Adversarial sample generation method, device, equipment, medium and program product

Abstract

Embodiments of the present application disclose a method, device, equipment, medium and program product for generating an adversarial sample. The method comprises: obtaining a preset code file; determining a non-conditional jump instruction in the preset code file; modifying the non-conditional jump instruction into a reconstructed jump instruction according to a preset instruction modification rule; performing control flow flattening processing on a basic block of the preset code file; based on a result of the control flow flattening processing, inserting a preset application programming interface (API) sequence into the preset code file according to a preset rule to obtain a target code file containing a malicious code feature; inserting noise into the target code file to obtain an initial sample; and performing iteration on the initial sample according to a preset evolution algorithm to obtain an adversarial sample. The embodiments of the present application can generate a large number of malicious code adversarial samples that can evade antivirus software and sandboxes.

Description

Technical Field

[0001] This application belongs to the field of network security technology, and in particular relates to an adversarial sample generation method, apparatus, device, computer storage medium, and computer program product. Background Technology

[0002] With the rapid development of information technology, the threat of malware is becoming increasingly severe, posing a significant challenge to cybersecurity. To effectively address this threat, machine learning technology, with its powerful data processing and pattern recognition capabilities, has gradually become an important method in the field of malware detection. This method first disassembles the malicious code, then extracts key features to construct feature vectors. Subsequently, various machine learning algorithms are used to build a classification model based on these feature vectors.

[0003] However, the inherent weaknesses of machine learning algorithms also provide malware creators with new attack avenues. In recent years, research related to adversarial machine learning has increased, aiming to explore how to exploit vulnerabilities in machine learning models to circumvent their detection capabilities. Therefore, constructing adversarial examples against malware detection machine learning models to uncover their flaws is of great significance for malware detection. Summary of the Invention

[0004] This application provides an adversarial sample generation method, apparatus, device, computer storage medium, and computer program product, which can generate a large number of malicious code adversarial samples that can evade antivirus software and sandboxes.

[0005] In a first aspect, embodiments of this application provide an adversarial example generation method, including:

[0006] Get the preset code file;

[0007] Identify unconditional jump instructions in the preset code file;

[0008] Modify the unconditional jump instruction into a refactoring jump instruction according to the preset instruction modification rules;

[0009] Perform control flow flattening on the basic blocks of the preset code file;

[0010] Based on the result of control flow flattening, a preset application programming interface (API) sequence is inserted into a preset code file according to preset rules to obtain a target code file containing malicious code features. The preset API sequence is obtained from a preset set of API sequences, which includes multiple malicious code feature API sequences and multiple benign code feature API sequences.

[0011] Noise is inserted into the target code file to obtain the initial sample;

[0012] The initial samples are iterated according to a preset evolutionary algorithm to obtain adversarial samples.

[0013] In an optional implementation, before inserting a preset API sequence into a preset code file according to preset rules based on the result of control flow flattening processing to obtain a target code file containing malicious code characteristics, the method further includes:

[0014] Obtain a sample set, which includes multiple code samples, including multiple malicious code samples and multiple benign code samples;

[0015] Run the sample set in the sandbox to obtain the API call sequence corresponding to each code sample;

[0016] Each API call sequence is segmented to obtain the term information corresponding to each API call sequence. The term information includes multiple words, which are used to represent the API sequence.

[0017] Construct a vocabulary based on the term information corresponding to each API call sequence;

[0018] For each API call sequence, the target vector set corresponding to the term information is calculated based on the vocabulary. The target vector set includes the term frequency-inverse document frequency vectors of multiple words.

[0019] The target vector sets corresponding to each API call sequence are input into the pre-trained code classification model;

[0020] The code classification model categorizes API call sequences based on a set of target vectors.

[0021] Obtain the feature interpretation results of the target vector set corresponding to each API call sequence output by the code classification model. The feature interpretation results include the feature type and importance score of the word frequency-inverse document frequency vector in the target vector set.

[0022] Based on the feature interpretation results of the target vector set corresponding to each API call sequence, multiple malicious code feature API sequences and multiple benign code feature API sequences are identified.

[0023] Create an API sequence set based on multiple malicious code feature API sequences and multiple benign code feature API sequences.

[0024] In one alternative implementation, the code classification model includes a support vector machine (SVM) model, a gradient boosting decision tree (XGBoost) model, and a convolutional neural network (CNN) model.

[0025] Obtain the feature interpretation results of the target vector set corresponding to each API call sequence output by the code classification model, including the following steps for each target vector set corresponding to each API call sequence:

[0026] Obtain the first feature weights corresponding to each term frequency-inverse document frequency vector in the SVM model;

[0027] Calculate the Shapley value for each term frequency-inverse document frequency vector in the XGBoost model;

[0028] Based on the Shapley value corresponding to each term frequency-inverse document frequency vector, determine the feature type corresponding to each term frequency-inverse document frequency vector;

[0029] Calculate the locally interpretable model-independent interpretation (LIME) corresponding to each term frequency-inverse document frequency vector in the CNN model;

[0030] Based on LIME, determine the second feature weights corresponding to each term frequency-inverse document frequency vector;

[0031] The importance score of each term frequency-inverse document frequency vector is calculated based on the first feature weight and the second feature weight corresponding to each term frequency-inverse document frequency vector.

[0032] In one optional implementation, the preset instruction modification rules include:

[0033] Get the target instruction length of the refactoring jump instruction;

[0034] If the target instruction length is less than or equal to a preset instruction length threshold, the unconditional jump instruction is modified with an equivalent instruction to obtain a reconstructed jump instruction.

[0035] If the target instruction length is greater than the preset instruction length threshold, the unconditional jump instruction is modified into an interrupt exception instruction to obtain the reconstructed jump instruction.

[0036] In one alternative implementation, noise is inserted into the target code file to obtain an initial sample, including:

[0037] Identify the target API sequence corresponding to the malicious code characteristics in the target code file;

[0038] Noise is inserted into the target API sequence to obtain the initial sample.

[0039] In one alternative implementation, the number of initial samples is multiple;

[0040] The initial samples are iterated according to a preset evolutionary algorithm to obtain adversarial examples, including:

[0041] Create a set of variant samples based on multiple initial samples;

[0042] Extract a predetermined number of initial samples from the mutated sample set;

[0043] The preset number of initial samples are mutated according to the preset mutation algorithm to obtain multiple mutated samples;

[0044] Perform crossover operations on multiple mutated samples to obtain multiple crossover samples;

[0045] Functional validation was performed on multiple cross-samples.

