Method of predicting Ransomware and Apparatus for executing the same

Abstract

A ransomware prediction method according to a disclosed embodiment comprises: a hybrid analysis step of extracting an OPcode sequence and an API call sequence based on an executable file received from an external source; a data vectorization step of generating a first embedding vector from the extracted OPcode sequence based on the FastText technique and generating a second embedding vector from the extracted API call sequence based on the FastText technique; a pattern extraction step of generating a static feature tensor from a pre-trained first Bi-GRU (Bidirectional-Gated Recurrent Unit) model by inputting the first embedding vector and generating a dynamic feature tensor from a pre-trained second Bi-GRU model by inputting the second embedding vector; and an API call prediction step of combining the static feature tensor and the dynamic feature tensor and extracting an API call sequence vector having a preset first behavior size from a pre-trained TCN (Temporal Convolution Network) model by inputting the combined feature tensor.

Description

Technology Field

[0001] The present invention relates to a method for predicting the API call behavior of ransomware based on a Bi-GRU (Bidirectional-Gated Recurrent Unit) and a TCN (Temporal Convolution Network), and an apparatus for executing the same. Background Technology

[0002] Damage caused by ransomware attacks is continuously increasing due to the development of information and communication technology (ICT) and the data technology industry, as well as the emergence of cryptocurrencies and the acceleration of digital transformation. Ransomware is a type of malware that encrypts a user's system or data and demands money from the user, and it can also cause secondary damage by leaking important data to the outside. While the primary targets of early ransomware attacks were governments and corporations, the scope of damage has recently expanded to various industrial sectors such as services, manufacturing, and healthcare. Furthermore, with the emergence of 'Ransomware as a Service (RasS),' which produces and sells ransomware, new and variant ransomware types are rapidly increasing.

[0003] Techniques for detecting ransomware attacks are broadly classified into static analysis and dynamic analysis. Static analysis extracts and analyzes assembly code, so the analysis time is short, but it is difficult to analyze obfuscated ransomware (Balram et al., 2019). On the other hand, dynamic analysis executes files to monitor behavior in real time, but it requires a longer analysis time compared to static analysis (Kara et al., 2021; Sharmeen et al., 2020), and cases occur where the system becomes infected and encrypted while the analysis is being performed.

[0004] To solve the above-mentioned problem, Korean Registered Patent Publication No. 10-1988747 discloses a machine learning-based ransomware detection method through hybrid analysis that increases the ransomware detection rate by generating a dataset by performing static and dynamic analysis, and determining whether each is ransomware through modeling based on multiple modeling variables generated by filtering the dataset.

[0005] However, the aforementioned conventional techniques only partially improve upon the shortcomings of static and dynamic analysis and have limitations in that they fail to mitigate the risk of ransomware infection caused by the long execution time of dynamic analysis. Therefore, there is a need for a ransomware detection method that effectively shortens analysis time to lower the probability of infection while maintaining high prediction accuracy.

[0006] [Previous Paper 1] Balram, N., Hsieh, G., & McFall, C. (2019). Static malware analysis using machine learning algorithms on APT1 dataset with string and PE header features. 2019 International Conference on Computational Science and Computational Intelligence (CSCI), Las Vegas, NV, USA, 90-95.

[0007] [Previous Paper 2] Kara, I., & Aydos, M. (2021). The rise of ransomware: Forensic analysis for windows based ransomware attacks. Expert Systems with Applications, 190, 1-14.

[0008] [Previous Paper 3] Sharmeen, S., Ahmed, YA, Huda, S., Koηer, BS, & Hassan, MM (2020). Avoiding future digital extortion through robust protection against ransomware threats using deep learning based adaptive approaches. IEEE Access, 8, 24522-24534.

[0009] [Previous Paper 4] Zhou, H., Zhang, S., Peng, J., Zhang, S., Li, J., Xiong, H., & Zhang, W. (2021). Informer: Beyond efficient transformer for long sequence time-series forecasting. Proceedings of the AAAI Conference on Artificial Intelligence, 35(12), 11106-11115.

