A method and system for API annotation of Windows PE virus samples

Abstract

The application relates to a Windows PE virus sample API labeling method and system, and belongs to the field of cyberspace security, which solves the problems of low labeling precision and low efficiency of Windows PE virus sample API in the prior art. The method comprises the following steps: performing dynamic analysis on each virus sample in an obtained virus sample set to obtain a corresponding virus sample API, wherein the virus sample API comprises a dynamic API calling sequence; performing initial labeling on the virus sample API according to API information defined by a Windows operating system and the dynamic API calling sequence to obtain an initial labeling result; and performing automatic perception labeling on the virus sample API according to the initial labeling result and the dynamic API calling sequence of the virus sample API by using a trained hidden Markov model, so that the virus sample API can be quickly, efficiently and accurately labeled.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security technology, and in particular to a method and system for annotating Windows PE virus sample APIs. Background Technology

[0002] Windows PE (Portable Executable) virus samples remain one of the most serious security threats in cyberspace. They launch undetected, compromising software and data security and privacy. The increasing number of viruses has driven the application of machine learning in virus detection. A key challenge in the effective implementation of machine learning-based virus detection methods is obtaining sample labels; due to the unique nature of viruses, determining their labels is extremely difficult and requires multifaceted expertise. Manual labeling is resource-intensive, especially with the surge in new and variant virus programs. The lag in manual analysis severely hinders emergency response, making rapid and effective control of virus programs difficult, rendering purely manual analysis inefficient and impractical. Therefore, automating the analysis process is imperative. Employing automated analysis techniques to deeply study virus sample behavior has significant practical implications.

[0003] Most existing research on virus samples focuses on the entire virus sample at a granular level. This is relatively effective for early viruses and Trojans with relatively simple structures and functions; however, newer virus samples have significantly increased code size, and their code structures and implemented functions are becoming increasingly complex, making complete analysis of the functions of complex virus samples almost impossible. Therefore, finer-grained analysis of virus samples is needed. API, or Application Programming Interface, is used by virtually all functions in the Windows operating system. By analyzing system API calls, the functionality of virus programs can be analyzed. Attackers create virus samples by calling APIs to achieve one or more of their attack objectives; therefore, finer-grained research on APIs is necessary in the analysis of binary virus samples.

[0004] Furthermore, effective annotation of PE virus samples is fundamental to defending against PE virus threats. Current technologies for annotating virus sample APIs mostly remain at the stage of simple semantic feature analysis. One approach is the TF-IDF (Term Frequency–Inverse Document Frequency) feature extraction method for single APIs, which uses features such as word frequency in a single API for feature function classification, primarily used in information retrieval and data mining. Another approach is N-gram-based API feature extraction, originating from the NLP (Netural Language Processing) field, which has good performance in extracting semantic information from text. A third approach is the GloVe (Global Vectors for Word Representation) API sequence feature vector method, which has powerful performance in addressing related words.

[0005] Existing technologies suffer from at least the following drawbacks: First, the TF-IDF (Term Frequency–Inverse Document Frequency) feature extraction method for single APIs does not perform well when the number of API types in virus samples is relatively small. Second, the API feature extraction method based on N-grams suffers from low annotation efficiency due to the enormous state space of API sequences caused by the variation of different N values. Third, the API sequence feature vector method based on GloVe is ineffective in analyzing virus sample APIs because the API call sequences are longer and more varied, and GloVe can only generate word vectors statically based on the corpus training results. Fourth, these existing methods cannot effectively analyze complex PE virus sample APIs, thus failing to successfully detect more complex PE virus samples. Summary of the Invention

[0006] Based on the above analysis, the embodiments of the present invention aim to provide a method and system for annotating Windows PE virus sample APIs, in order to solve the problems of low accuracy and low efficiency in the existing technology of Windows PE virus sample API annotation.

[0007] On one hand, this invention provides a method for annotating Windows PE virus sample APIs, including:

[0008] Each virus sample in the acquired virus sample set is dynamically analyzed to obtain the corresponding virus sample API, wherein the virus sample API includes a dynamic API call sequence;

[0009] Initial annotation results were obtained by initially labeling the API of the virus sample based on the API information defined by the Windows operating system and the dynamic API call sequence.

[0010] The trained Hidden Markov Model is used to automatically perceive and annotate the API of the virus sample based on the initial annotation results and dynamic API call sequence of the virus sample API.

