Malicious process detection method, device, system and computer-readable storage medium

Abstract

The embodiment of the present invention discloses a malicious process detection method, including: obtaining multiple DLL loading logs and process names, add-on names, add-on signatures and malicious process identification fields in each DLL loading log, and storing them in a two-dimensional matrix form to obtain a first two-dimensional matrix; in the first two-dimensional matrix, numbering the add-on names according to the system's own DLL list, and numbering the add-on signatures according to the add-on signature type to obtain a sample two-dimensional matrix; using the process name in the sample two-dimensional matrix as a row index, and the numbered add-on name, the numbered add-on signature, and the malicious process identification field as a column index, inputting them into a logistic regression model and a decision tree model to obtain a malicious process detection model; inputting the process to be detected into the malicious process detection model to determine whether the process to be detected is a malicious process. Rapid and accurate identification of malicious processes is achieved.

Description

Technical Field

[0001] The present invention relates to the field of malicious process detection, and in particular to a malicious process detection method, device, system and computer-readable storage medium. Background Art

[0002] In Windows systems, there is a file called Dynamic Link Library (DLL), which has the file suffix dll. DLL files contain codes and data that can be used by multiple programs. Each program will load many DLL files when running. Therefore, the DLL files loaded by a process reflect the function of the process to a certain extent. By analyzing the DLL loading records, the process attributes can be analyzed.

[0003] There is a logging function in the Windows system. After installing Sysmon, an official Microsoft software, it can detect the behavior of processes loading DLLs and other executable files, which provides us with a source of data.

[0004] The amount of DLL loading logs is very large. A process can generate dozens of logs in a short period of time. It is difficult to analyze them manually, and it is also difficult to match them using inherent rules to identify malicious processes among these processes.

[0005] There is currently no effective solution to the problem that it is difficult to detect malicious processes in existing technologies. Summary of the invention

[0006] To solve the above problems, the present invention provides a malicious process detection method, device, system and computer-readable storage medium, which collect process names, add-in names, add-in signatures and malicious process identification fields in DLL loading logs, and number the add-in names and add-in signatures according to the system's built-in DLL list and add-in signature types, thereby obtaining a two-dimensional matrix that can represent each process, and inputting the two-dimensional matrix into a logistic regression model and a decision tree model to obtain a malicious process detection model, and using the model to detect each process to solve the problem that malicious processes are difficult to detect quickly and accurately.

[0007] To achieve the above-mentioned purpose, the present invention provides a malicious process detection method, comprising: obtaining multiple DLL loading logs and the process name, add-in name, add-in signature and malicious process identification field in each DLL loading log, and storing them in the form of a two-dimensional matrix to obtain a first two-dimensional matrix; in the first two-dimensional matrix, numbering the add-in name according to the system's built-in DLL list, and numbering the add-in signature according to the add-in signature type to obtain a sample two-dimensional matrix; using the process name in the sample two-dimensional matrix as a row index, and the numbered add-in name, the numbered add-in signature, and the malicious process identification field as a column index, inputting them into a logistic regression model and a decision tree model to obtain a malicious process detection model; inputting the process to be detected into the malicious process detection model to determine whether the process to be detected is a malicious process.

[0008] Further optionally, in the first two-dimensional matrix, the add-on names are numbered according to the system's built-in DLL list, and the add-on signatures are numbered according to the add-on signature type to obtain a sample two-dimensional matrix, including: in the first two-dimensional matrix, after numbering the add-on names according to the system's built-in DLL list, the numbered add-on names are one-hot encoded, and the add-on signatures are deleted to obtain a second two-dimensional matrix; in the second two-dimensional matrix, the DLL loading logs of the same process name are merged to obtain a third two-dimensional matrix; in the first two-dimensional matrix, after numbering the add-on signatures according to the add-on signature type, the add-on names are deleted to obtain a fourth two-dimensional matrix; in the fourth two-dimensional matrix, the DLL loading logs of the same process name are merged to obtain a fifth two-dimensional matrix; the third two-dimensional matrix is ​​data-connected with the fifth two-dimensional matrix to obtain the sample two-dimensional matrix.

[0009] Further optionally, in the fourth two-dimensional matrix, the DLL loading logs of the same process name are merged to obtain a fifth two-dimensional matrix including: when it is determined that the multiple add-in signature numbers corresponding to the current process name include the first priority add-in signature number, the multiple add-in signature numbers corresponding to the current process name are all set to the first priority add-in signature number; when it is determined that the multiple add-in signature numbers corresponding to the current process name do not include the first priority add-in signature number but include the second priority add-in signature number, the multiple add-in signature numbers corresponding to the current process name are all set to the second priority add-in number; when it is determined that the multiple add-in signature numbers corresponding to the current process name include neither the first priority add-in signature number nor the second priority add-in signature number, the multiple add-in signature numbers corresponding to the current process name are all set to the third priority add-in number.