[0046] Based on the functional verification results, multiple target cross samples are determined from multiple cross samples to obtain a target cross sample set;

[0047] The target sample set is determined from the target crossover sample set and the mutant sample set according to the preset fitness criteria;

[0048] The target sample set is used as a new mutated sample set, and multiple samples in the target sample set are used as multiple new initial samples. The preset number of initial samples are extracted from the mutated sample set until the preset stopping condition is met.

[0049] Generate adversarial examples based on the target sample set.

[0050] Secondly, embodiments of this application provide an adversarial sample generation apparatus, comprising:

[0051] The acquisition module is used to acquire preset code files;

[0052] The determination module is used to determine unconditional jump instructions in the preset code file;

[0053] The modification module is used to modify unconditional jump instructions into refactored jump instructions according to preset instruction modification rules;

[0054] The processing module is used to flatten the control flow of basic blocks in a preset code file.

[0055] The insertion module is used to insert a preset API sequence into a preset code file according to preset rules based on the result of control flow flattening processing, so as to obtain a target code file containing malicious code features. The preset API sequence is obtained from a preset API sequence set, which includes multiple malicious code feature API sequences and multiple benign code feature API sequences.

[0056] The insertion module is also used to insert noise into the target code file to obtain initial samples;

[0057] The iteration module is used to iterate the initial samples according to a preset evolutionary algorithm to obtain adversarial samples.

[0058] Thirdly, embodiments of this application provide an electronic device, the device including: a processor and a memory storing computer program instructions;

[0059] When the processor executes computer program instructions, it implements an adversarial sample generation method as described in any optional embodiment of the first aspect of this application.

[0060] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement an adversarial sample generation method as described in any optional embodiment of the first aspect of this application.

[0061] Fifthly, embodiments of this application provide a computer program product in which instructions, when executed by a processor of an electronic device, cause the electronic device to perform an adversarial sample generation method as described in any optional implementation of the first aspect of this application.

[0062] The adversarial sample generation method, apparatus, device, computer storage medium, and computer program product of this application embodiment can obtain a preset code file, determine the unconditional jump instructions in the preset code file, modify the unconditional jump instructions into reconstructed jump instructions according to preset instruction modification rules, and perform control flow flattening processing on the basic blocks of the preset code file. Next, based on the result of the control flow flattening processing, a preset API sequence can be inserted into the preset code file according to preset rules to obtain a target code file containing malicious code features. The preset API sequence is obtained from a preset API sequence set, which includes multiple malicious code feature API sequences and multiple benign code feature API sequences. Thus, random modification of the preset API sequence can be achieved based on the pre-identified malicious code feature API sequences and benign code feature API sequences. This allows modification of the code file while maintaining the integrity and functionality of the malicious code. Subsequently, noise can be inserted into the target code file to obtain an initial sample. Inserting noise can interfere with the analysis of program behavior, thereby helping the sample evade detection by antivirus software and sandboxes. Through random modification of the API sequence and random addition of noise, the code sample can be expanded. Then, the initial samples are iterated according to a preset evolutionary algorithm to obtain adversarial samples. In this way, by continuously iterating the samples, a massive number of adversarial malicious code samples that can evade antivirus software and sandboxes can be generated. Attached Figure Description

[0063] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0064] Figure 1 This is a flowchart illustrating an adversarial example generation method provided in one embodiment of this application;

[0065] Figure 2 This is a schematic diagram of the program execution flow provided in another embodiment of this application;

[0066] Figure 3 This is a schematic diagram of the program execution flow provided in another embodiment of this application;

[0067] Figure 4 This is a schematic diagram of API insertion provided in another embodiment of this application;

[0068] Figure 5 This is a flowchart illustrating an adversarial example generation method provided in another embodiment of this application;

[0069] Figure 6 This is a schematic diagram illustrating a modification of the unconditional jump instruction provided in another embodiment of this application;

[0070] Figure 7 This is a schematic diagram illustrating a modification of the unconditional jump instruction provided in another embodiment of this application;

[0071] Figure 8 This is a schematic diagram of the structure of an adversarial example generation system provided in another embodiment of this application.

[0072] Figure 9 This is a schematic diagram of the structure of an adversarial sample generation device provided in another embodiment of this application;

[0073] Figure 10 This is a schematic diagram of the structure of an adversarial sample generation device provided in another embodiment of this application. Detailed Implementation

[0074] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0075] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0076] As described in the background section, the inherent weaknesses of machine learning algorithms provide malware creators with new attack avenues. In recent years, research related to adversarial machine learning has increased, aiming to explore how to exploit vulnerabilities in machine learning models to circumvent their detection capabilities. Therefore, constructing adversarial examples against malware detection machine learning models to uncover their flaws is of great significance for malware detection.

[0077] The relevant technology involves adversarial binary code generation based on machine learning. While this technique can evade static feature engines, the code's dynamic behavior is still exposed during execution and can be identified by dynamic feature models. For example, in a sandbox environment, the dynamic behavior of malicious code can be monitored and analyzed. Furthermore, this technology is only applicable to single-sample generation and cannot be applied to large-scale malware detection and evaluation scenarios.

[0078] In order to solve the problems existing in the prior art, the inventors, after in-depth thinking, ingeniously proposed an adversarial sample generation method, device, equipment, computer storage medium and computer program product.

[0079] The adversarial sample generation method provided in this application will be described below with reference to the accompanying drawings and specific embodiments and application scenarios. The adversarial sample generation method provided in this application can be executed by an adversarial sample generation device, or a portion of the adversarial sample generation device used to execute the adversarial sample generation method. This application uses the execution of the adversarial sample generation method by an adversarial sample generation device as an example to describe in detail the adversarial sample generation method provided in this application.

[0080] The following is in conjunction with the appendix Figure 1 The adversarial sample generation method provided in the embodiments of this application will be described in detail.

[0081] Figure 1 A flowchart illustrating an adversarial example generation method according to an embodiment of this application is shown. As shown, the adversarial example generation method may specifically include the following steps S110 to S170.

[0082] S110, retrieve the preset code file.

[0083] In step S110, the preset code file may include a file obtained by decompiling a preset code program. The preset code program may include malicious code or benign code.

[0084] S120, determine the unconditional jump instructions in the preset code file.

[0085] In step S120, unconditional jump instructions may include CALL and JMP instructions. In one example, a binary form lookup table of CALL and JMP instructions can be pre-built. Using the binary forms of each CALL and JMP instruction in the lookup table, a disassembler, such as IDA Python (built into Interactive Disassembler Professional, IDA pro), is used to identify the quality of all unconditional jumps in the pre-built code.

[0086] S130, modify the unconditional jump instruction into a refactoring jump instruction according to the preset instruction modification rules.