[0011] Furthermore, the API information includes a description of API functional characteristics; specifically, the initial annotation results are obtained by initially annotating the virus sample API in the following manner:

[0012] For one of the APIs in the dynamic API call sequence, based on the API functional feature description defined by the Windows operating system, the functional component category to which the API belongs and the probability of belonging to the functional component category are determined, thereby obtaining the first functional component probability distribution of the API;

[0013] The API in the dynamic API call sequence is matched with the API category matching set set in the Windows operating system to determine the category of the API, and then the functional component category to which the API belongs and the probability of belonging to the functional component category are determined, thereby obtaining the second functional component probability distribution of the API.

[0014] If the maximum probability in the probability distribution of the first functional component is greater than the maximum probability in the probability distribution of the second functional component, then the functional component category corresponding to the maximum probability in the probability distribution of the first functional component is used as the initial annotation result of one of the APIs; if it is less than, then the functional component category corresponding to the maximum probability in the probability distribution of the second functional component is used as the initial annotation result of one of the APIs; if they are equal, then either the functional component category corresponding to the maximum probability in the probability distribution of the first functional component or the functional component category corresponding to the maximum probability in the probability distribution of the second functional component is selected as the initial annotation result of one of the APIs.

[0015] By traversing each API in the dynamic API call sequence, the initial annotation result of each API is obtained, thereby obtaining the initial annotation result of the virus sample API.

[0016] Furthermore, the Hidden Markov Model is obtained by training in the following manner:

[0017] The length of the dynamic API call sequence corresponding to each virus sample API is normalized. For each virus sample API, a dynamic API call sequence of a preset length is selected as the input of the Hidden Markov Model. The preset length represents the number of APIs included in the dynamic API call sequence.

[0018] Based on the selected input, the state transition probability matrix, observation probability matrix, and initial state distribution vector of the Hidden Markov Model are obtained, thereby obtaining the trained Hidden Markov Model.

[0019] Furthermore, the types of hidden states in the Hidden Markov Model correspond to the functional component categories of the virus sample API, and the types of hidden states include control functional components, detection functional components, infection functional components, and destruction functional components; the types of observed states in the Hidden Markov Model correspond to the actual names of the virus sample API.

[0020] Furthermore, the state transition probability matrix in the Hidden Markov Model is obtained in the following manner:

[0021] Each hidden state type is numbered;

[0022] Define a first two-dimensional matrix corresponding to the virus sample API. The first and second dimensions of the first two-dimensional matrix both correspond to the hidden state type number. The elements in the first two-dimensional matrix represent the probability that the hidden state corresponding to the first dimension will transition to the hidden state corresponding to the second dimension.

[0023] Based on the initial annotation results of the virus sample API, each API in the dynamic API call sequence of a preset length corresponding to the virus sample API is annotated, and the set of functional component categories to which the virus sample API belongs is determined based on the API annotation results.

[0024] Set up a second two-dimensional matrix corresponding to the virus sample API. The first and second dimensions of the second two-dimensional matrix both correspond to the hidden state type number. The elements in the second two-dimensional matrix represent the number of times the hidden state corresponding to the first dimension transitions to the hidden state corresponding to the second dimension. And determine the element values ​​in the second two-dimensional matrix based on the API annotation results.

[0025] The first two-dimensional matrix corresponding to the virus sample API is calculated based on the determined element values ​​in the second two-dimensional matrix.

[0026] By traversing each virus sample API, the first two-dimensional matrix corresponding to each virus sample API is determined. Based on multiple first two-dimensional matrices, the state transition probability matrix in the hidden Markov model is calculated.

[0027] Further, based on the determined element values ​​in the second two-dimensional matrix, the first two-dimensional matrix corresponding to the virus sample API is calculated, including:

[0028]

[0029] Where M_sample_n ij In the first two-dimensional matrix, the first dimension represents the element with index i and the second dimension represents the element with index j. Label_sample_n ij In the second two-dimensional matrix, the first dimension represents the element with index i and the second dimension represents the element with index j. Label_sample_n ik Let i represent the element value corresponding to the number i in the first dimension and the number k in the second dimension in the second two-dimensional matrix, where i, j, k ∈ {1, 2, 3, 4}.

[0030] Furthermore, the step of calculating the state transition probability matrix in the hidden Markov model based on multiple first two-dimensional matrices includes:

[0031] (i, j∈{1, 2, 3, 4}),

[0032] Among them, M ij The state transition probability matrix represents the element value corresponding to number i in the first dimension and number j in the second dimension, with total representing the total number of virus samples.