[0010] Further optionally, the obtaining of multiple DLL loading logs and the process name, add-on name, add-on signature and malicious process identification field in each DLL loading log, and storing them in the form of a two-dimensional matrix, to obtain a first two-dimensional matrix includes: obtaining the multiple DLL loading logs, and respectively marking the DLL loading logs generated by malicious processes and normal processes to obtain a malicious process identification field; data-connecting the process name, add-on name, add-on signature in each collected DLL loading log with the corresponding malicious process identification field, and storing them in the form of a two-dimensional matrix, deleting completely duplicate DLL loading logs, to obtain the first two-dimensional matrix.

[0011] On the other hand, the present invention also provides a malicious process detection device, which includes: a first two-dimensional matrix generation module, which is used to obtain multiple DLL loading logs and the process name, add-on name, add-on signature and malicious process identification field in each DLL loading log, and store them in the form of a two-dimensional matrix to obtain a first two-dimensional matrix; a sample two-dimensional matrix generation module, which is used to number the add-on name according to the system's built-in DLL list in the first two-dimensional matrix, and to number the add-on signature according to the add-on signature type to obtain a sample two-dimensional matrix; a malicious process detection model generation module, which is used to use the process name in the sample two-dimensional matrix as a row index, and the numbered add-on name, the numbered add-on signature, and the malicious process identification field as a column index, and input them into a logistic regression model and a decision tree model to obtain a malicious process detection model; a malicious process judgment module, which is used to input the process to be detected into the malicious process detection model to determine whether the process to be detected is a malicious process.

[0012] Further optionally, the sample two-dimensional matrix generation module includes: a second two-dimensional matrix generation submodule, which is used to number the add-in names according to the system's built-in DLL list in the first two-dimensional matrix, perform one-hot encoding on the numbered add-in names, and delete the add-in signatures to obtain a second two-dimensional matrix; a third two-dimensional matrix generation submodule, which is used to merge the DLL loading logs of the same process name in the second two-dimensional matrix to obtain a third two-dimensional matrix; a fourth two-dimensional matrix generation submodule, which is used to number the add-in signatures according to the add-in signature type in the first two-dimensional matrix, and then delete the add-in names to obtain a fourth two-dimensional matrix; a fifth two-dimensional matrix generation submodule, which is used to merge the DLL loading logs of the same process name in the fourth two-dimensional matrix to obtain a fifth two-dimensional matrix; and a data connection submodule, which is used to perform data connection between the third two-dimensional matrix and the fifth two-dimensional matrix to obtain the sample two-dimensional matrix.

[0013] Further optionally, the fifth two-dimensional matrix generation submodule includes: a first determination unit, which is used to set the multiple add-on signature numbers corresponding to the current process name to the first priority add-on signature number when it is determined that the multiple add-on signature numbers corresponding to the current process name include the first priority add-on signature number; a second determination unit, which is used to set the multiple add-on signature numbers corresponding to the current process name to the second priority add-on number when it is determined that the multiple add-on signature numbers corresponding to the current process name do not include the first priority add-on signature number but include the second priority add-on signature number; and a third determination unit, which is used to set the multiple add-on signature numbers corresponding to the current process name to the third priority add-on number when it is determined that the multiple add-on signature numbers corresponding to the current process name include neither the first priority add-on signature number nor the second priority add-on signature number.

[0014] Further optionally, the first two-dimensional matrix generation module includes: a malicious process field annotation submodule, used to obtain the multiple DLL loading logs, and respectively annotate the DLL loading logs generated by the malicious process and the normal process to obtain the malicious process identification field; a feature acquisition submodule, used to connect the process name, add-in name, add-in signature in each collected DLL loading log with the corresponding malicious process identification field, and store them in the form of a two-dimensional matrix, delete completely duplicate DLL loading logs, and obtain the first two-dimensional matrix.

[0015] On the other hand, the present invention further provides a malicious process detection system, comprising the malicious process detection device mentioned above.

[0016] On the other hand, the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein the program implements the above-mentioned malicious process detection method when executed by a processor.

[0017] The above technical scheme has the following beneficial effects: the present invention extracts the loading log when a process loads DLL as the basis for data analysis, and the DLL file can reflect the properties of the process to a certain extent, thereby making it easier to determine the malicious process; the add-in name is associated with the system's built-in DLL list, and the add-in signature is associated with the add-in signature type, giving the add-in name and add-in signature meaning to determine whether the process is a malicious process, thereby making the detection of malicious processes more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 is a flow chart of a malicious process detection method provided by an embodiment of the present invention;

[0020] Figure 2 is a flow chart of a sample two-dimensional matrix generation method provided by an embodiment of the present invention;

[0021] Figure 3 is a flow chart of a fifth two-dimensional matrix generation method provided by an embodiment of the present invention;

[0022] Figure 4 is a flow chart of a first two-dimensional matrix generation method provided by an embodiment of the present invention;

[0023] Figure 5 is a schematic diagram of the structure of a malicious process detection device provided by an embodiment of the present invention;

[0024] Figure 6 is a schematic diagram of the structure of a sample two-dimensional matrix generation module provided by an embodiment of the present invention;

[0025] Figure 7 is a schematic structural diagram of a fifth two-dimensional matrix generating submodule provided in an embodiment of the present invention;

[0026] Figure 8 It is a structural schematic diagram of a first two-dimensional matrix generation module provided in an embodiment of the present invention.

