Internet of Things malicious code detection method based on behavior semantic fusion extraction

Abstract

The present invention discloses a method for detecting malicious code of the Internet of Things based on behavior semantic fusion extraction, comprising the following steps: using static analysis to disassemble benign and malicious codes in elf format, selecting the most suitable code segment, and extracting the operation code contained in the segment; cleaning sample data, and merging it into a corpus and a dictionary with word frequency, using the corpus to train the CBOW model of word2vec, using the MEOI-TFIDF algorithm and the MT-TextRank algorithm to extract keywords, and sending them into the trained word2vec model to generate word vectors; using the TextCNN network based on the attention mechanism to perform feature training and classification, and adjusting parameters and optimizing according to the results. The present invention can accurately identify the binary classification of Internet of Things software and improve the accuracy of sample classification.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an Internet of Things malicious code detection method based on behavior semantic fusion extraction. Background Art

[0002] With the development of information and communication technology, the Internet of Things system spawned by the digital economy has developed rapidly. In recent years, the number of Internet of Things devices has grown exponentially. According to statistics from the analysis company Gartner, the global Internet of Things will exceed 26 billion in 2020, and this number will reach 75 billion in five years. Its applications will be spread across all walks of life, designing all aspects of production and life. Smart homes, smart cities, smart medical care, smart transportation, smart finance, etc. will benefit the public, and malicious attacks also exist between network devices all the time.

[0003] Malicious code classification and identification has always been an important research topic in the Internet industry. However, with the improvement of malicious code identification technology, malicious programs developed by network attackers tend to be complex and secretive. In order to evade the review of security protection tools, malicious codes usually undergo deformation and obfuscation to continuously form new variants. Classic malicious code detection methods such as signature scanning, searching for broad-spectrum features, and detection technologies based on reverse engineering disassembly and heuristic scanning are no longer able to cope with the huge challenges of current malicious codes in terms of performance and efficiency.

[0004] In 2015, Kaggle launched a competition for malicious code classification. In the following years, most of the malicious code classification in China was based on the compiled and processed data released by the platform. The methods were similar, converting binary data into grayscale images, or directly processing opcode sequences using n-grams and extracting features using word frequency. There was no significant breakthrough in detection accuracy. However, malicious codes in the Internet of Things emerge in an endless stream in various forms, and malicious code detection in ELF format is even rarer. Through static analysis of ELF format samples, full use of sample information, extraction of the most representative opcodes in the samples, exclusion of redundant opcodes, and consideration of the correlation between opcodes, combined with deep learning, the timeliness and accuracy of malicious code detection are crucial. Summary of the invention

[0005] The purpose of the present invention is to provide an Internet of Things malicious code detection method based on behavioral semantic fusion extraction, to make up for the shortcomings of feature extraction in malicious application detection, to eliminate unnecessary redundant codes, and to fuse the correlation between words to obtain keywords, as well as the efficiency problem of deep learning.

[0006] The technical solution to achieve the purpose of the present invention is: a method for detecting malicious code in the Internet of Things based on behavioral semantic fusion extraction, comprising:

[0007] Disassemble malicious software and benign software in elf format;

[0008] Extract keywords contained in the code segment in the assembly code;

[0009] The keyword samples are converted into matrices and convolutional neural networks are used for feature training and classification.

[0010] Compared with the prior art, the present invention has the following significant advantages: (1) The present invention comprehensively considers the importance of the operation code to a single sample and a sample set to extract keywords; (2) The convolutional neural network designed according to the extracted feature matrix in the present invention has very little computational complexity, and the training process can be implemented using GPU parallel computing, thereby improving computational efficiency; (3) Compared with the current mainstream methods, the present invention has higher accuracy and faster detection efficiency in detecting malicious code in the Internet of Things. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 This is a flow chart of the IoT malicious code detection method based on behavioral semantic fusion extraction.

[0012] Figure 2 It is a flowchart of keyword extraction based on behavioral semantic fusion.

[0013] Figure 3 It is a flowchart of the MT-TextRank algorithm.

[0014] Figure 4 It is the flowchart of feature vectorization. DETAILED DESCRIPTION

[0015] like Figure 1 As shown, a method for detecting malicious code in the Internet of Things based on behavior semantic fusion extraction of the present invention comprises the following steps:

[0016] Disassemble malicious software and benign software in elf format;

[0017] Extract keywords contained in the code segment in the assembly code;

[0018] The keyword samples are converted into matrices, and convolutional neural networks are used for feature training and classification, which can ultimately accurately identify malicious IoT applications.