[0087] In step S130, the original instructions can be replaced or adjusted by modifying the instructions in order to change the program behavior or hide malicious behavior.

[0088] S140 performs control flow flattening on the basic blocks of the preset code file.

[0089] In step S140, control flow flattening can mean controlling the execution flow of all basic blocks of the program through a main dispatcher. For example, Figure 2 This is a schematic diagram of the program execution flow before control flow flattening. Figure 3 This is a schematic diagram of the program execution flow after control flow flattening. After control flow flattening, the program execution flow changes, but the program integrity is not compromised; basic block 2 can still reach basic blocks 3 and 4 through the main dispatcher function. The main dispatcher function can maintain a jump table to prevent basic block 2 from reaching basic block 5 through the main dispatcher function.

[0090] S150, based on the result of control flow flattening, inserts a preset API sequence into a preset code file according to preset rules to obtain a target code file containing malicious code features. The preset API sequence is obtained from a preset API sequence set, which includes multiple malicious code feature API sequences and multiple benign code feature API sequences.

[0091] In step S150, based on the result of control flow flattening, the main dispatcher function can be used to hijack the API control flow together and record it in a jump table. The control flow is changed by modifying the jump table, thereby achieving API sequence insertion. Before performing API sequence insertion, the insertion location, i.e., the instrumentation location, can be determined. Specifically, all functions in the preset code file can be traversed to determine if they are library functions. If not, all binary instructions in the function block can be traversed to determine if they point to an API function, and then recorded. This yields a list of all related API function names and addresses for the function block, and the instrumentation location can be confirmed based on the API function name and address list. Inserting preset API sequences into the preset code file according to preset rules can include determining the preset API sequence based on the type of the preset code file and inserting the preset API sequence according to the instrumentation location. For example, when the preset code file is a benign code file, the preset API sequence can include malicious code feature API sequences randomly selected from the API sequence set; when the preset code file is a malicious code file, the preset API sequence can include benign code feature API sequences randomly selected from the API sequence set. In this way, a preset code file can be randomly modified to obtain a target code file containing malicious code characteristics.

[0092] Figure 4 An example of inserting into the API, in Figure 4 In this context, solid lines represent APIs that execute normally, while dashed lines represent CALL instructions that execute inserted API sequences. For example... Figure 4 As shown, after executing the API sequence insertion, it is possible to execute the inserted API (such as MessageBoxA, NtClose, etc.) before executing the API CALL replacement, then jump to the API CALL replacement part to implement the original function, and then return to the original control flow position to continue the program execution.

[0093] S160, insert noise into the target code file to obtain the initial sample.

[0094] In step S160, noise may include harmless calls not directly related to the target API. For example, noise may include system APIs, application-defined helper functions, or benign code feature API sequences from the aforementioned set of API sequences. Inserting noise is an obfuscation technique that can interfere with the analysis of program behavior. By inserting unnecessary, harmless, or misleading API calls (i.e., noise), the API sequence of the target code file can be made more complex and difficult to analyze. It is understood that by randomly inserting noise into the target code file, multiple initial samples can be obtained.

[0095] S170: The initial sample is iterated according to the preset evolutionary algorithm to obtain adversarial samples.

[0096] The preset evolutionary algorithms can include population-based stochastic optimization methods such as Differential Evolution Algorithm (DEA), Genetic Algorithm, and Particle Swarm Optimization. By iterating over the initial samples using evolutionary algorithms, the sample size can be expanded again through stochastic optimization.

[0097] The adversarial sample generation method of this application can obtain a preset code file, identify unconditional jump instructions in the preset code file, modify the unconditional jump instructions into reconstructed jump instructions according to preset instruction modification rules, and perform control flow flattening on the basic blocks of the preset code file. Next, based on the result of the control flow flattening, a preset API sequence can be inserted into the preset code file according to preset rules to obtain a target code file containing malicious code features. The preset API sequence is obtained from a preset API sequence set, which includes multiple malicious code feature API sequences and multiple benign code feature API sequences. Thus, the preset API sequence can be randomly modified based on the pre-identified malicious code feature API sequences and benign code feature API sequences. This allows modification of the code file while maintaining the integrity and functionality of the malicious code. Subsequently, noise can be inserted into the target code file to obtain an initial sample. Inserting noise can interfere with the analysis of program behavior, thereby helping the sample evade detection by antivirus software and sandboxes. Through random modification of the API sequence and random addition of noise, the code sample can be expanded. Then, the initial sample is iterated according to a preset evolutionary algorithm to obtain adversarial samples. In this way, by continuously iterating the samples, a massive number of adversarial malicious code samples that can evade antivirus software and sandboxes can be generated.

[0098] In one example, a binary lookup table of CALL and JMP instructions can be constructed based on an x86 program. An example of a portion of this lookup table is shown in Table 1.

[0099] Table 1

[0100]

[0101] In one embodiment, before inserting a preset API sequence into a preset code file according to preset rules based on the result of control flow flattening processing to obtain a target code file containing malicious code characteristics, the method may further include:

[0102] Obtain a sample set, which includes multiple code samples, including multiple malicious code samples and multiple benign code samples.

[0103] Run the sample set in the sandbox to obtain the API call sequence corresponding to each code sample.

[0104] Each API call sequence is segmented to obtain the term information corresponding to each API call sequence. The term information includes multiple words, which are used to represent the API sequence.

[0105] A vocabulary list is constructed based on the term information corresponding to each API call sequence.

[0106] For each API call sequence, the target vector set corresponding to the term information is calculated based on the vocabulary. The target vector set includes the term frequency-inverse document frequency vectors of multiple words.

[0107] The target vector sets corresponding to each API call sequence are input into the pre-trained code classification model.

[0108] The code classification model categorizes API call sequences based on a set of target vectors.

[0109] Obtain the feature interpretation results of the target vector set corresponding to each API call sequence output by the code classification model. The feature interpretation results include the feature type and importance score of the word frequency-inverse document frequency vector in the target vector set.

[0110] Based on the feature interpretation results of the target vector set corresponding to each API call sequence, multiple malicious code feature API sequences and multiple benign code feature API sequences are identified.

[0111] Create an API sequence set based on multiple malicious code feature API sequences and multiple benign code feature API sequences.

[0112] The malicious code samples in the above embodiments can be obtained from malware sample libraries, such as the VirusShare platform. In one example, the malicious code samples in the above embodiments can also be updated based on updates to the malicious code in the malware sample library. Specifically, one can log in to the VirusShare platform website and, based on the already downloaded BitTorrent list, determine whether a new BitTorrent list exists. If a new BitTorrent list exists, it can be downloaded, and subsequently, a new malicious code archive can be downloaded. Decompressing the archive yields the updated Portable Executable (PE) malicious code sample.