[0027] Attached Figures: 100 - first two-dimensional matrix generation module 1001 - malicious process field labeling submodule 1002 - feature acquisition submodule 200 - sample two-dimensional matrix generation module 300 - malicious process detection model generation module 400 - malicious process judgment module 2001 - second two-dimensional matrix generation submodule 2002 - third two-dimensional matrix generation submodule 2003 - fourth two-dimensional matrix generation submodule 2004 - fifth two-dimensional matrix generation submodule 20041 - first judgment unit 20042 - second judgment unit 20043 - third judgment unit 2005 - data connection submodule DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] In order to solve the above-mentioned problem that it is difficult to detect malicious processes and the accuracy is not high, an embodiment of the present invention provides a malicious process detection method. Figure 1 is a flow chart of a malicious process detection method provided by an embodiment of the present invention, such as Figure 1 As shown, including:

[0030] S101, obtaining multiple DLL loading logs and the process name, add-in name, add-in signature, and malicious process identification field in each DLL loading log, and storing them in a two-dimensional matrix form to obtain a first two-dimensional matrix;

[0031] DLL loading log refers to the loading log of a DLL file or other executable file by a process. Sysmon, an official Microsoft software, can be used to collect these DLL loading logs. The DLL loading log contains fields such as time, process ID, and process name. Extract the process name, add-on name, and add-on signature of each DLL loading log, and obtain the malicious process identification field of each DLL loading log as the subsequent feature value. After collecting these data, convert the data into json format and store it in a two-dimensional matrix format for subsequent data processing.

[0032] S102, in the first two-dimensional matrix, number the add-in names according to the system's built-in DLL list, and number the add-in signatures according to the add-in signature types to obtain a sample two-dimensional matrix;

[0033] Before numbering the add-in names, collect the DLL files under the Windows system and generate corresponding serial numbers as the system built-in DLL list. Use the system built-in DLL list to number the add-in names in the first two-dimensional matrix. If the add-in name exists in the system built-in DLL list, use the corresponding serial number in the system built-in DLL list as the number of the add-in name; if the add-in name does not exist in the system built-in DLL list, mark the add-in name with 0, indicating that it is a non-system DLL.

[0034] When numbering add-on signatures, add-on signatures issued by Microsoft such as Microsoft Windows or Microsoft Corporation are marked as 2, add-on signatures issued by third parties are marked as 1, and empty signatures are marked as 0.

[0035] In the first two-dimensional matrix, replace the add-in name column with the numbered add-in name, and replace the add-in signature column with the numbered add-in signature to obtain a sample two-dimensional matrix.

[0036] S103. Use the process name in the sample two-dimensional matrix as the row index, the numbered add-on name, the numbered add-on signature, and the malicious process identification field as the column index, and input them into the logistic regression model and the decision tree model to obtain a malicious process detection model.

[0037] In the sample two-dimensional matrix, the row index is the process name, and the column index is the numbered add-on name, the numbered add-on name, and the malicious process identification field. This data is the final standardized data set for machine learning model training. The logistic regression model and decision tree model in the open source machine learning library scikit-learn are called. The logistic regression model uses the coordinate descent method to iteratively optimize the loss function and the L1 regularization method; the decision tree model uses the Gini coefficient as the impurity calculation method. This is because the data generated by the data processing part has the characteristics of high dimension, sparse features, and many 0 values, and the above parameters are more applicable.

[0038] The sample two-dimensional matrix is ​​divided into a training set and a test set in a ratio of 6:4. Both the training set and the test set use the add-on name number and the add-on signature number as features, and whether it is a malicious process as a label. At the beginning, the training set is input into the logistic regression model and the decision tree model for training, and saved in sav format after the training is completed; the test set is used to test the recognition accuracy of the detection model trained using the training set, and the parameters of the detection model are corrected according to the accuracy of the detection results to obtain the final malicious process detection model, which can be used to detect whether the process is malicious.

[0039] S104: Input the process to be detected into a malicious process detection model to determine whether the process to be detected is a malicious process.

[0040] The malicious process detection model is used to detect whether the process to be detected is malicious. During the detection, the malicious process detection model determines whether the process to be detected is malicious by identifying the add-on signature and add-on name in the process to be detected, so as to achieve fast and accurate judgment of the malicious process.

[0041] As an optional implementation, Figure 2 is a flow chart of a sample two-dimensional matrix generation method provided by an embodiment of the present invention. Figure 2 As shown, in the first two-dimensional matrix, the add-in names are numbered according to the system's built-in DLL list, and the add-in signatures are numbered according to the add-in signature type to obtain a sample two-dimensional matrix, including:

[0042] S1021. In the first two-dimensional matrix, after numbering the add-in names according to the system's built-in DLL list, one-hot encoding is performed on the numbered add-in names, and the add-in signatures are deleted to obtain a second two-dimensional matrix;

[0043] In the first two-dimensional matrix, the process name is used as the index to perform one-hot encoding on the variable of the add-on name, so as to standardize the geometric distance between the values ​​of the variable of the add-on name. One-hot encoding is also called one-bit effective encoding, which uses an N-bit register to encode N states. The nth state corresponds to the nth register taking 1, and the rest taking 0. The variable of the add-on name is replaced by the encoded add-on name, and the variable of the add-on signature is deleted to obtain a new two-dimensional matrix, namely the second two-dimensional matrix. In the second two-dimensional matrix, the row index is the process name of each DLL loading behavior, and the column index is the total DLL number and number 0 (non-system DLL) in the system's built-in DLL list. When the value of a row or column is 1, it means that the process has loaded the DLL.