[0019] Furthermore, the malicious code software and benign software in elf format are malicious samples crawled from the VirusTotal hreatIntelligence website and benign samples extracted from various official IoT applications.

[0020] Furthermore, keywords contained in the code segment in the assembly code are extracted, including:

[0021] Extract code segments from the disassembled sample;

[0022] Extract all opcodes contained in the code segment;

[0023] Clean the opcode samples and delete all punctuation marks and undefined.

[0024] For the cleaned samples, the behavior semantic fusion extraction method is used to extract keywords. The specific steps of using the behavior semantic fusion extraction method to extract keywords are as follows:

[0025] Keyword extraction based on the MEOI-TFIDF algorithm, that is, combining TF-IDF with average information entropy to calculate the weight of the operation code in a single sample, the formula is: in For the characteristic item c, n c is the word frequency in a single sample, S c is the frequency of words in the same category of samples, N is the total number of samples, N c is the number of samples containing feature item c, f ck Represents the frequency of word c appearing in document k; sort the weights W in reverse order to obtain the most important M operation codes as the keywords of a single sample.

[0026] Keyword extraction based on MT-TextRank algorithm, the formula is: Where W is the weight of the opcode calculated above, In(V i ) indicates the operation code V i The set of all incoming links, that is, the set pointing to V i The vertex set, Out(V j ) indicates the operation code V j The out-degree point set, namely V j The vertex set pointed to, d refers to the damping coefficient, which is 0.85, w ji Refers to the operation code V i and V j The edge weight between them indicates the relationship between the two opcodes. i ) are sorted in reverse order to obtain the most important N operation codes as the keywords of a single sample.

[0027] The cleaned data samples are constructed into a custom corpus to train the word2vec CBOW model. The M keywords and N keywords are merged into the features of a sample and converted into a K*(M+N)-dimensional word vector through the trained word2vec model, where K is the word vector dimension and M+N is the number of features.

[0028] Design a classification model based on TextCNN according to the feature parameters, including the input dimension of the convolutional neural network, the size of the convolution kernel, the number of convolution kernels, the size of the pooling layer, the number of pooling layers, the size of the fully connected layer, the number of fully connected layers, and the dimension of the output layer. The feature parameters include the length M+N of each sample feature, the number of samples to be classified, and the feature dimension.

[0029] The word vector is fed into the classification model to train and verify the accuracy of the classification model.

[0030] The present invention also provides an Internet of Things malicious code detection system based on behavior semantic fusion extraction, including a sample collection module, a feature extraction module, a feature vectorization module, and a classification module;

[0031] The sample collection module is used to collect data to verify whether the method of the present invention is feasible, mainly including benign code and malicious code;

[0032] The feature extraction module includes disassembling the elf format samples to obtain assembly code, cleaning the data, deleting meaningless words and punctuation marks to obtain operation code samples, obtaining an operation code corpus and a dictionary sorted by word frequency based on the above samples, and obtaining the keywords contained in the samples based on the MEOI-TFIDF algorithm and the MT-TextRank algorithm;

[0033] The feature vectorization module includes applying the corpus composed of the above samples to train the word2vec CBOW model, and sending the sample keywords into the model to obtain a feature matrix;

[0034] The classification module refers to designing the convolutional neural network structure according to the characteristics of feature parameters, performing feature training and classification.

[0035] The present invention is further described in detail below in conjunction with the accompanying drawings and specific implementations.

[0036] Example

[0037] like Figure 1 As shown, a method for detecting malicious code in the Internet of Things based on behavior semantic fusion extraction includes:

[0038] Crawl samples and disassemble ELF format samples to obtain assembly code;

[0039] Clean the data, remove meaningless words and punctuation marks to obtain operation code samples;

[0040] Based on the above samples, we obtain an opcode corpus and a dictionary sorted by word frequency;

[0041] Obtain sample keywords based on the MEOI-TFIDF algorithm and the MT-TextRank algorithm;

[0042] The corpus composed of the above samples is used to train the word2vec CBOW model, and each sample keyword is sent into the model to obtain a feature matrix;

[0043] Design the convolutional neural network structure according to the characteristics of the feature matrix, and perform feature training and classification.