[0010] (Patent Document 1) KR 10-1988747 B1 The problem to be solved

[0011] An embodiment disclosed to solve these problems relates to a ransomware prediction method and an apparatus for executing the same, which can prevent damage caused by ransomware in advance by relatively accurately predicting long-term behavior through short-term behavior analysis by learning various ransomware behaviors using a Bi-GRU model that considers behavioral information in both directions and a TCN model optimized for processing long-term time-series data. means of solving the problem

[0012] A ransomware prediction method according to a disclosed embodiment comprises: a hybrid analysis step of extracting an OPcode sequence and an API call sequence based on a Portable Executable (PE) file received from an external source; a data vectorization step of generating a first embedding vector from the extracted OPcode sequence based on a FastText technique and generating a second embedding vector from the extracted API call sequence based on the FastText technique; and a pattern extraction step of generating a static feature tensor from a pre-trained first Bi-GRU (Bidirectional-Gated Recurrent Unit) model by inputting the first embedding vector and generating a dynamic feature tensor from a pre-trained second Bi-GRU model by inputting the second embedding vector. and an API call prediction step of predicting an API call sequence vector having a preset first behavior size from a pre-trained TCN (Temporal Convolution Network) model by combining the static feature tensor and the dynamic feature tensor and inputting the combined feature tensor;

[0013] The above hybrid analysis step can extract the OPcode sequence and the API call sequence during a limited analysis time.

[0014] The data vectorization step may include the step of generating a first embedding vector of a first size pre-set for characters included in the OPcode sequence and a second embedding vector of a second size pre-set for characters included in the API call sequence.

[0015] The pattern extraction step may include the step of reducing the dimensionality of the first embedding vector based on a distilling technique, and generating the static feature tensor considering various behavior features based on the bidirectional order of the first embedding vector with reduced dimensionality.

[0016] The pattern extraction step may include the step of reducing the dimension of the second embedding vector based on a distilling technique, and generating the dynamic feature tensor considering various behavioral features based on the bidirectional order of the second embedding vector with reduced dimension.

[0017] The API call prediction step described above can generate a single feature tensor containing various features of a PE file by sequentially concatenating the static feature tensor and the dynamic feature tensor.

[0018] The above TCN model is composed of a plurality of temporal blocks consisting of layer combinations and residual connections that are repeated at least twice, and the layer combinations may consist of a Dilated causal convolution layer, a ReLU layer, and a Dropout layer.

[0019] The above hybrid analysis step can extract the OPcode sequence and the API call sequence to a preset third behavior size for supervised learning of the model.

[0020] The ransomware prediction method described above may further include the step of supervising the first Bi-GRU model, the second Bi-GRU model, and the TCN model based on a preset input sequence of a second behavior size and a preset actual sequence of a first behavior size. The second behavior size is characterized by being shorter than the first behavior size.

[0021] A ransomware prediction device according to another disclosed embodiment comprises: a storage unit storing an executable file received from the outside, a pre-trained first and second Bi-GRU model and a pre-trained TCN model; and a processor that predicts an API call sequence based on the executable file; wherein the processor extracts an OPcode sequence and an API call sequence based on the executable file, generates a first embedding vector from the extracted OPcode sequence based on the FastText technique, generates a second embedding vector from the extracted API call sequence based on the FastText technique, generates a static feature tensor from the pre-trained first Bi-GRU model by inputting the first embedding vector, generates a dynamic feature tensor from the pre-trained second Bi-GRU model by inputting the second embedding vector, combines the static feature tensor and the dynamic feature tensor, and extracts an API call sequence vector having a preset first behavior size from the pre-trained TCN model by inputting the combined feature tensor.

[0022] The processor can generate a first embedding vector of a first size that is preset for the characters included in the OPcode sequence and a second embedding vector of a second size that is preset for the characters included in the API call sequence.

[0023] The processor can reduce the dimension of the first embedding vector based on a distilling technique and generate the static feature tensor including various behavioral features based on a bidirectional order of the first embedding vector with reduced dimension.

[0024] The processor can reduce the dimension of the second embedding vector based on a distilling technique and generate the dynamic feature tensor including various behavioral features based on a bidirectional order of the second embedding vector with reduced dimension.

[0025] The processor can sequentially combine the static feature tensor and the dynamic feature tensor.

[0026] The above TCN model is composed of a plurality of temporal blocks consisting of layer combinations and residual connections that are repeated at least twice, and the layer combinations may consist of a Dilated causal convolution layer, a ReLU layer, and a Dropout layer.

[0027] The processor may configure the OPcode sequence and the API call sequence to a preset third action size for supervised learning of the model.

[0028] The processor can supervise the first Bi-GRU model, the second Bi-GRU model, and the TCN model based on a preset input sequence of a second behavior size and a preset actual sequence of a first behavior size. The second behavior size is characterized by being shorter than the first behavior size.