[0044] S1022. In the second two-dimensional matrix, merge the DLL loading logs with the same process name to obtain a third two-dimensional matrix;

[0045] In order to achieve the purpose of using a single process as the detection subject, it is necessary to merge the DLL loading logs with the same process name. When merging, the DLL loading logs with the same process name in the second two-dimensional matrix are merged, and the add-in names are summed. Since the malicious process identification field is determined according to the process, the malicious identification fields of the same process name are the same and can be directly merged to obtain a new two-dimensional matrix, namely the third two-dimensional matrix.

[0046] S1023. In the first two-dimensional matrix, after numbering the add-in signatures according to the add-in signature types, delete the add-in names to obtain a fourth two-dimensional matrix;

[0047] Using the first two-dimensional matrix as the basis for data processing, the add-in signatures are numbered, and the add-in signature variable is replaced with the numbered add-in signature. At the same time, the add-in name variable is deleted to obtain a new two-dimensional matrix, namely the fourth two-dimensional matrix.

[0048] S1024. In the fourth two-dimensional matrix, merging the DLL loading logs with the same process name to obtain a fifth two-dimensional matrix;

[0049] In order to achieve the purpose of using a single process as the detection subject, it is necessary to merge the DLL loading logs of the same process name. When merging, the DLL loading logs of the same process name in the fourth two-dimensional matrix are merged, and the add-on signature items are normalized. Since the malicious process identification field is determined according to the process, the malicious identification fields of the same process name are the same and can be directly merged to obtain a new two-dimensional matrix, namely the fifth two-dimensional matrix.

[0050] S1025. Perform data connection on the third two-dimensional matrix and the fifth two-dimensional matrix to obtain a sample two-dimensional matrix.

[0051] Taking the process name as the basis for merging, the add-on name number and add-on signature number corresponding to the same process name are data-connected to obtain a new two-dimensional matrix including the process name, add-on name number, add-on signature number and malicious process field, namely the sample two-dimensional matrix.

[0052] As an optional implementation, Figure 3 is a flow chart of a fifth two-dimensional matrix generation method provided by an embodiment of the present invention. Figure 3 As shown, S1024, in the fourth two-dimensional matrix, the DLL loading logs of the same process name are merged to obtain a fifth two-dimensional matrix including:

[0053] S10241. When it is determined that the multiple add-in signature numbers corresponding to the current process name include the first priority add-in signature number, all the multiple add-in signature numbers corresponding to the current process name are set as the first priority add-in signature number;

[0054] S10242: When it is determined that the multiple add-in signature numbers corresponding to the current process name do not include the first priority add-in signature number but include the second priority add-in signature number, all the multiple add-in signature numbers corresponding to the current process name are set as the second priority add-in signature numbers;

[0055] S10243. When it is determined that the multiple add-in signature numbers corresponding to the current process name contain neither the first priority add-in signature number nor the second priority add-in signature number, the multiple add-in signature numbers corresponding to the current process name are all set to the third priority add-in numbers.

[0056] When normalizing the add-in signature numbers in the fifth two-dimensional matrix, three priorities are first set. The first priority is the add-in signature without a signature, that is, the add-in signature number numbered 0; the second priority is the add-in signature issued by a third party, that is, the add-in signature number numbered 1; the third priority is the add-in signature issued by Microsoft such as Microsoft Windows or Microsoft Corporation, that is, the add-in signature number numbered 2.

[0057] When merging data for multiple add-in signature numbers corresponding to the same process name, first determine whether there is an add-in signature number numbered 0 among the multiple add-in signature numbers. If so, the multiple add-in signature numbers are unified as 0; if there is no add-in signature number numbered 0, but there is an add-in signature number numbered 1, the multiple add-in signature numbers are unified as 1; if both the add-in signature numbers numbered 0 and 1 do not exist, the multiple add-in signature numbers are unified as 2, so as to achieve data merging of multiple add-in signature numbers corresponding to the same process name.

[0058] These add-on signature numbers are determined based on the add-on signature type, that is, the signature issuer. Different signature issuers have different probabilities of corresponding processes being malicious processes. For example, the possibility of a process corresponding to a signature issued by Microsoft being a malicious process is lower than the possibility of a process corresponding to a signature issued by a third party being a malicious process, and the possibility of a process corresponding to a signature issued by a third party being a malicious process is lower than the possibility of a process corresponding to no signature being a malicious process. Therefore, this is of certain significance in determining whether a process is malicious or not.