[0033] Furthermore, the observation probability matrix in the Hidden Markov Model is obtained in the following way:

[0034] N tj =U t [j],

[0035] as well as,

[0036] N tj =V t [j],

[0037] Where, N tj U represents the probability that the virus sample API with actual name number t belongs to hidden state j, where j∈{1,2,3,4}. t [j] represents the probability distribution of the first functional component of the virus sample API, V t [j] represents the probability distribution of the second functional component of the virus sample API.

[0038] Furthermore, the initial state distribution vector in the Hidden Markov Model is obtained in the following manner:

[0039] Determine the number of times that the API contained in the dynamic API call sequence of a preset length corresponding to the virus sample API is marked as hidden state j, where j∈{1,2,3,4}.

[0040] The APIs contained in the dynamic API call sequence of a preset length corresponding to each virus sample API are traversed to obtain the number of annotations corresponding to each hidden state.

[0041] Based on the number of annotations corresponding to each hidden state, the initial state distribution vector is calculated using the following formula:

[0042]

[0043] Among them, Π j Let represent the initial state distribution vector, Label[j] represent the number of times the hidden state j is labeled, and Label[k] represent the number of times the hidden state k is labeled, where k∈{1,2,3,4}.

[0044] On the other hand, the present invention provides a Windows PE virus sample API annotation system, comprising:

[0045] The virus sample API acquisition module is used to dynamically analyze each virus sample in the acquired virus sample set to obtain the corresponding virus sample API, wherein the virus sample API includes a dynamic API call sequence.

[0046] The initial annotation module is used to perform initial annotation of the virus sample API based on the API information defined by the Windows operating system and the dynamic API call sequence to obtain the initial annotation result;

[0047] The annotation module is used to automatically perceive and annotate the virus sample API based on the initial annotation results and dynamic API call sequence of the trained Hidden Markov Model.

[0048] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0049] 1. The Windows PE virus sample API annotation method and system proposed in this invention takes into account the four common operating stages of virus sample APIs and their corresponding functional components, and classifies the functional components of virus sample APIs to more effectively analyze the characteristics of virus sample APIs, and then performs efficient and accurate annotation based on the characteristics of virus sample APIs.

[0050] 2. The Windows PE virus sample API annotation method and system proposed in this invention performs initial annotation of the virus sample API based on the functional feature information and dynamic API sequence information of the virus sample API. Based on the initial annotation results and the corresponding dynamic API call sequence of the virus sample API, a trained Hidden Markov Model is used to automatically perceive and annotate the virus sample API, thereby improving the annotation efficiency of the virus sample API.

[0051] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0052] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0053] Figure 1 This is a flowchart of the Windows PE virus sample API annotation method according to an embodiment of the present invention. Detailed Implementation

[0054] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0055] Method Implementation Examples

[0056] One specific embodiment of the present invention discloses a method for annotating Windows PE virus sample APIs. For example... Figure 1 As shown, the method includes:

[0057] S110. Perform dynamic analysis on each virus sample in the acquired virus sample set to obtain the corresponding virus sample API. This virus sample API includes a dynamic API call sequence. Specifically, the virus sample APIs obtained through analysis are all APIs defined within the Windows operating system platform.

[0058] S120. Based on the API information defined by the Windows operating system and the dynamic API call sequence, the virus sample API is initially labeled to obtain the initial labeling result.

[0059] S130. Using the trained Hidden Markov Model, the virus sample API is automatically labeled based on the initial annotation results and dynamic API call sequence.

[0060] Preferably, in step S110, based on the virus sample set, the existing sandbox (virtual execution environment for network programming) tool Cuckoo is used to dynamically analyze the virus samples to obtain the dynamic API call sequence corresponding to each virus sample. Specifically, the virus sample is run in the Cuckoo virtual execution environment, the APIs called by the sample in sequence are recorded, an API sequence with dynamic characteristics is constructed, and the obtained dynamic API call sequence is extracted and filtered, that is, redundant APIs (adjacent and repeated APIs in the sequence) and noise (a segment or several segments of APIs in the sequence are likely noise added by the virus author). The processed dynamic API call sequence is obtained.