[0029] A ransomware prediction system according to another disclosed embodiment includes a service system that transmits and receives data through a communication network; and a device connected to the service system, receiving an executable file from the communication network, and predicting an API call sequence of the executable file; wherein the device stores a pre-trained first and second Bi-GRU model and a pre-trained TCN model, extracts an OPcode sequence and an API call sequence based on the executable file, generates a first embedding vector from the extracted OPcode sequence based on the FastText technique, generates a second embedding vector from the extracted API call sequence based on the FastText technique, generates a static feature tensor from the pre-trained first Bi-GRU model by inputting the first embedding vector, generates a dynamic feature tensor from the pre-trained second Bi-GRU model by inputting the second embedding vector, combines the static feature tensor and the dynamic feature tensor, and extracts an API call sequence vector having a preset first behavior size from the pre-trained TCN model by inputting the combined feature tensor. Effects of the invention

[0030] The ransomware prediction method disclosed hereto and the device executing the same utilize a Bi-GRU model that considers bidirectional behavioral information and a TCN model optimized for processing long-term time-series data to learn various ransomware behaviors, thereby predicting long-term behavior relatively accurately through short-term behavioral analysis and effectively preventing damage caused by ransomware in advance. Brief explanation of the drawing

[0031] Figure 1 is a diagram schematically illustrating a disclosed ransomware prediction device. Figure 2 is a control block diagram of a disclosed ransomware prediction device. Figure 3 is a diagram schematically illustrating a disclosed ransomware prediction method. Figure 4 is a flowchart illustrating the execution process of the disclosed ransomware prediction method. Figure 5 is a flowchart illustrating a ransomware prediction method. Figure 6 is a diagram illustrating the learning method of the first and second Bi-GRU models and the TCN model described in Figure 3. FIG. 7 is a diagram for further explaining the API call prediction step described in FIG. 3 in more detail. Specific details for implementing the invention

[0032] Throughout the specification, the same reference numerals refer to the same components. This specification does not describe all elements of the embodiments, and general content in the art to which the invention pertains or content that overlaps between embodiments is omitted.

[0033] Throughout the specification, when a part is described as being "connected" to another part, this includes not only cases where they are directly connected but also cases where they are indirectly connected, and indirect connections include connections made via a wireless communication network.

[0034] Furthermore, when it is stated that a part "includes" a certain component, this means that, unless specifically stated otherwise, it does not exclude other components but may include additional components.

[0035] Singular expressions include plural expressions unless there is an obvious exception in the context.

[0036] In addition, terms such as "~part," "~unit," "~block," "~part," and "~module" may refer to a unit that processes at least one function or operation. For example, the above terms may refer to at least one piece of hardware such as an FPGA (field-programmable gate array) or ASIC (application specific integrated circuit), at least one piece of software stored in memory, or at least one process processed by a processor.

[0037] The symbols attached to each step are used to identify each step and do not indicate the order of the steps relative to one another; the steps may be performed differently from the specified order unless a specific order is clearly indicated in the context.

[0038] Hereinafter, an embodiment relating to an electronic device and a control method according to one aspect will be described in detail with reference to the attached drawings.

[0039] FIG. 1 is a diagram schematically illustrating a disclosed ransomware prediction device, and FIG. 2 is a control block diagram of the disclosed ransomware prediction device. To avoid redundant descriptions, they are described together below.

[0040] Referring to FIG. 1, a ransomware prediction device (10) according to a disclosed embodiment analyzes an executable file (101, see FIG. 3) received through a communication network (2) and, if it is determined to be ransomware (1), transmits the prediction result to a healthcare service system (3) and an IoT service system (4).

[0041] A ransomware prediction device (10) according to a disclosed embodiment may be implemented as a computer or high-performance server capable of connecting to a user terminal or communication network capable of training an artificial intelligence model and performing inference through the trained artificial intelligence model. Here, the computer may include, for example, a laptop, desktop, laptop, tablet PC, slate PC, etc. equipped with a web browser.

[0042] The communication network (2) is a channel for receiving the executable file (101), and the ransomware prediction device (10) continuously receives the executable file (101) for a preset acquisition time.

[0043] Here, the executable file (101) is a computer file that performs a task instructed according to a coded command, and includes PE (Portable Executable) files, MZ files, COM files, PDF files, etc., and the PE file may include file formats such as exe, dll, ocx, sys, scr, etc.

[0044] The executable file (101) received in this way is stored in a storage unit (13, see FIG. 2). The ransomware prediction device (10) can predict the long-term behavior of ransomware through supervised learning, which involves extracting OPcode sequences and API call sequences based on the executable file (101) stored in the storage unit (13) and then training an artificial intelligence model.