[0059] As an optional implementation, Figure 4 is a flow chart of a first two-dimensional matrix generation method provided by an embodiment of the present invention. Figure 4 As shown, S101, multiple DLL loading logs and the process name, add-in name, add-in signature and malicious process identification field in each DLL loading log are obtained, and stored in the form of a two-dimensional matrix, and the first two-dimensional matrix is ​​obtained, including:

[0060] S1011, obtaining multiple DLL loading logs, and marking the DLL loading logs generated by the malicious process and the normal process respectively, to obtain a malicious process identification field;

[0061] S1012. Connect the process name, add-in name, add-in signature and corresponding malicious process identification field in each collected DLL loading log, store them in the form of a two-dimensional matrix, delete completely duplicated DLL loading logs, and obtain a first two-dimensional matrix.

[0062] In the data acquisition phase, after obtaining multiple DLL loading logs, each process in these logs is marked according to the process name to determine whether it is malicious. For example, 1 represents a malicious process, and 0 represents a non-malicious process. The identification of whether the process is malicious is written into the malicious process identification field to obtain the identification tag of the process for subsequent detection model generation.

[0063] When collecting data from the DLL loading log, nxlog can be used to collect the log, and the process name, add-in name, whether the add-in is signed, add-in signature, and add-in signature status fields are initially screened and stored in json format. Then the process name, add-in name, and add-in signature are extracted, and data is connected with the malicious process identification field, and the above data in json format is read and stored in a two-dimensional matrix. The data with completely repeated four features is deleted, that is, the completely repeated rows are deleted in the two-dimensional matrix to obtain the first two-dimensional matrix.

[0064] Figure 5 is a schematic diagram of the structure of a malicious process detection device provided by an embodiment of the present invention. Figure 5 As shown, an embodiment of the present invention provides a malicious process detection device, including:

[0065] The first two-dimensional matrix generation module 100 is used to obtain multiple DLL loading logs and the process name, add-in name, add-in signature and malicious process identification field in each DLL loading log, and store them in the form of a two-dimensional matrix to obtain a first two-dimensional matrix;

[0066] DLL loading log refers to the loading log of a DLL file or other executable file by a process. Sysmon, an official Microsoft software, can be used to collect these DLL loading logs. The DLL loading log contains fields such as time, process ID, and process name. Extract the process name, add-on name, and add-on signature of each DLL loading log, and obtain the malicious process identification field of each DLL loading log as the subsequent feature value. After collecting these data, convert the data into json format and store it in a two-dimensional matrix format for subsequent data processing.

[0067] The sample two-dimensional matrix generation module 200 is used to number the add-in names according to the system's own DLL list in the first two-dimensional matrix, and to number the add-in signatures according to the add-in signature types, to obtain a sample two-dimensional matrix;

[0068] Before numbering the add-in names, collect the DLL files under the Windows system and generate corresponding serial numbers as the system built-in DLL list. Use the system built-in DLL list to number the add-in names in the first two-dimensional matrix. If the add-in name exists in the system built-in DLL list, use the corresponding serial number in the system built-in DLL list as the number of the add-in name; if the add-in name does not exist in the system built-in DLL list, mark the add-in name with 0, indicating that it is a non-system DLL.

[0069] When numbering add-on signatures, add-on signatures issued by Microsoft such as Microsoft Windows or Microsoft Corporation are marked as 2, add-on signatures issued by third parties are marked as 1, and empty signatures are marked as 0.

[0070] In the first two-dimensional matrix, replace the add-in name column with the numbered add-in name, and replace the add-in signature column with the numbered add-in signature to obtain a sample two-dimensional matrix.

[0071] The malicious process detection model generation module 300 is used to use the process name in the sample two-dimensional matrix as the row index, the numbered add-on name, the numbered add-on signature, and the malicious process identification field as the column index, and input them into the logistic regression model and the decision tree model to obtain the malicious process detection model.

[0072] In the sample two-dimensional matrix, the row index is the process name, and the column index is the numbered add-on name, the numbered add-on name, and the malicious process identification field. This data is the final standardized data set for machine learning model training. The logistic regression model and decision tree model in the open source machine learning library scikit-learn are called. The logistic regression model uses the coordinate descent method to iteratively optimize the loss function and the L1 regularization method; the decision tree model uses the Gini coefficient as the impurity calculation method. This is because the data generated by the data processing part has the characteristics of high dimension, sparse features, and many 0 values, and the above parameters are more applicable.

[0073] The sample two-dimensional matrix is ​​divided into a training set and a test set in a ratio of 6:4. Both the training set and the test set use the add-on name number and the add-on signature number as features, and whether it is a malicious process as a label. At the beginning, the training set is input into the logistic regression model and the decision tree model for training, and saved in sav format after the training is completed; the test set is used to test the recognition accuracy of the detection model trained using the training set, and the parameters of the detection model are corrected according to the accuracy of the detection results to obtain the final malicious process detection model, which can be used to detect whether the process is malicious.

[0074] The malicious process determination module 400 is used to input the process to be detected into the malicious process detection model to determine whether the process to be detected is a malicious process.

[0075] The malicious process detection model is used to detect whether the process to be detected is malicious. During the detection, the malicious process detection model determines whether the process to be detected is malicious by identifying the add-on signature and add-on name in the process to be detected, so as to achieve fast and accurate judgment of the malicious process.