[0061] Preferably, in step S120, the initial annotation result is obtained by initially annotating the virus sample API in the following manner:

[0062] S1201. For one of the APIs in the dynamic API call sequence (also known as the first API), based on the API functional feature description and parameter settings defined by the Windows operating system (Windows operating system API manual), the dynamic API call sequence is manually compared with the Windows operating system API manual to determine the functional component category to which the first API belongs, and the probability that the first API belongs to that functional component category is determined based on experience, thereby obtaining the first functional component probability distribution of the first API. Specifically, the first functional component probability distribution is represented in the following form:

[0063] U = [A:w A ,B:w B ,C:w C ,D:w D ]

[0064] Where U represents the probability distribution of the first functional component, and A, B, C, and D represent the four functional components of control, detection, infection, and destruction, respectively. A ,w B ,w C and w D These represent the probabilities that the first API belongs to the corresponding functional component. Furthermore, the above probability parameters satisfy w. A +w B +w C +w D =1.

[0065] S1202. Match one of the APIs (the first API) in the dynamic API call sequence with the API category matching set set in the Windows operating system to determine the category of the API, and then determine the functional component category to which the API belongs and the probability of belonging to the functional component category, thereby obtaining the second functional component probability distribution of the API. Specifically:

[0066] The Windows operating system platform defines 10 API categories: memory, process, kernel, device, file, system, text, registry, window, and network; a matching set is defined for each API category, denoted as M. memory M process M kernel M device M file M system M text M registry M window and M network The contents of each matching set are shown in Table 1. Memory and process are defined as management components, kernel and device as detection components, file, system, and text as infection components, and registry, window, and network as destructive components. For one API in the dynamic API call sequence (the first API), match each item in these 10 matching sets. If any of these items are present, it indicates that the first API is related to that category, meaning the first API is related to the functional component corresponding to that API category. Record the matching results. The method is as follows:

[0067] [A:N A ,B:N B ,C:N C ,D:N D ]

[0068] Where A, B, C, and D still represent the four functional components of control, detection, infection, and destruction, respectively, and N A N B N C N D This represents the total number of substrings of the first API matched by the corresponding functional component. In other words, it involves determining the functional component to which each string in the first API belongs, thereby obtaining the total number of strings in the first API corresponding to each functional component. A matching record is then constructed for this first API, which is the probability distribution of the second functional component:

[0069] V = [A:v] A ,B:vB ,C:v C ,D:v D ]

[0070] Where v x (x = A, B, C, D), v A ,v B ,v C ,v D This represents the proportion of strings matched by this functional component out of the total number of strings. The calculation method is as follows:

[0071]

[0072] S1203. If the maximum probability in the probability distribution of the first functional component is greater than the maximum probability in the probability distribution of the second functional component, then the functional component category corresponding to the maximum probability in the probability distribution of the first functional component is taken as the initial annotation result of one of the APIs (first API). If it is less than the maximum probability in the probability distribution of the second functional component, then the functional component category corresponding to the maximum probability in the probability distribution of the second functional component is taken as the initial annotation result of one of the APIs (first API). If they are equal, then either the functional component category corresponding to the maximum probability in the probability distribution of the first functional component or the functional component category corresponding to the maximum probability in the probability distribution of the second functional component is selected as the initial annotation result of one of the APIs (first API).

[0073] S1204. Traverse each API in the dynamic API call sequence to obtain the initial annotation result of each API, and then obtain the initial annotation result of the virus sample API.

[0074] Table 1

[0075]

[0076]

[0077] First, the relevant parameters in the Hidden Markov Model are explained as follows:

[0078] Г represents the type of hidden state;

[0079] Λ represents the type of observation state;

[0080] M represents the state transition probability matrix (two-dimensional);

[0081] N represents the observation probability matrix (two-dimensional);

[0082] Π = Initial state distribution vector;

[0083] In the Hidden Markov Model, the types of hidden states correspond to the functional component categories of the virus sample API. The types of hidden states include control functional components, detection functional components, infection functional components, and destruction functional components. The types of observed states in the Hidden Markov Model correspond to the actual names of the virus sample API. This can be analogous to the part-of-speech tagging method to automatically tag dynamic API call sequences.

[0084] Specifically, Г = [A, B, C, D], which is the set of codes for four hidden states (functional component types);

[0085] Λ = [1, 2, 3, 4, ..., Num] (i.e., a set of Num devAPI numeric IDs with different actual names);

[0086] M ij This represents the probability that hidden state i will transition to hidden state j. "Transition" means: if the m-th element in Label_sample_n is hidden state i, and the (m+1)-th element is defined as hidden state j, then hidden state i will transition to hidden state j.