[0045] Here, a long-term action refers to a sequence of API calls to be performed after a short-term action (hereinafter, an API call sequence with a pre-set first action size).

[0046] In comparison, short-term behavior refers to OPcode sequences and API call sequences monitored for a short period of time within 30 seconds.

[0047] The specific operation and method of the ransomware prediction device (10) predicting the long-term behavior of ransomware through short-term behavior analysis using an artificial intelligence model and inferring whether the received executable file (101) is ransomware or not will be described later through other drawings.

[0048] A ransomware prediction device (10) according to one embodiment may include at least two pre-trained Bi-GRU models (21) and a pre-trained TCN model (22).

[0049] The Bi-GRU (bidirectional gated recurrent unit) model (21) is a variant of the GRU model capable of processing input sequences of various lengths, and is a model in which the GRU is arranged bidirectionally. The Bi-GRU model learns both forward and reverse sequences and outputs a result by combining the hidden layers of each direction. That is, the Bi-GRU model improves natural language processing performance by considering bidirectional behavioral information.

[0050] The TCN (Temporal Convolutional Network) model (22) is a variation of the CNN (Convolution Neural Network) model and is composed of Causal Convolution, which is effective when considering time and order, and Dilated Convolution, which increases the size of the receptive field while preventing an increase in computational load, thereby improving precision when processing time series data.

[0051] Referring to FIG. 2, the ransomware prediction device (10) may include an input unit (11) that receives input commands from a user, a communication unit (12) that communicates with a communication network (2), a storage unit (13) that stores a received executable file and a plurality of artificial intelligence models, an output unit (14) that outputs the analysis results of a processor (20), and a processor (20) that controls the entire disclosed device.

[0052] Specifically, the input unit (11) may include hardware devices such as various buttons, switches, keyboards, mice, trackballs, various levers, handles, or sticks for receiving user input commands. Additionally, the input unit (11) may include a GUI (Graphical User Interface), i.e., a software device such as a touch pad. The touch pad may be implemented as a touch screen panel (TSP) and form a layered structure with the output unit (14).

[0053] The communication unit (12) may include one or more components that enable communication with a communication network, and may include, for example, at least one of a short-range communication module, a wired communication module, and a wireless communication module.

[0054] The short-range communication module may include various short-range communication modules that transmit and receive signals using a wireless communication network at short range, such as a Bluetooth module, an infrared communication module, an RFID (Radio Frequency Identification) communication module, a WLAN (Wireless Local Access Network) communication module, an NFC communication module, and a Zigbee communication module.

[0055] Wired communication modules may include various wired communication modules such as Controller Area Network (CAN) communication modules, Local Area Network (LAN) modules, Wide Area Network (WAN) modules, or Value Added Network (VAN) modules, as well as various cable communication modules such as Universal Serial Bus (USB), High Definition Multimedia Interface (HDMI), Digital Visual Interface (DVI), RS-232 (recommended standard 232), power line communication, or plain old telephone service (POTS).

[0056] In addition to Wi-Fi modules and WiBro (Wireless broadband) modules, the wireless communication module may include wireless communication modules that support various wireless communication methods such as GSM (global System for Mobile Communication), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), UMTS (universal mobile telecommunications system), TDMA (Time Division Multiple Access), and LTE (Long Term Evolution).

[0057] The storage unit (13) may be implemented as at least one of a non-volatile memory device such as a cache, ROM (Read Only Memory), PROM (Programmable ROM), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), and flash memory, a volatile memory device such as RAM (Random Access Memory), or a storage medium such as a hard disk drive (HDD) and CD-ROM, but is not limited thereto. The storage unit (13) may be a memory implemented as a separate chip from the processor (20) described later, or it may be implemented as a single chip with the processor (20).

[0058] The output unit (14) outputs the analysis result of the processor (20), namely whether or not it is ransomware. To this end, the output unit (14) may be provided with a Digital Light Processing (DLP) panel, a Plasma Display Panel, a Liquid Crystal Display (LCD) panel, an Electro Luminescence (EL) panel, an Electrophoretic Display (EPD) panel, an Electrochromic Display (ECD) panel, a Light Emitting Diode (LED) panel, or an Organic Light Emitting Diode (OLED) panel, but is not limited thereto.

[0059] The processor (20) controls various hardware described in FIG. 2 and trains the Bi-GRU model (21) and the TCN model (22). In addition, the processor (20) determines whether the executable file is ransomware through the sequence having a first behavior size output through the trained TCN model (22) and the sequence ultimately output.