[0076] As an optional implementation, Figure 6 is a schematic diagram of the structure of a sample two-dimensional matrix generation module provided by an embodiment of the present invention. Figure 6 As shown, the sample two-dimensional matrix generation module 200 includes:

[0077] The second two-dimensional matrix generating submodule 2001 is used to number the add-in names in the first two-dimensional matrix according to the system's own DLL list, perform one-hot encoding on the numbered add-in names, and delete the add-in signatures to obtain a second two-dimensional matrix;

[0078] In the first two-dimensional matrix, the process name is used as the index to perform one-hot encoding on the variable of the add-on name, so as to standardize the geometric distance between the values ​​of the variable of the add-on name. One-hot encoding is also called one-bit effective encoding, which uses an N-bit register to encode N states. The nth state corresponds to the nth register taking 1, and the rest taking 0. The variable of the add-on name is replaced by the encoded add-on name, and the variable of the add-on signature is deleted to obtain a new two-dimensional matrix, namely the second two-dimensional matrix. In the second two-dimensional matrix, the row index is the process name of each DLL loading behavior, and the column index is the total DLL number and number 0 (non-system DLL) in the system's built-in DLL list. When the value of a row or column is 1, it means that the process has loaded the DLL.

[0079] The third two-dimensional matrix generating submodule 2002 is used to merge the DLL loading logs with the same process name in the second two-dimensional matrix to obtain a third two-dimensional matrix;

[0080] In order to achieve the purpose of using a single process as the detection subject, it is necessary to merge the DLL loading logs with the same process name. When merging, the DLL loading logs with the same process name in the second two-dimensional matrix are merged, and the add-in names are summed. Since the malicious process identification field is determined according to the process, the malicious identification fields of the same process name are the same and can be directly merged to obtain a new two-dimensional matrix, namely the third two-dimensional matrix.

[0081] The fourth two-dimensional matrix generating submodule 2003 is used to, in the first two-dimensional matrix, after numbering the add-in signatures according to the add-in signature types, delete the add-in names to obtain a fourth two-dimensional matrix;

[0082] Using the first two-dimensional matrix as the basis for data processing, the add-in signatures are numbered, and the add-in signature variable is replaced with the numbered add-in signature. At the same time, the add-in name variable is deleted to obtain a new two-dimensional matrix, namely the fourth two-dimensional matrix.

[0083] The fifth two-dimensional matrix generating submodule 2004 is used to merge the DLL loading logs with the same process name in the fourth two-dimensional matrix to obtain a fifth two-dimensional matrix;

[0084] In order to achieve the purpose of using a single process as the detection subject, it is necessary to merge the DLL loading logs of the same process name. When merging, the DLL loading logs of the same process name in the fourth two-dimensional matrix are merged, and the add-on signature items are normalized. Since the malicious process identification field is determined according to the process, the malicious identification fields of the same process name are the same and can be directly merged to obtain a new two-dimensional matrix, namely the fifth two-dimensional matrix.

[0085] The data connection submodule 2005 is used to perform data connection on the third two-dimensional matrix and the fifth two-dimensional matrix to obtain a sample two-dimensional matrix.

[0086] Taking the process name as the basis for merging, the add-on name number and add-on signature number corresponding to the same process name are data-connected to obtain a new two-dimensional matrix including the process name, add-on name number, add-on signature number and malicious process field, namely the sample two-dimensional matrix.

[0087] As an optional implementation, Figure 7 is a schematic diagram of the structure of a fifth two-dimensional matrix generating submodule provided in an embodiment of the present invention. Figure 7 As shown, the fifth two-dimensional matrix generation submodule 2004 includes:

[0088] The first determination unit 20041 is used to set all of the multiple add-in signature numbers corresponding to the current process name as the first priority add-in signature number when it is determined that the multiple add-in signature numbers corresponding to the current process name include the first priority add-in signature number;

[0089] The second determination unit 20042 is used to set all of the multiple add-in signature numbers corresponding to the current process name as the second priority add-in signature numbers when it is determined that the multiple add-in signature numbers corresponding to the current process name do not include the first priority add-in signature number but include the second priority add-in signature number;

[0090] The third determination unit 20043 is used to set all the multiple add-on signature numbers corresponding to the current process name as third priority add-on numbers when it is determined that the multiple add-on signature numbers corresponding to the current process name contain neither the first priority add-on signature number nor the second priority add-on signature number.

[0091] When normalizing the add-in signature numbers in the fifth two-dimensional matrix, three priorities are first set. The first priority is the add-in signature without a signature, that is, the add-in signature number numbered 0; the second priority is the add-in signature issued by a third party, that is, the add-in signature number numbered 1; the third priority is the add-in signature issued by Microsoft such as Microsoft Windows or Microsoft Corporation, that is, the add-in signature number numbered 2.