[0113] In one example, a sample set is run within a sandbox to obtain the API call sequence corresponding to each code sample. Specifically, this may include executing the following steps for each code sample: running the code sample program within the sandbox; dynamically analyzing the code samples through the sandbox to generate a JavaScript Object Notation (JSON) file storing the detection results; traversing the JSON file to obtain the initial API call sequence; and extracting API sequence features from the initial API call sequence using a Python script to obtain the API call sequence. The aforementioned sandbox could be, for example, the Cuckoo sandbox. Extracting API sequence features from the initial API call sequence using a Python script may include extracting API bag-of-words (N-gram) features, such as 2-gram, 3-gram, 4-gram, and 5-gram features. As an example, the API N-gram feature extraction process for PE malware can be as follows: Figure 5 As shown.

[0114] In the above embodiments, the API call sequence can be a text representation of code samples. Each API call sequence can be segmented using a word segmenter. The term information corresponding to each API call sequence consists of multiple words, which represent the API sequence, and this API sequence can be a part of the API call sequence. A vocabulary is constructed based on the term information corresponding to each API call sequence. Specifically, this may include: traversing the term information corresponding to each API call sequence, collecting all unique words, and constructing a vocabulary containing all words.

[0115] In one example, for the term information corresponding to each API call sequence, the target vector set corresponding to the term information is calculated based on the vocabulary. This can include: calculating the word frequency of each word in the term information corresponding to each API call sequence based on the vocabulary; and calculating the word frequency-inverse document frequency vector of each word based on the word frequency and the distribution of each word in the term information corresponding to each API call sequence. As an example, the term information corresponding to each API call sequence can be represented by the text documents corresponding to each API call sequence. The word frequency-inverse document frequency vector of any word in any API call sequence can be calculated using Equations 1 and 2.

[0116] TF = n / N (Equation 1)

[0117]

[0118] In Equation 1, n can represent the number of times a word appears in the text document corresponding to the API call sequence, and N can represent the total number of words in the text document corresponding to the API call sequence.

[0119] In Equation 2, M can represent the total number of all API call sequences corresponding to the vocabulary. DF can represent the number of text documents containing the vocabulary among all text documents corresponding to the API call sequences.

[0120] In the above embodiments, the code classification model may include one or more models such as statistical classification models and deep learning-based classification models. It is understood that the code classification model needs to be trained before application. In one example, the training process of the code classification model may include the following steps: obtaining a training sample set, which includes multiple training samples. Each training sample includes a vector set corresponding to an API call sequence and classification labels. The vector set includes word frequency-inverse document frequency vectors for multiple words. The classification labels can be determined based on the code type corresponding to the API call sequence. For example, if the code type corresponding to the API call sequence is malicious code, the classification label can be "malicious code"; if the code type corresponding to the API call sequence is benign code, the classification label can be "benign code". The training sample set is input into a preset code classification model. The code classification model processes the vector set of each training sample to obtain the classification result for each training sample. Based on the classification labels and classification results of each training sample, the code classification model is iteratively trained until the training stopping condition is met, resulting in a trained code classification model. The training stopping condition may include reaching a preset number of iterations, or the model's loss function reaching a preset value, etc., which are not limited here.

[0121] In the above implementation, the feature type of the term frequency-inverse document frequency vector can be malicious code features, benign code features, or neutral features. The importance score can represent the contribution value of the term frequency-inverse document frequency vector in classification prediction. Based on the feature interpretation results of the target vector set corresponding to each API call sequence, multiple malicious code feature API sequences and multiple benign code feature API sequences are determined. Specifically, this can include: determining multiple first term frequency-inverse document frequency vectors from the term frequency-inverse document frequency vectors of type malicious code features based on the importance score of each malicious code feature. For example, term frequency-inverse document frequency vectors with importance scores greater than a preset importance score threshold can be determined as first term frequency-inverse document frequency vectors, or the top few term frequency-inverse document frequency vectors with the highest importance scores can be determined as first term frequency-inverse document frequency vectors. The API sequences corresponding to the multiple first term frequency-inverse document frequency vectors are determined as multiple malicious code feature API sequences. Based on the importance score of each benign code feature, multiple second term frequency-inverse document frequency (IF-IVF) vectors are determined from the term frequency-inverse document frequency (IF-IVF) vectors of type benign code feature. For example, the second IF-IVF vectors can be selected from the term frequency-IVF vectors with importance scores greater than a preset importance score threshold, or the top few term frequency-IVF vectors with the highest importance scores can be selected as the second IF-IVF vectors. The API sequences corresponding to the multiple second IF-IVF vectors are then determined as multiple benign code feature API sequences.

[0122] According to the above implementation method, code programs can be dynamically executed through a sandbox, thereby exposing their dynamic behavior and obtaining the APIs corresponding to the code samples. Subsequently, using the APIs of the PE code as features, a large number of code samples are processed, resulting in a large number of malicious code feature API sequences and benign code feature API sequences. This allows for the automatic and accurate location of malicious and benign code feature API sequences within code samples, facilitating the modification of the code to counteract these vulnerabilities. Furthermore, by creating a large number of malicious and benign code feature API sequences, these sequences can be used to randomly modify preset code files. This facilitates the automated generation of massive amounts of adversarial malicious code samples capable of evading antivirus software and sandboxes, allowing for better exposure of the vulnerabilities of antivirus software and sandboxes.

[0123] In one embodiment, the code classification model includes a Support Vector Machine (SVM) model, a Gradient Boosting Decision Tree (XGBoost) model, and a Convolutional Neural Network (CNN) model.

[0124] Obtain the feature interpretation results of the target vector set corresponding to each API call sequence output by the code classification model. Specifically, this can include performing the following steps for each target vector set corresponding to each API call sequence:

[0125] Obtain the first feature weights corresponding to each term frequency-inverse document frequency vector in the SVM model.

[0126] Calculate the Shapley value for each term frequency-inverse document frequency vector in the XGBoost model.

[0127] The feature type corresponding to each term frequency-inverse document frequency vector is determined based on the Shapley value corresponding to each term frequency-inverse document frequency vector.

[0128] Calculate the locally interpretable model-independent interpretation (LIME) corresponding to each term frequency-inverse document frequency vector in the CNN model.

[0129] Based on LIME, determine the second feature weights corresponding to each term frequency-inverse document frequency vector.

[0130] The importance score of each term frequency-inverse document frequency vector is calculated based on the first feature weight and the second feature weight corresponding to each term frequency-inverse document frequency vector.