[0060] To this end, the processor (20) may refer to a data processing device embedded in hardware having a physically structured circuit to perform a function expressed by code or instructions included in a program. Examples of such data processing devices embedded in hardware may include, but are not limited to, processing devices such as a microprocessor, a central processing unit (CPU), a processor core, a multiprocessor, an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), and a Graphics Processing Unit (GPU). The processor (20) may include one or more processors.

[0061] Meanwhile, the disclosed ransomware prediction device (10) may include various additional configurations in addition to the configuration described in FIG. 2, and various variations are possible.

[0062] FIG. 3 is a diagram schematically illustrating the disclosed ransomware prediction method, and FIG. 4 is a flowchart illustrating the execution process of the disclosed ransomware prediction method. To avoid redundant descriptions, they are described together below.

[0063] Referring first to FIG. 3, the disclosed ransomware prediction method includes a hybrid analysis step (110), a data vectorization step (120), a pattern extraction step (130), and an API call prediction step (140).

[0064] Referring to FIG. 4, in the hybrid analysis step (110), the processor (10) performs static analysis (200) and dynamic analysis (300) based on the executable file (101) to extract behavior information. Through static analysis (200), the processor (10) extracts an OPcode sequence (111-2) from the file structure (111-1) of the executable file (101). At the same time, the processor (10) performs dynamic analysis (300) in a virtual environment to extract an API call sequence (112-2) from the API calls behavior log (112-1) of the executable file (101).

[0065] Meanwhile, in the hybrid analysis step (110), the Opcode sequence (111-2) and API call sequence (112-2) are extracted during a limited analysis time. For example, the analysis time is limited to 30 seconds, and the length of each sequence may vary depending on the executable file (101), for example, the number of extracted sequences may differ.

[0066] In the data vectorization step (120), the processor (10) extracts a first embedding vector (121-1) from an OPcode sequence (111-2) based on the FastText technique and extracts a second embedding vector (122-1) from an API call sequence (112-2). The FastText technique is a type of technique for creating vectors from words, which converts words into vectors using subwords by treating each word as a character-unit n-gram. Since the FastText technique generates a vector for each subword, it can also handle Out Of Vocabulary (OOV).

[0067] In the pattern extraction step (130), the processor (10) inputs each embedding vector into a pre-trained Bi-GRU model to generate a feature tensor with a major pattern. That is, by inputting the first embedding vector (121-1), a static feature tensor (131-1) is generated from the pre-trained first Bi-GRU model (21-1), and by inputting the second embedding vector (122-1), a dynamic feature tensor (132-1) is generated from the pre-trained second Bi-GRU model (21-2).

[0068] According to one embodiment, the processor (10) may use a distilling technique to generate a static feature tensor (131-1) and a dynamic feature tensor (132-1). A distilling technique is a method for reducing the dimension of a sequence vector. According to Zhou et al. 2021, this can improve the gradient vanishing and gradient exploding problems of RNN-based deep learning models.

[0069] The processor (10) can reduce the dimensions of the first embedding vector (121-1) and the second embedding vector (122-1) according to mathematical formula 1 applied to the distilling technique.

[0070] [Mathematical Formula 1]

[0071]

[0072] Here represents the t-th embedding vector of the l-th layer, and represents a dimensionally reduced output embedding vector.

[0073] The processor (10) generates a static feature tensor (131-1) and a dynamic feature tensor (132-1) based on the bidirectional ordering of each embedding vector by inputting the dimensionally reduced first embedding vector (121-1) and second embedding vector (122-1) into the first and second Bi-GRU models (21-1, 21-2). The Bi-GRU model (21) can output behavioral features extracted with improved long-term dependency by considering the sequential features of the first embedding vector (121-1) and the second embedding vector (122-1) bidirectionally through a reset gate and an update gate. Accordingly, the first and second Bi-GRU models (21-1, 21-2) included in the disclosed ransomware prediction method also have the t-th embedding vector according to Equation 2 and the previous state vector and Forward GRU output vector from and backward GRU output vector Calculate and output the static feature tensor (131-1) and dynamic feature tensor (132-1).

[0074] [Mathematical Formula 2]

[0075]

[0076]

[0077] The API call prediction step is the step of inputting into the TCN model (22) to obtain the output result.

[0078] In the API call prediction step (140), the processor (10) combines the static feature tensor (131-1) and the dynamic feature tensor (132-1), and the combined feature tensor (141-1) is input into a pre-trained TCN model (22).