[0092] When merging data for multiple add-in signature numbers corresponding to the same process name, first determine whether there is an add-in signature number numbered 0 among the multiple add-in signature numbers. If so, the multiple add-in signature numbers are unified as 0; if there is no add-in signature number numbered 0, but there is an add-in signature number numbered 1, the multiple add-in signature numbers are unified as 1; if both the add-in signature numbers numbered 0 and 1 do not exist, the multiple add-in signature numbers are unified as 2, so as to achieve data merging of multiple add-in signature numbers corresponding to the same process name.

[0093] These add-on signature numbers are determined based on the add-on signature type, that is, the signature issuer. Different signature issuers have different probabilities of corresponding processes being malicious processes. For example, the possibility of a process corresponding to a signature issued by Microsoft being a malicious process is lower than the possibility of a process corresponding to a signature issued by a third party being a malicious process, and the possibility of a process corresponding to a signature issued by a third party being a malicious process is lower than the possibility of a process corresponding to no signature being a malicious process. Therefore, this is of certain significance in determining whether a process is malicious or not.

[0094] As an optional implementation, Figure 8 is a schematic diagram of the structure of a first two-dimensional matrix generation module provided in an embodiment of the present invention. Figure 8 As shown, the first two-dimensional matrix generation module 100 includes:

[0095] Malicious process field marking submodule 1001 is used to obtain multiple DLL loading logs, and mark the DLL loading logs generated by malicious processes and normal processes respectively to obtain malicious process identification fields;

[0096] The feature acquisition submodule 1002 is used to connect the process name, add-in name, add-in signature and the corresponding malicious process identification field in each collected DLL loading log, store them in the form of a two-dimensional matrix, delete completely repeated DLL loading logs, and obtain the first two-dimensional matrix.

[0097] In the data acquisition phase, after obtaining multiple DLL loading logs, each process in these logs is marked according to the process name to determine whether it is malicious. For example, 1 represents a malicious process, and 0 represents a non-malicious process. The identification of whether the process is malicious is written into the malicious process identification field to obtain the identification tag of the process for subsequent detection model generation.

[0098] When collecting data from the DLL loading log, nxlog can be used to collect the log, and the process name, add-in name, whether the add-in is signed, add-in signature, and add-in signature status fields are initially screened and stored in json format. Then the process name, add-in name, and add-in signature are extracted, and data is connected with the malicious process identification field, and the above data in json format is read and stored in a two-dimensional matrix. The data with completely repeated four features is deleted, that is, the completely repeated rows are deleted in the two-dimensional matrix to obtain the first two-dimensional matrix.

[0099] An embodiment of the present invention further provides a malicious process detection system, comprising the malicious process detection device mentioned above.

[0100] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the above-mentioned malicious process detection method is implemented.

[0101] The above-mentioned software is stored in the above-mentioned storage medium, which includes but is not limited to: a CD, a floppy disk, a hard disk, an erasable memory, etc.

[0102] The above technical scheme has the following beneficial effects: the present invention extracts the loading log when a process loads DLL as the basis for data analysis, and the DLL file can reflect the properties of the process to a certain extent, thereby making it easier to determine the malicious process; the add-in name is associated with the system's built-in DLL list, and the add-in signature is associated with the add-in signature type, giving the add-in name and add-in signature meaning to determine whether the process is a malicious process, thereby making the detection of malicious processes more accurate.

[0103] The above specific implementation methods further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A malicious process detection method, characterized in that: include: Obtain multiple DLL loading logs and the process name, add-in name, add-in signature, and malicious process identification field in each DLL loading log, and store them in a two-dimensional matrix form to obtain a first two-dimensional matrix; In the first two-dimensional matrix, add-in names are numbered according to the system's built-in DLL list, and add-in signatures are numbered according to the add-in signature type to obtain a sample two-dimensional matrix; The process name in the sample two-dimensional matrix is ​​used as a row index, and the numbered add-on name, the numbered add-on signature, and the malicious process identification field are used as column indexes, and input into a logistic regression model and a decision tree model to obtain a malicious process detection model; The process to be detected is input into the malicious process detection model to determine whether the process to be detected is a malicious process.

2. The malicious process detection method according to claim 1, characterized in that: In the first two-dimensional matrix, the add-in names are numbered according to the system's built-in DLL list, and the add-in signatures are numbered according to the add-in signature type to obtain a sample two-dimensional matrix, including: In the first two-dimensional matrix, after the add-in names are numbered according to the system's built-in DLL list, the numbered add-in names are one-hot encoded, and the add-in signatures are deleted to obtain a second two-dimensional matrix; In the second two-dimensional matrix, DLL loading logs with the same process name are merged to obtain a third two-dimensional matrix; In the first two-dimensional matrix, after the add-in signatures are numbered according to the add-in signature types, the add-in names are deleted to obtain a fourth two-dimensional matrix; In the fourth two-dimensional matrix, DLL loading logs with the same process name are merged to obtain a fifth two-dimensional matrix; The third two-dimensional matrix is ​​data-connected with the fifth two-dimensional matrix to obtain the sample two-dimensional matrix.