[0131] In the above implementation, the SVM model, XGBoost model, and CNN model can be combined using ensemble learning to obtain a code classification model. As an example, the combination of the SVM model, XGBoost model, and CNN model is y. ensemble (x) can be represented by the following equation 3.

[0132]

[0133] In Equation 3, NormA i This can represent accuracy normalization. NormE i This can represent efficiency normalization. The parameter α (0 ≤ α ≤ 1) can be the weight value for accuracy normalization, y i (x) can represent the weight of model i on feature point x.

[0134] In the above implementation, the SVM model is a linear model, which is interpretable and allows direct acquisition of the first feature weights corresponding to each word frequency-inverse document frequency vector in the SVM model.

[0135] The XGBoost model is not interpretable. In the above implementation, the Shapley Value (SHAP) of each term frequency-inverse document frequency vector in the XGBoost model can be calculated using the Shapley Additive exPlanations (SHAP) model. The SHAP model is based on game theory principles. Through the SHAP model, a Shapley value can be recalculated for each feature of the model, illustrating the positive or negative impact of the feature on the model's predictions. For each feature, if all malicious code samples have positive Shapley values ​​for that feature, and all benign code samples have negative Shapley values ​​for that feature, then that feature is a malicious code feature. Similarly, if all malicious samples have negative Shapley values ​​for that feature, and all benign samples have positive Shapley values ​​for that feature, then that feature is a benign code feature. The more malicious code features a code sample possesses, the more likely it is to be predicted as a malicious code sample; the more benign code features a sample possesses, the more likely it is to be predicted as a benign code sample. The SHAP model can be defined as shown in Equation 4 below.

[0136]

[0137] In Equation 4, g(z) can represent the SHAP model. M can represent the number of input features, and Ф0 can represent a constant, which can be defined according to actual needs. Ф k This can represent the Shapley value of feature k. Its Ф k It can be calculated using the following formula 5.

[0138]

[0139] In Equation 5, |M| can represent the set of input features. |N| can represent {M\x k A subset of}. It can represent the probability corresponding to different combinations of features. f(x) N∪{k} ) and f(x N ) can represent x under different combinations of features. k The prediction results of the model when it is included in the model and when it is not included in the model.

[0140] CNN models are generally considered uninterpretable. In the above implementation, local interpretability of the model can be provided through LIME. Specifically, the output of LIME can be a list of explanations reflecting the contribution of each feature to the prediction of the data samples, thus providing local interpretability, and also identifying which feature changes will have the greatest impact on the prediction. As an example, LIME can be defined by Equation 6 below.

[0141]

[0142] For an explanatory model g of instance x, the approximation between model g and the original model f can be compared by minimizing the loss function. Here, Ω(g) represents the model complexity of the explanatory model g. G can represent all possible explanatory models. π x This can be used to define the neighborhood of x. Minimizing L makes the model f interpretable. The model g, the size of the neighborhood, and the model complexity all need to be defined according to the specific circumstances.

[0143] In the above embodiments, calculating the importance score of each term frequency-inverse document frequency vector based on the first feature weight and the second feature weight corresponding to each term frequency-inverse document frequency vector may include calculating the first feature weight and the second feature weight corresponding to each term frequency-inverse document frequency vector according to a preset algorithm to obtain the importance score of each term frequency-inverse document frequency vector. The preset algorithm may include calculating the sum of the first feature weight and the second feature weight, or calculating the weighted average of the first feature weight and the second feature weight, etc.

[0144] According to the above implementation method, by combining multiple classification model techniques and model interpretation methods, malicious code features and benign code features are identified through Shapley values, and the importance score of the features is calculated through the first feature weight and the second feature weight. In this way, malicious code features and benign code features that have a significant impact on the model classification results can be accurately identified, thereby facilitating the generation of massive amounts of malicious code feature API sequences and benign code feature API sequences.

[0145] In one embodiment, the preset instruction modification rules may include:

[0146] Get the target instruction length of the refactoring jump instruction.

[0147] If the target instruction length is less than or equal to a preset instruction length threshold, the unconditional jump instruction is modified with an equivalent instruction to obtain a reconstructed jump instruction.

[0148] If the target instruction length is greater than the preset instruction length threshold, the unconditional jump instruction is modified into an interrupt exception instruction to obtain the reconstructed jump instruction.

[0149] In the above embodiments, obtaining the target instruction length for the refactoring jump instruction can include a target instruction length determined based on the impact of instruction length changes on the overall program performance and security. To ensure the accuracy and consistency of instruction modifications, automated tools or scripts can be used to generate the modified code. These tools can automatically adjust the instruction length according to the instruction set and rules of the target architecture.

[0150] In the above embodiments, the equivalent instruction modification method may include replacing the instruction to be modified with an unconditional jump instruction that jumps to a new section. The length of the instruction in the new section is unrestricted, thus allowing the original instruction to be reconstructed into an instruction of arbitrary length. As an example, the replacement of binary code equivalent instructions can be achieved by calling the IDA Python IDC library. See [link to documentation] for details. Figure 6 It can perform instruction movement, erasure, and reconstruction on the original instruction sequence to obtain reconstructed jump instructions.

[0151] When modifying the quality of unconditional jumps, if the target instruction length exceeds the instruction length threshold (such as the original instruction length), the equivalent instruction modification method cannot be used. In cases where the target instruction length exceeds the threshold, if the equivalent instruction modification method is employed, the modified equivalent instruction will occupy adjacent space, causing the subsequent instruction to be overwritten, altering the program's control flow, compromising program integrity, and ultimately preventing program execution. According to the above implementation method, when the target instruction length exceeds the instruction length threshold, the unconditional jump instruction can be modified into an interrupt exception instruction, achieving exception-based equivalent instruction replacement to obtain the reconstructed jump instruction.

[0152] For example, modifying an unconditional jump instruction into an interrupt exception instruction can be implemented based on Structured Exception Handling (SEH). SEH is the way the Windows operating system handles exceptions when a program encounters an exception. SEH is an error protection and repair mechanism that tells the system who should handle exceptions or errors encountered during program execution. The program can handle exceptions and errors through SEH. For example, static binary rewriting can be used to insert exception handling functions into the binary executable program, and the exception handling functions are installed at the beginning of program execution. Specifically, the unconditional jump instructions (JMP and CALL, etc.) in the preset code file can be modified using the INT3 exception (CC interrupt exception) to obtain the CC instruction. When the program executes this jump instruction, it will trigger an interrupt exception, and the exception handling function will execute the jump. For specific operations, please refer to [link to documentation]. Figure 7 .like Figure 7As shown, a new section can be added using a script, with the corresponding content constructed within it. A jump function can then be used to jump back to the original entry point after the SEH installation process is complete. The SEH processing function itself can be manually constructed, written in assembly language, translated into binary machine code, and finally embedded into the new section using Python.