[0079] The processor (10) can concatenate static feature tensors (131-1) and dynamic feature tensors (132-1). Concatenation means connecting vectors or tensors in a linear or sequential manner.

[0080] In the API call prediction step (140), the pre-trained TCN model (22) receives a combined feature tensor (141-1) as input and extracts an API call sequence vector (142-2) having a preset first behavior size. Here, the behavior size is the capacity of the behavior information code executed during a specific time, and the behavior information is an OPcode sequence and an API call sequence.

[0081] The preset first action size may be the capacity of the action information code executed for 90 seconds. However, the standard for the preset first action size may vary and is not limited to the specific value mentioned above.

[0082] A detailed explanation of how to output an API call sequence vector through the TCN model (22) will be described later with reference to FIG. 7.

[0083] Figure 5 is a flowchart illustrating a disclosed ransomware prediction method.

[0084] Referring to FIG. 5, the disclosed ransomware prediction method receives an executable file related to ransomware from an external source (100).

[0085] The disclosed ransomware prediction method extracts OPcode sequences and API call sequences based on a received executable file (111, 112).

[0086] According to one embodiment, the ransomware prediction method disclosed in steps 111 and 112 may extract an OPcode sequence and an API call sequence to a preset second behavior size. For example, the preset second behavior size may be 30 seconds. However, the reference for the preset second behavior size may vary and is not limited to the specific value mentioned above.

[0087] The disclosed ransomware prediction method generates a first embedding vector from the extracted OPcode sequence based on the FastText technique and generates a second embedding vector from the extracted API call sequence based on the FastText technique (121, 122).

[0088] According to one embodiment, the ransomware prediction method disclosed in steps 121 and 122 generates a first embedding vector of a preset first size for characters included in the OPcode sequence and a second embedding vector of a preset second size for characters included in the API call sequence. Here, size is the dimension of the embedding vector. For example, the preset first size and the preset second size may be 256. However, the references for the preset first size and the preset second size may vary and are not limited to the specific values ​​mentioned above.

[0089] The disclosed ransomware prediction method generates a static feature tensor from a pre-trained first Bi-GRU model by inputting the first embedding vector, and generates a dynamic feature tensor from a pre-trained second Bi-GRU model by inputting the second embedding vector (131, 132).

[0090] According to one embodiment, the ransomware prediction method disclosed in step 131 can reduce the dimensionality of the first embedding vector based on a distilling technique and generate the static feature tensor that considers various behavioral features based on the bidirectional order of the first embedding vector with reduced dimensionality. Additionally, the ransomware prediction method disclosed in step 132 can reduce the dimensionality of the second embedding vector based on a distilling technique and generate the dynamic feature tensor that considers various behavioral features based on the bidirectional order of the second embedding vector with reduced dimensionality.

[0091] The disclosed ransomware prediction method combines the static feature tensor and the dynamic feature tensor (141), and by inputting the combined feature tensor, extracts an API call sequence vector having a preset first behavior size from a pre-trained Temporal Convolution Network (TCN) model (142).

[0092] Figure 6 is a diagram illustrating the learning method of the first and second Bi-GRU models and the TCN model described in Figure 3.

[0093] The disclosed ransomware prediction method performs supervised learning of a first Bi-GRU model, a second Bi-GRU model, and a TCN model based on an input sequence and an actual sequence.

[0094] Referring to FIG. 6, a sequence (110-1) extracted from an executable file (101) is separated into an input sequence (110-2) and a ground truth sequence (110-3). Here, the extracted sequence (110-1) is an OPcode sequence (111-2) or an API call sequence (112-2). The extracted sequence (110-1) is input into a Bi-GRU model (21) after passing through the data vectorization step (120) described in FIG. 4. When static feature tensors and dynamic feature tensors for the OPcode sequence (111-2) and API call sequence (112-2) are generated in the Bi-GRU model (21), they are combined and input into a TCN model (22). The TCN model receives the combined feature tensors and predicts an output sequence (150). The Bi-GRU model (21) and TCN model (22) are trained by repeating the process (160) of comparing the output sequence (150) with the actual sequence (110-3).

[0095] Here, the sequence (110-1) extracted from the executable file (101) is the third behavior size (e.g., the capacity of the behavior information code executed for 120 seconds), and the input sequence (110-2) is the second behavior size (e.g., the capacity of the behavior information code executed for 30 seconds). The actual sequence (110-3) and the output sequence (150) have the same behavior size as the first behavior size (e.g., the capacity of the behavior information code executed for 90 seconds).