3. The malicious process detection method according to claim 2, characterized in that: In the fourth two-dimensional matrix, the DLL loading logs of the same process name are merged to obtain a fifth two-dimensional matrix including: When it is determined that the multiple add-in signature numbers corresponding to the current process name include the first priority add-in signature number, the multiple add-in signature numbers corresponding to the current process name are all set as the first priority add-in signature number; When it is determined that the multiple add-in signature numbers corresponding to the current process name do not include the first priority add-in signature number but include the second priority add-in signature number, all the multiple add-in signature numbers corresponding to the current process name are set as the second priority add-in signature numbers; When it is determined that the multiple add-in signature numbers corresponding to the current process name contain neither the first priority add-in signature number nor the second priority add-in signature number, the multiple add-in signature numbers corresponding to the current process name are all set to the third priority add-in signature number; Among them, the first priority add-on signature number is 0, representing no add-on signature; the second priority add-on signature number is 1, representing an add-on signature issued by a third party; the third priority add-on signature number is 2, representing an add-on signature issued by Microsoft.

4. The malicious process detection method according to claim 1, characterized in that: The method obtains multiple DLL loading logs and the process name, add-in name, add-in signature and malicious process identification field in each DLL loading log, and stores them in the form of a two-dimensional matrix, and obtains a first two-dimensional matrix including: Acquire the multiple DLL loading logs, and respectively mark the DLL loading logs generated by the malicious process and the normal process to obtain a malicious process identification field; The process name, add-in name, add-in signature in each collected DLL loading log are data-connected with the corresponding malicious process identification field, and stored in the form of a two-dimensional matrix. Completely duplicated DLL loading logs are deleted to obtain the first two-dimensional matrix.

5. A malicious process detection device, characterized in that: include: A first two-dimensional matrix generation module is used to obtain multiple DLL loading logs and the process name, add-in name, add-in signature and malicious process identification field in each DLL loading log, and store them in a two-dimensional matrix form to obtain a first two-dimensional matrix; A sample two-dimensional matrix generation module is used to number the add-in names in the first two-dimensional matrix according to the system's built-in DLL list, and to number the add-in signatures according to the add-in signature types to obtain a sample two-dimensional matrix; A malicious process detection model generation module is used to input the process name in the sample two-dimensional matrix as a row index, the numbered add-on name, the numbered add-on signature, and the malicious process identification field as a column index into a logistic regression model and a decision tree model to obtain a malicious process detection model; The malicious process determination module is used to input the process to be detected into the malicious process detection model to determine whether the process to be detected is a malicious process.

6. The malicious process detection device according to claim 5, characterized in that: The sample two-dimensional matrix generation module includes: A second two-dimensional matrix generating submodule is used for, in the first two-dimensional matrix, after numbering the add-in names according to the system's built-in DLL list, performing one-hot encoding on the numbered add-in names, and deleting the add-in signatures to obtain a second two-dimensional matrix; A third two-dimensional matrix generating submodule, used for merging DLL loading logs with the same process name in the second two-dimensional matrix to obtain a third two-dimensional matrix; A fourth two-dimensional matrix generating submodule, configured to, in the first two-dimensional matrix, after numbering the add-in signatures according to the add-in signature types, delete the add-in names to obtain a fourth two-dimensional matrix; a fifth two-dimensional matrix generating submodule, configured to merge DLL loading logs of the same process name in the fourth two-dimensional matrix to obtain a fifth two-dimensional matrix; The data connection submodule is used to perform data connection on the third two-dimensional matrix and the fifth two-dimensional matrix to obtain the sample two-dimensional matrix.

7. The malicious process detection device according to claim 6, characterized in that: The fifth two-dimensional matrix generation submodule comprises: A first determination unit is used to set all of the multiple add-in signature numbers corresponding to the current process name as the first priority add-in signature number when it is determined that the multiple add-in signature numbers corresponding to the current process name include the first priority add-in signature number; A second determination unit is configured to set all of the multiple add-in signature numbers corresponding to the current process name as the second priority add-in signature numbers when it is determined that the multiple add-in signature numbers corresponding to the current process name do not include the first priority add-in signature number but include the second priority add-in signature number; A third determination unit is used to set all of the multiple add-in signature numbers corresponding to the current process name as third priority add-in signature numbers when it is determined that the multiple add-in signature numbers corresponding to the current process name do not include the first priority add-in signature number nor the second priority add-in signature number; Among them, the first priority add-on signature number is 0, representing no add-on signature; the second priority add-on signature number is 1, representing an add-on signature issued by a third party; the third priority add-on signature number is 2, representing an add-on signature issued by Microsoft.

8. The malicious process detection device according to claim 5, characterized in that: The first two-dimensional matrix generation module includes: A malicious process field marking submodule is used to obtain the multiple DLL loading logs and mark the DLL loading logs generated by the malicious process and the normal process respectively to obtain a malicious process identification field; The feature acquisition submodule is used to perform data connection between the process name, add-in name, add-in signature and the corresponding malicious process identification field in each collected DLL loading log, store them in the form of a two-dimensional matrix, delete completely repeated DLL loading logs, and obtain the first two-dimensional matrix.

9. A malicious process detection system, comprising the malicious process detection device as described in any one of claims 5-8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the malicious process detection method according to any one of claims 1 to 4 is implemented.

Images