[0153] According to the above implementation methods, the flexibility of instruction modification is improved by using equivalent instruction replacement and abnormal equivalent instruction replacement. The abnormal equivalent instruction replacement method can solve the problem that traditional instruction replacement methods cannot replace short-byte instructions. This helps to add API noise and change the execution order of APIs without affecting program functionality.

[0154] In one embodiment, noise is inserted into the target code file to obtain initial samples, which may specifically include:

[0155] Identify the target API sequence corresponding to the malicious code characteristics in the target code file.

[0156] Noise is inserted into the target API sequence to obtain the initial sample.

[0157] In the above embodiments, inserting noise into the target API sequence may include randomly inserting noise at least once in the beginning, end, or middle of the target API sequence.

[0158] According to the above implementation method, performing noise insertion on the target API sequence can better hide the characteristics of malicious code, thereby improving the probability of adversarial samples successfully evading the detection of antivirus software and sandboxes.

[0159] In one embodiment, the number of initial samples can be multiple.

[0160] The initial samples are iterated according to a preset evolutionary algorithm to obtain adversarial examples, which may include:

[0161] A set of variant samples is created based on multiple initial samples.

[0162] Extract a predetermined number of initial samples from the mutated sample set.

[0163] The preset mutation algorithm is used to perform mutation calculations on a preset number of initial samples to obtain multiple mutated samples.

[0164] Perform crossover operations on multiple mutated samples to obtain multiple crossover samples.

[0165] Functional validation was performed on multiple cross-samples.

[0166] Determine multiple target cross-samples from multiple cross-samples based on the functional verification results to obtain a target cross-sample set.

[0167] According to the preset fitness criterion, perform a target sample set on the target cross-sample set and the mutation sample set.

[0168] Use the target sample set as the new mutation sample set, use the multiple samples in the target sample set as the new multiple initial samples, and return to extract a preset number of initial samples from the mutation sample set until the preset stop condition is met.

[0169] Generate adversarial samples according to the target sample set.

[0170] The above embodiments can be implemented based on the differential evolution algorithm. For the convenience of explanation, a specific example is given below to explain the process of generating adversarial samples based on the differential evolution algorithm.

[0171] In the mutation sample set, each initial sample can include multi-dimensional eigenvalue of the problem space. In one example, generating adversarial samples can be implemented through the following steps S210 to S250.

[0172] S210, randomly select three different samples A, B, and C from the mutation sample set and perform a linear combination through Equation 7.

[0173]

[0174] In Equation 7, V i can represent the mutated sample, F can represent the scaling factor for controlling the intensity of mutation. times can represent the number of iterations. <0​​​​​​​​​​​​​​​​​​​​​​​[d]. In this way, the superior traits resulting from the mutation can be integrated into the original population.

[0177] S230 uses the open-source sandbox system Cuckoo Sandbox to verify whether crossover samples retain the original behavior, and uses the crossover samples that retain the original behavior as the objects for the next step of evolution.

[0178] S240, according to the preset fitness criteria, compare the above crossover samples with the initial samples, select the better samples as the new set of variant samples, and return to step S210 until the preset stopping condition is met.

[0179] In step S240, the preset stopping condition may include reaching the maximum number of iterations and finding a solution that satisfies the sandbox score. In this way, the evolutionary direction of the sample set is guaranteed through a "survival of the fittest" mechanism.

[0180] S250 generates adversarial examples based on the better samples after the last iteration.

[0181] According to the above implementation method, a differential evolution algorithm is introduced for population optimization. By continuously iterating to obtain candidate samples, a large number of malicious code adversarial samples that can evade antivirus software and sandboxes can be generated.

[0182] In one example, the adversarial example generation method based on the above-described embodiments can be based on... Figure 8 The framework for the adversarial sample generation system shown is implemented.

[0183] like Figure 8 As shown, an adversarial example generation system can include a machine learning module and a code intelligent mutation module.

[0184] The machine learning module can perform dataset construction, feature extraction and filtering, model training and evaluation, and interpretable artificial intelligence. Specifically, it can acquire raw malicious sample and raw benign sample datasets, execute samples through a sandbox, and extract API sequence features. After feature filtering, through model training and evaluation, a trained model is obtained. Based on the trained model, model interpretation is performed to obtain a large number of malicious code feature API sequences (black feature API sequences) and benign code feature API sequences (white feature API sequences). These malicious and benign code feature API sequences are then input into the code intelligent mutation module, enabling API sequence input and noise insertion based on these sequences.

[0185] The intelligent code mutation module can identify, modify, and flatten control flow API sequences based on malicious and benign code characteristic API sequences. It then uses a differential evolution algorithm to intelligently mutate the code files, generating a massive number of complete adversarial samples. Furthermore, the module can execute and evaluate these adversarial samples using sandboxes and antivirus software, further filtering out high-quality adversarial samples.

[0186] Based on the same inventive concept, embodiments of this application also provide an adversarial sample generation device.

[0187] like Figure 9 As shown, the adversarial sample generation device 200 may include a first acquisition module 201, a first determination module 202, a modification module 203, a first processing module 204, an insertion module 205, and an iteration module 206.

[0188] The first acquisition module 201 is used to acquire a preset code file.

[0189] The first determining module 202 is used to determine the unconditional jump instructions in the preset code file.

[0190] Modification module 203 is used to modify unconditional jump instructions into reconstructed jump instructions according to preset instruction modification rules.

[0191] The first processing module 204 is used to perform control flow flattening processing on the basic blocks of the preset code file.

[0192] The insertion module 205 is used to insert a preset API sequence into a preset code file according to preset rules based on the result of control flow flattening processing, so as to obtain a target code file containing malicious code features. The preset API sequence is obtained from a preset API sequence set, which includes multiple malicious code feature API sequences and multiple benign code feature API sequences.

[0193] The insertion module 205 is also used to insert noise into the target code file to obtain an initial sample.

[0194] The iteration module 206 is used to iterate the initial sample according to a preset evolutionary algorithm to obtain adversarial samples.