[0096] The disclosed ransomware prediction method trains each of the first Bi-GRU model (21-1), the second Bi-GRU model (21-2), and the TCN model (22) to output an output sequence of a first behavior size from an input sequence of a second behavior size. By doing so, the disclosed ransomware prediction method effectively improves the accuracy of long-term behavior prediction of ransomware.

[0097] FIG. 7 is a diagram for further explaining the API call prediction step described in FIG. 3 in more detail.

[0098] As described above in FIGS. 3 and 4, the API call prediction step (140) combines a static feature tensor (131-1) and a dynamic feature tensor (132-1), and inputs the combined feature tensor (141-1) into a pre-trained TCN model (22) to extract an API call sequence vector (142-2) having a preset first behavior size.

[0099] Referring to FIG. 7, the TCN model (22) of the disclosed ransomware prediction method is composed of a plurality of temporal blocks (142-1) consisting of layer combinations (142-11) and residual connections (142-12) that are repeated at least twice. Specifically, the layer combinations consist of a Dilated Casal Convolution layer, a ReLU layer, and a Dropout layer. Here, the Dropout layer is a hyperparameter that randomly removes some cells within a layer during model training to prevent the values ​​of those cells from being passed to the next layer, thereby preventing overfitting to specific cells.

[0100] The combined feature tensor (141-1) is input to the layer combination (142-11) and residual connection (142-12) of the time series block (142-1), respectively. When the data input to the layer combination (142-11) passes through the Dilated Causal Convolution layer, the ReLU layer, and the Dropout layer to obtain output data, the input data that was input to the residual connection (142-12) is added to the output data to output final data. The final data is passed to the next time series block and is input to the layer combination (142-11) and residual connection (142-12), respectively, in the same way as the combined feature tensor (141-1). That is, the TCN model of the disclosed ransomware prediction method extracts sequential features of a fixed length through the time series block (142-1), which consists of the layer combination (142-11) and the residual connection (142-12). The TCN model (22) outputs an API call sequence vector with a first action size by increasing the length of the combined feature tensor (141-1) while maintaining the dimension of the vector through the time series block (142-1) and the residual connection (142-12).

[0101] The ransomware prediction method disclosed through this utilizes a Bi-GRU model that considers bidirectional behavioral information and a TCN model optimized for processing long-term time-series data to learn various ransomware behaviors, thereby predicting long-term behavior relatively accurately through short-term behavioral analysis and effectively preventing damage caused by ransomware in advance.

[0102] Those skilled in the art to which the present invention pertains should understand that the embodiments described above are illustrative in all respects and not restrictive, as the present invention may be implemented in other specific forms without altering its technical concept or essential features. The scope of the present invention is defined by the claims set forth below rather than by the detailed description above, and all modifications or variations derived from the meaning and scope of the claims and equivalent concepts thereof should be interpreted as being included within the scope of the present invention. Explanation of the symbols

[0103] 10: Ransomware Prediction Device 11: Input section 12: Communications Department 13: Storage section 14: Output section 21: Bi-GRU Model 22: TCN Model 20: Processor