[0044] like Figure 2 The figure shows the feature extraction process of the behavior semantic fusion extraction of the ELF file. First, use the objdump related command to disassemble the ELF file, statically analyze the disassembled file, extract the paragraphs belonging to the code segment in the file, and extract all the opcodes of the paragraph to form an opcode sample. Perform data cleaning on the sample and delete all the characters, punctuation, and meaningless strings in the data. Secondly, count the opcode word frequency of the sample, and use the sample to generate a corpus to train the word2vec CBOW model. At the same time, according to the MEOI-TFIDF algorithm, the formula is: Calculate the word weight, where n c Indicates the number of times word c appears in a single sample, S c represents the total number of occurrences of all sample words c, N represents the total number of samples, N c Represents the number of samples containing word c, and through the formula: Calculate the word weight, f ck Indicates the frequency of word c in document k, sort W1*W2 to get TopM as the keyword output; according to the MI-TextRank algorithm, the specific calculation process is as follows Figure 3 As shown, the formula is: Calculate the weight of each word and sort them, select TopN as the keyword output, where W is the weight of the operation code calculated above, In(V i ) indicates the operation code V i The set of all incoming links, that is, the set pointing to V i The vertex set, Out(V j ) indicates the operation code V j The out-degree point set, namely V j The vertex set pointed to, d refers to the damping coefficient, which is 0.85, w ji Refers to the operation code V i and Vj The edge weight between them represents the relationship between the two operation codes; M+N is the keyword of the extracted sample.

[0045] like Figure 4 As shown in the figure, this is the process of feature conversion vectorization. First, the corpus generated by the original opcode fusion is used to train the Word2vec CBOW model. The ultimate goal of the training is to output the expected word vector w(t) when inputting w(tn), w(t-n+1), w(t+1), ..., w(t+n-1), w(t+n), so as to obtain the word vector of each opcode appearing in the sample; secondly, Figure 2 The fixed number and fixed order of word sequence samples consisting of the keywords generated in the , the corresponding word vectors calculated on the text are combined into a matrix, and then the samples are shuffled, the ratio of the test set to the training set is 2:8, the convolutional neural network is trained and the results are verified.

Claims

1. A method for detecting malicious code in the Internet of Things based on behavioral semantic fusion extraction, characterized in that: include: Disassembling malicious code software and benign software in elf format, wherein the malicious code software and benign software in elf format are malicious samples crawled from the VirusTotal HReat Intelligence website and benign samples extracted from IoT applications; Extract the keywords contained in the code segment in the assembly code. The specific steps are as follows: Extract code segments from the disassembled sample; Extract all opcodes contained in the code segment; Clean the opcode samples and delete all punctuation marks and undefined. For the cleaned samples, a behavior semantic fusion extraction method is used to extract keywords. The behavior semantic fusion extraction method includes the following steps: Keyword extraction based on the MEOI-TFIDF algorithm, that is, combining TF-IDF with average information entropy to calculate the weight of the operation code in a single sample, the formula is: in For the characteristic item c, n c is the word frequency in a single sample, S c is the frequency of words in the same category of samples, N is the total number of samples, N c is the number of samples containing feature item c, f ck Indicates the frequency of word c appearing in document k; sort the weights W in reverse order to obtain the most important M operation codes as the keywords of a single sample; Keyword extraction based on MT-TextRank algorithm, the formula is: Where W is the weight of the opcode, In(V i ) indicates the operation code V i The set of all incoming links, Out(V j ) indicates the operation code V j The out-degree point set, d is the damping coefficient, w ji Refers to the operation code V i and V j The edge weight between them indicates the relationship between the two opcodes; for the weight W(V i ) are sorted in reverse order to obtain the most important N operation codes as keywords for a single sample; The cleaned data samples are constructed into a custom corpus to train the word2vec CBOW model; M keywords and N keywords are merged into the features of a sample, and converted into K*(M+N)-dimensional word vectors through the trained word2vec model, where K is the word vector dimension and M+N is the number of features; Design a classification model based on TextCNN according to the feature parameters. The model includes the input dimension of the convolutional neural network, the size of the convolution kernel, the number of convolution kernels, the size of the pooling layer, the number of pooling layers, the size of the fully connected layer, the number of fully connected layers, and the dimension of the output layer. The feature parameters include the length of each sample feature, the number of sample categories to be classified, and the feature dimension. The word vector is fed into the classification model to train and verify the accuracy of the classification model.

Images