[0195] The adversarial sample generation apparatus of this application embodiment can acquire a preset code file, identify unconditional jump instructions in the preset code file, modify the unconditional jump instructions into reconstructed jump instructions according to preset instruction modification rules, and perform control flow flattening processing on the basic blocks of the preset code file. Next, based on the result of the control flow flattening processing, a preset API sequence can be inserted into the preset code file according to preset rules to obtain a target code file containing malicious code features. The preset API sequence is obtained from a preset API sequence set, which includes multiple malicious code feature API sequences and multiple benign code feature API sequences. Thus, random modification of the preset API sequence can be achieved based on the pre-identified malicious code feature API sequences and benign code feature API sequences. This allows modification of the code file while maintaining the integrity and functionality of the malicious code. Subsequently, noise can be inserted into the target code file to obtain an initial sample. Inserting noise can interfere with the analysis of program behavior, thereby helping the sample evade detection by antivirus software and sandboxes. Through random modification of the API sequence and random addition of noise, the code sample can be expanded. Then, the initial sample is iterated according to a preset evolutionary algorithm to obtain adversarial samples. In this way, by continuously iterating the samples, a massive number of adversarial malicious code samples that can evade antivirus software and sandboxes can be generated.

[0196] In one embodiment, the apparatus may further include:

[0197] The second acquisition module is used to acquire a sample set before inserting a preset API sequence into a preset code file according to preset rules based on the result of control flow flattening processing and obtaining a target code file containing malicious code characteristics. The sample set includes multiple code samples, which include multiple malicious code samples and multiple benign code samples.

[0198] The run module is used to run the sample set within the sandbox to obtain the API call sequence corresponding to each code sample.

[0199] The second processing module is used to perform word segmentation on each API call sequence to obtain the word information corresponding to each API call sequence. The word information includes multiple words, which are used to represent the API sequence.

[0200] The building module is used to construct a vocabulary based on the term information corresponding to each API call sequence.

[0201] The calculation module is used to calculate the target vector set corresponding to the term information for each API call sequence based on the vocabulary. The target vector set includes the term frequency-inverse document frequency vectors of multiple words.

[0202] The input module is used to input the target vector set corresponding to each API call sequence into the pre-trained code classification model.

[0203] The classification module is used to classify various API call sequences based on a target vector set using a code classification model.

[0204] The second acquisition module is also used to acquire the feature interpretation results of the target vector set corresponding to each API call sequence output by the code classification model. The feature interpretation results include the feature type and importance score of the word frequency-inverse document frequency vector in the target vector set.

[0205] The second determination module is used to determine multiple malicious code feature API sequences and multiple benign code feature API sequences based on the feature interpretation results of the target vector set corresponding to each API call sequence.

[0206] Create a module for creating an API sequence set based on multiple malicious code feature API sequences and multiple benign code feature API sequences.

[0207] In one embodiment, the code classification model may include a Support Vector Machine (SVM) model, a Gradient Boosting Decision Tree (XGBoost) model, and a Convolutional Neural Network (CNN) model.

[0208] The second acquisition module is used to obtain the feature interpretation results of the target vector set corresponding to each API call sequence output by the code classification model. Specifically, it may include: The second acquisition module is used to perform the following steps for each target vector set corresponding to each API call sequence:

[0209] Obtain the first feature weights corresponding to each term frequency-inverse document frequency vector in the SVM model.

[0210] Calculate the Shapley value for each term frequency-inverse document frequency vector in the XGBoost model.

[0211] The feature type corresponding to each term frequency-inverse document frequency vector is determined based on the Shapley value corresponding to each term frequency-inverse document frequency vector.

[0212] Calculate the locally interpretable model-independent interpretation (LIME) corresponding to each term frequency-inverse document frequency vector in the CNN model.

[0213] Based on LIME, determine the second feature weights corresponding to each term frequency-inverse document frequency vector.

[0214] The importance score of each term frequency-inverse document frequency vector is calculated based on the first feature weight and the second feature weight corresponding to each term frequency-inverse document frequency vector.

[0215] In one embodiment, the preset instruction modification rules may include:

[0216] Get the target instruction length of the refactoring jump instruction.

[0217] If the target instruction length is less than or equal to a preset instruction length threshold, the unconditional jump instruction is modified with an equivalent instruction to obtain a reconstructed jump instruction.

[0218] If the target instruction length is greater than the preset instruction length threshold, the unconditional jump instruction is modified into an interrupt exception instruction to obtain the reconstructed jump instruction.

[0219] In one embodiment, the insertion module is used to insert noise into the target code file to obtain an initial sample, which may specifically include:

[0220] The determination submodule is used to determine the target API sequence corresponding to the malicious code characteristics in the target code file.

[0221] The insertion submodule is used to insert noise into the target API sequence to obtain the initial sample.

[0222] In one embodiment, the number of initial samples can be multiple.

[0223] The iteration module is used to iterate over the initial samples according to a preset evolutionary algorithm to obtain adversarial examples, which may include:

[0224] Create a submodule to create a set of variant samples based on multiple initial samples.

[0225] The extraction submodule is used to extract a preset number of initial samples from the mutated sample set.

[0226] The calculation submodule is used to perform mutation calculations on a preset number of initial samples according to a preset mutation algorithm to obtain multiple mutated samples.

[0227] The crossover submodule is used to perform crossover operations on multiple mutated samples to obtain multiple crossover samples.

[0228] The validation submodule is used to perform functional validation on multiple cross-samples respectively.

[0229] The determination submodule is used to determine multiple target cross samples from multiple cross samples based on the functional verification results, and obtain the target cross sample set.

[0230] The determination submodule is also used to determine the target sample set from the target crossover sample set and the mutant sample set according to a preset fitness criterion.

[0231] The return submodule is used to take the target sample set as a new mutated sample set, take multiple samples in the target sample set as multiple new initial samples, and return the preset number of initial samples extracted from the mutated sample set until the preset stopping condition is met.

[0232] The generation submodule is used to generate adversarial examples based on the target sample set.

[0233] The adversarial example generation device provided in this application embodiment can achieve... Figure 1 The various processes implemented in the method implementation examples will not be described again here to avoid repetition.

[0234] Figure 10 A schematic diagram of the hardware structure of the adversarial sample generation device provided in an embodiment of this application is shown.

[0235] The adversarial sample generation device may include a processor 301 and a memory 302 storing computer program instructions.

[0236] Specifically, the processor 301 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0237] Memory 302 may include mass storage for data or instructions. For example, and not limitingly, memory 302 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 302 may include removable or non-removable (or fixed) media. Where appropriate, memory 302 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 302 is non-volatile solid-state memory.

[0238] Memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the methods according to one aspect of this disclosure.

[0239] The processor 301 implements any of the adversarial sample generation methods in the above embodiments by reading and executing computer program instructions stored in the memory 302.