Claims

Claim 1 A hybrid analysis step for extracting an OPcode sequence and an API call sequence based on an executable file received from an external source; a data vectorization step for generating a first embedding vector from the extracted OPcode sequence based on the FastText technique and generating a second embedding vector from the extracted API call sequence based on the FastText technique; and a pattern extraction step for generating a static feature tensor from a pre-trained first Bi-GRU (Bidirectional-Gated Recurrent Unit) model by inputting the first embedding vector and generating a dynamic feature tensor from a pre-trained second Bi-GRU model by inputting the second embedding vector. A ransomware prediction method comprising: an API call prediction step of combining the static feature tensor and the dynamic feature tensor and inputting the combined feature tensor to extract an API call sequence vector having a preset first behavior size from a pre-trained Temporal Convolution Network (TCN) model; and further comprising a step of supervising the first Bi-GRU model, the second Bi-GRU model, and the TCN model based on an input sequence of a preset second behavior size and a ground truth sequence of the preset first behavior size, wherein the preset second behavior size is shorter than the preset first behavior size. Claim 2 A ransomware prediction method according to claim 1, wherein the hybrid analysis step can extract the Opcode sequence and the API call sequence during a limited analysis time, and the data vectorization step generates a first embedding vector of a preset first size for characters included in the OPcode sequence and a second embedding vector of a preset second size for characters included in the API call sequence. Claim 3 A ransomware prediction method according to claim 1, wherein the pattern extraction step comprises the step of reducing the dimensionality of the first embedding vector based on a distilling technique and generating the static feature tensor considering various behavior features based on the bidirectional order of the first embedding vector with reduced dimensionality. Claim 4 A ransomware prediction method according to claim 1, wherein the pattern extraction step comprises the step of reducing the dimensionality of the second embedding vector based on a distilling technique and generating the dynamic feature tensor considering various behavioral features based on the bidirectional order of the dimensionally reduced second embedding vector. Claim 5 In claim 1, the API call prediction step is a ransomware prediction method that sequentially concatenates the static feature tensor and the dynamic feature tensor. Claim 6 A ransomware prediction method according to claim 1, wherein the TCN model is composed of a plurality of temporal blocks consisting of layer combinations and residual connections that are repeated at least twice, and the layer combinations consist of a Dilated causal convolution layer, a ReLU layer, and a Dropout layer. Claim 7 In claim 1, the hybrid analysis step is a ransomware prediction method that extracts the OPcode sequence and the API call sequence to a preset third behavior size for supervised learning of the model. Claim 8 delete Claim 9 A storage unit that stores an executable file received from the outside, a pre-trained first and second Bi-GRU model, and a pre-trained TCN model; and a processor that predicts an API call sequence based on the executable file; wherein the processor extracts an OPcode sequence and an API call sequence based on the executable file, generates a first embedding vector from the extracted OPcode sequence based on the FastText technique, generates a second embedding vector from the extracted API call sequence based on the FastText technique, generates a static feature tensor from the pre-trained first Bi-GRU model by inputting the first embedding vector, generates a dynamic feature tensor from the pre-trained second Bi-GRU model by inputting the second embedding vector, combines the static feature tensor and the dynamic feature tensor, extracts an API call sequence vector having a preset first behavior size from the pre-trained TCN model by inputting the combined feature tensor, supervises the first Bi-GRU model, the second Bi-GRU model, and the TCN model based on an input sequence of a preset second behavior size and a measured sequence of the preset first behavior size, and the preset second behavior size is the A ransomware prediction device characterized by being shorter than a preset first behavior size. Claim 10 In claim 9, the processor is a ransomware prediction device that generates a first embedding vector of a preset first size for characters included in the OPcode sequence and a second embedding vector of a preset second size for characters included in the API call sequence. Claim 11 In claim 9, the processor is a ransomware prediction device that reduces the dimensionality of the first embedding vector based on a distilling technique and generates the static feature tensor considering various behavioral features based on the bidirectional order of the dimensionally reduced first embedding vector. Claim 12 In claim 9, the processor is a ransomware prediction device that reduces the dimensionality of the second embedding vector based on a distilling technique and generates the dynamic feature tensor considering various behavioral features based on the bidirectional order of the dimensionally reduced second embedding vector. Claim 13 In claim 9, the processor is a ransomware prediction device that sequentially combines the static feature tensor and the dynamic feature tensor. Claim 14 In claim 9, the TCN model is composed of a plurality of temporal blocks consisting of layer combinations and residual connections that are repeated at least twice, and the layer combination is composed of a Dilated Casal Convolution layer, a ReLU layer, and a Dropout layer, a ransomware prediction device. Claim 15 In claim 9, the processor is a ransomware prediction device that extracts the OPcode sequence and the API call sequence to a preset third behavior size for supervised learning of the model. Claim 16 delete Claim 17 A service system that transmits and receives data through a communication network; and a device connected to the service system, receiving an executable file from the communication network, and predicting an API call sequence of the executable file; wherein the device stores a pre-trained first and second Bi-GRU model and a pre-trained TCN model, extracts an OPcode sequence and an API call sequence based on the executable file, generates a first embedding vector from the extracted OPcode sequence based on the FastText technique, generates a second embedding vector from the extracted API call sequence based on the FastText technique, generates a static feature tensor from the pre-trained first Bi-GRU model by inputting the first embedding vector, generates a dynamic feature tensor from the pre-trained second Bi-GRU model by inputting the second embedding vector, combines the static feature tensor and the dynamic feature tensor, extracts an API call sequence vector having a pre-set first behavior size from the pre-trained TCN model by inputting the combined feature tensor, and includes an input sequence of a pre-set second behavior size and a pre-set first behavior size A ransomware prediction system characterized by supervising the first Bi-GRU model, the second Bi-GRU model, and the TCN model based on an actual sequence, wherein the preset second behavior size is shorter than the preset first behavior size.

Images