtained by substituting the frequency features, semantic features, and byte features into a preset parameter extraction model. The target malware detection model is obtained by updating the preset malware detection model according to the target parameters; Simulate the operation of the target access software and obtain the log data of the target access software during operation; A grayscale image is generated based on the log data, and the grayscale image is substituted into the target malware detection model to obtain the malware level of the target access software; the malware level is divided into safe, normal and dangerous. The target access software is blocked based on the level of malice.

2. The method for intercepting malware using flexible grayscale calculation in host security protection according to claim 1, characterized in that, Feature extraction of the assembly language source file and the executable file yields frequency features, semantic features, and byte features, including: The assembly language source file is scanned line by line, and the operation instruction code sequence is extracted by referring to the code dictionary; Feature extraction is performed on the operation instruction code sequence to obtain instruction opcode frequency features and instruction opcode semantic features; The executable file is subjected to regular expression extraction to obtain byte sequences and readable characters; Feature extraction is performed on the readable characters to obtain readable character frequency features and readable character semantic features; Byte features are obtained by performing feature extraction on the byte sequence; Frequency features are obtained by frequency fusion of the instruction opcode frequency features and the readable character frequency features; The semantic features are obtained by semantic fusion of the semantic features of the instruction opcode and the semantic features of the readable characters.

3. The method for intercepting malware using flexible grayscale calculation in host security protection according to claim 2, characterized in that, Feature extraction of the operation instruction code sequence yields instruction opcode frequency features and instruction opcode semantic features, including: The first frequency feature set is obtained by calculating the frequency and proportion of each opcode in the operation instruction code sequence; The co-occurrence pattern of N opcodes in the operation instruction code sequence is calculated to obtain a second frequency feature set; the co-occurrence pattern is a combination of N consecutive opcodes appearing simultaneously in a specific order; The frequency of occurrence of each functional class in the operation instruction code sequence is calculated to obtain a third frequency feature set; the functional classes include data transmission class, control flow class, and computation class; The first frequency feature set, the second frequency feature set, and the third frequency feature set are normalized and then concatenated to obtain the instruction opcode frequency feature. The operation instruction code sequence is divided into subsequence sets by using control flow parameters as boundaries; the control flow parameters include function calls, function returns, and unconditional jumps; Substituting the subsequence set into the semantic feature extraction model yields the semantic features of the instruction opcode.

4. The method for intercepting malware using flexible grayscale calculation in host security protection according to claim 3, characterized in that, Substituting the subsequence set into the semantic feature extraction model yields the instruction opcode semantic features, including: For each subsequence in the subsequence set, the matching degree between the subsequence and each semantic template in the preset semantic template set is calculated, and the semantic template with the highest matching degree is obtained as the first semantic feature; the preset semantic template set stores the semantic information corresponding to different operation instruction code sequences; The control flow attributes of the subsequence are extracted to obtain the second semantic feature; the control flow attributes include branch count, loop depth, and function call density. The instruction opcode semantic features are obtained based on the first semantic feature and the second semantic feature.

5. The method for intercepting malware using flexible grayscale calculation in host security protection according to claim 2, characterized in that, Feature extraction of the readable characters yields readable character frequency features and readable character semantic features, including: Calculate the frequency of occurrence of each character in the readable characters and sort them according to a preset rule to obtain the frequency characteristics of the readable characters; Substituting the readable characters into the semantic recognition model yields the semantic features of the readable characters.

6. The method for intercepting malware using flexible grayscale calculation in host security protection according to claim 1, characterized in that, Substituting the frequency features, semantic features, and byte features into a preset parameter extraction model yields target parameters including: Substituting the frequency features into a lightweight gradient booster yields the frequency principal components. Substituting the semantic features into the RF model yields semantically important features; The frequency principal components and the semantically important features are concatenated, and the first fused feature is obtained by normalization through maximum and minimum values. Substitute the first fusion feature and the byte feature into the Gaussian process to obtain the target parameters.

7. The method for intercepting malware using flexible grayscale calculation in host security protection according to claim 1, characterized in that, The method also includes training a pre-defined malware detection model: Obtain historical normal software access logs and historical malware access logs; The historical normal software access logs and the historical malicious software access logs are converted into grayscale images to obtain normal grayscale images and abnormal grayscale images, respectively. The normal grayscale image and the abnormal grayscale image are used as training data and substituted into the feature extraction model to obtain the target output features; The target output features are substituted into a Bayesian network for training to obtain a preset malware detection model. The training objective is to train the conditional probabilities of each node in the Bayesian network using the target output features obtained from the training data, so that the accuracy of malware detection reaches a preset threshold.

8. The method for intercepting malware using flexible grayscale calculation in host security protection according to claim 1, characterized in that, Generating a grayscale image based on the log data includes: Extract the relevant runtime data for each API from the log data; the relevant runtime data includes the name, parameters, and return value; Each API's identity tag is obtained by connecting its relevant runtime data with underscores; the identity tag is a unique behavioral identifier for each API. The call frequency is obtained by retrieving the number of calls to the same API name, and the API call data is obtained by concatenating the call frequency with the identity tag. Normalize all API call data to a preset range to obtain normalized data; Normalized data is fixed into a two-dimensional square matrix of a preset size, and the two-dimensional square matrices corresponding to all API call data are fused to obtain a fusion matrix; A grayscale image is obtained by correcting the data in the fusion matrix using a preset matrix template.

9. The method for intercepting malware using flexible grayscale calculation in host security protection according to claim 7, characterized in that, The target malware detection model is obtained by updating the preset malware detection model according to the target parameters, including: The target malware detection model is obtained by updating the weights of the Bayesian network in the preset malware detection model according to the target parameters.

10. A method for intercepting malware using flexible grayscale calculation in host security protection according to claim 9, characterized in that, The working principle of the feature extraction model includes: Obtain input features, perform convolution operation on the input features to obtain first convolution features, and perform pooling processing on the first convolution features to obtain first pooling features; The first pooling feature is convolved to obtain the second convolutional feature, and the second convolutional feature is pooled to obtain the second pooling feature. The third convolutional feature is obtained by performing a convolution operation on the second pooling feature; The first convolutional feature, the second convolutional feature, and the third convolutional feature are fused to obtain the output feature of the feature extraction model.

Images