[0240] As an example, the adversarial example generation device may also include a communication interface 303 and a bus 310. Wherein, such as Figure 10 As shown, the processor 301, memory 302, and communication interface 303 are connected through bus 310 and complete communication with each other.

[0241] The communication interface 303 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0242] Bus 310 includes hardware, software, or both, that couples components of an online data traffic metering device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 310 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0243] The adversarial example generation device can execute the adversarial example generation method in the embodiments of this application, thereby achieving a combination of Figure 1 and Figure 9 The adversarial example generation method and apparatus are described.

[0244] Furthermore, in conjunction with the adversarial example generation methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the adversarial example generation methods in the above embodiments.

[0245] In addition, in conjunction with the adversarial example generation methods in the above embodiments, this application provides a computer program product in which the instructions are executed by the processor of an electronic device, causing the electronic device to execute any of the adversarial example generation methods in the above embodiments.

[0246] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0247] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0248] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0249] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0250] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. An adversarial sample generation method, characterized in that, include: Get the preset code file; Determine the unconditional jump instructions in the preset code file; Modify the unconditional jump instruction into a reconstructed jump instruction according to the preset instruction modification rules; The basic blocks of the preset code file are subjected to control flow flattening processing; Based on the result of the control flow flattening process, a preset application programming interface (API) sequence is inserted into the preset code file according to preset rules to obtain a target code file containing malicious code features. The preset API sequence is obtained from a preset API sequence set, which includes multiple malicious code feature API sequences and multiple benign code feature API sequences. Noise is inserted into the target code file to obtain the initial sample; The initial sample is iterated according to a preset evolutionary algorithm to obtain adversarial samples.

2. The method of claim 1, wherein, Before inserting a preset API sequence into the preset code file according to preset rules based on the result of the control flow flattening process to obtain a target code file containing malicious code characteristics, the method further includes: Obtain a sample set, which includes multiple code samples, including multiple malicious code samples and multiple benign code samples; Run the sample set in the sandbox to obtain the API call sequence corresponding to each code sample; Each API call sequence is segmented to obtain word information corresponding to each API call sequence. The word information includes multiple words, which are used to represent the API sequence. Construct a vocabulary based on the term information corresponding to each API call sequence; For each API call sequence, the target vector set corresponding to the term information is calculated based on the vocabulary. The target vector set includes multiple term frequency-inverse document frequency vectors of the term. The target vector sets corresponding to each API call sequence are input into the pre-trained code classification model; The code classification model is used to classify each API call sequence based on the target vector set. Obtain the feature interpretation results of the target vector set corresponding to each API call sequence output by the code classification model, wherein the feature interpretation results include the feature type and importance score of the word frequency-inverse document frequency vector in the target vector set; Based on the feature interpretation results of the target vector set corresponding to each API call sequence, multiple malicious code feature API sequences and multiple benign code feature API sequences are identified. The API sequence set is created based on the multiple malicious code feature API sequences and the multiple benign code feature API sequences.

3. The method of claim 2, wherein, The code classification model includes a support vector machine (SVM) model, a gradient boosting decision tree (XGBoost) model, and a convolutional neural network (CNN) model. The step of obtaining the feature interpretation results of the target vector set corresponding to each API call sequence output by the code classification model includes performing the following steps for each target vector set corresponding to each API call sequence: Obtain the first feature weights corresponding to each term frequency-inverse document frequency vector in the SVM model; Calculate the Shapley value corresponding to each term frequency-inverse document frequency vector in the XGBoost model; Based on the Shapley value corresponding to each term frequency-inverse document frequency vector, determine the feature type corresponding to each term frequency-inverse document frequency vector; Calculate the locally interpretable model-independent interpretation (LIME) corresponding to each term frequency-inverse document frequency vector in the CNN model; Based on the LIME, determine the second feature weights corresponding to each term frequency-inverse document frequency vector; The importance score of each term frequency-inverse document frequency vector is calculated based on the first feature weight and the second feature weight corresponding to each term frequency-inverse document frequency vector.

4. The method of claim 1, wherein, The preset instruction modification rules include: Get the target instruction length of the refactoring jump instruction; If the target instruction length is less than or equal to a preset instruction length threshold, the unconditional jump instruction is modified with an equivalent instruction to obtain the reconstructed jump instruction. If the target instruction length is greater than a preset instruction length threshold, the unconditional jump instruction is modified into an interrupt exception instruction to obtain the reconstructed jump instruction.

5. The method of claim 1, wherein, The step of inserting noise into the target code file to obtain initial samples includes: Identify the target API sequence corresponding to the malicious code features in the target code file; Noise is inserted into the target API sequence to obtain the initial sample.

6. The method of claim 1, wherein, The number of initial samples is multiple; The step of iterating the initial sample according to a preset evolutionary algorithm to obtain adversarial samples includes: Create a set of variant samples based on multiple initial samples; Extract a predetermined number of initial samples from the set of mutated samples; The preset number of initial samples are subjected to mutation calculations according to a preset mutation algorithm to obtain multiple mutated samples; Perform a crossover operation on each of the multiple mutated samples to obtain multiple crossover samples; Functional verification was performed on each of the multiple cross-samples; Based on the functional verification results, multiple target cross samples are determined from the multiple cross samples to obtain a target cross sample set; According to the preset fitness criteria, the target sample set is determined from the target crossover sample set and the mutant sample set; The target sample set is used as a new mutant sample set, and multiple samples in the target sample set are used as multiple new initial samples. The process of extracting a preset number of initial samples from the mutant sample set continues until a preset stopping condition is met. Adversarial examples are generated based on the target sample set.

7. An adversarial sample generation apparatus, comprising: include: The acquisition module is used to acquire preset code files; The determination module is used to determine the unconditional jump instructions in the preset code file; The modification module is used to modify the unconditional jump instruction into a reconstructed jump instruction according to a preset instruction modification rule; The processing module is used to perform control flow flattening processing on the basic blocks of the preset code file; An insertion module is used to insert a preset API sequence into a preset code file according to preset rules based on the result of the control flow flattening process, thereby obtaining a target code file containing malicious code features. The preset API sequence is obtained from a preset API sequence set, which includes multiple malicious code feature API sequences and multiple benign code feature API sequences. The insertion module is also used to insert noise into the target code file to obtain an initial sample; The iteration module is used to iterate the initial sample according to a preset evolutionary algorithm to obtain adversarial samples.

8. An electronic device, comprising: The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the adversarial sample generation method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the adversarial example generation method as described in any one of claims 1-6.

10. A computer program product, characterised in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device causes the electronic device to perform the adversarial sample generation method as described in any one of claims 1-6.

Images