[0087] Preferably, the Hidden Markov Model is obtained by training in the following manner:

[0088] Step 1: Normalize the length of the dynamic API call sequence corresponding to each virus sample API. For each virus sample API, select a dynamic API call sequence of a preset length as the input of the Hidden Markov Model. The preset length represents the number of APIs included in the dynamic API call sequence. For example, the preset length is 100.

[0089] Step 2: Based on the selected input, obtain the state transition probability matrix, observation probability matrix, and initial state distribution vector in the Hidden Markov Model, and then obtain the trained Hidden Markov Model.

[0090] Preferably, step 2 specifically includes:

[0091] Step 201: Specifically, the state transition probability matrix in the Hidden Markov Model is obtained in the following manner:

[0092] Each hidden state type is numbered, for example, as follows: [A:1, B:2, C:3, D:4];

[0093] Define the first two-dimensional matrix M_sample_n[4][4] corresponding to the virus sample API. The first and second dimensions of the first two-dimensional matrix both correspond to the hidden state type number. The elements M_sample_n in the first two-dimensional matrix ij M_sample_n represents the probability that a hidden state in the first dimension will transition to the hidden state corresponding to the second dimension.ij This represents the probability that hidden state i will transition to hidden state j in the nth (n = 1, 2, 3...total) virus sample API (i.e., dynamic API call sequence), and total represents the total number of virus samples.

[0094] Based on the initial annotation results of the virus sample API, each API in the dynamic API call sequence of the preset length corresponding to the virus sample API is annotated, and the functional component category set Lable_sample_n

[100] to which the virus sample API belongs is determined based on the API annotation results, where Lable_sample_n[f] is the functional component to which the f-th API belongs.

[0095] Set the second two-dimensional matrix Label_sample_n[4][4] corresponding to the virus sample API. The first and second dimensions of the second two-dimensional matrix correspond to the hidden state type number. The elements in the second two-dimensional matrix represent the number of times the hidden state corresponding to the first dimension transitions to the hidden state corresponding to the second dimension. And determine the element values ​​in the second two-dimensional matrix according to the API annotation results. Specifically, Label_sample_n ij This represents the number of times the hidden state i transitions to hidden state j in the API of the nth virus sample. The Label_sample_n of the nth virus sample is iterated through, and the number of transitions is counted and recorded in Label_sample_n.

[0096] The first two-dimensional matrix corresponding to the virus sample API is calculated based on the element values ​​in the determined second two-dimensional matrix:

[0097]

[0098] Where M_sample_n ij In the first two-dimensional matrix, the first dimension represents the element with index i and the second dimension represents the element with index j. Label_sample_n ij In the second two-dimensional matrix, the first dimension represents the element with index i and the second dimension represents the element with index j. Label_sample_n ik In the second two-dimensional matrix, the first dimension is the element value corresponding to the number i and the second dimension is the element value corresponding to the number k, where i, j, k∈{1, 2, 3, 4}, and each represents the number corresponding to the functional component category.

[0099] By traversing each virus sample API, the first two-dimensional matrix corresponding to each virus sample API is determined. Based on multiple first two-dimensional matrices, the state transition probability matrix in the Hidden Markov Model is calculated, specifically represented as follows:

[0100] (i, j∈{1, 2, 3, 4}),

[0101] Among them, M ij The state transition probability matrix represents the element value corresponding to number i in the first dimension and number j in the second dimension, with total representing the total number of virus samples.

[0102] Step 202: Specifically, the observation probability matrix in the Hidden Markov Model is obtained in the following way:

[0103] N tj =U t [j],

[0104] as well as,

[0105] N tj =V t [j],

[0106] Where, N tj U represents the probability that the virus sample API with actual name number t belongs to hidden state j, where j∈{1,2,3,4}. t [j] represents the probability distribution of the first functional component of the virus sample API, V t [j] represents the probability distribution of the second functional component of the virus sample API.

[0107] Step 203: Specifically, the initial state distribution vector in the Hidden Markov Model is obtained in the following manner:

[0108] Determine the number of times the API is marked as a hidden state j in a dynamic API call sequence of a preset length corresponding to the virus sample API, where j∈{1,2,3,4}.

[0109] The APIs contained in the dynamic API call sequence of a preset length corresponding to each virus sample API are traversed to obtain the number of annotations corresponding to each hidden state.

[0110] Based on the number of annotations corresponding to each hidden state, the initial state distribution vector is calculated using the following formula:

[0111]

[0112] Among them, Π j The initial state distribution vector is represented by Label[j], which represents the number of times the hidden state j is labeled, and Label[k] represents the number of times the hidden state k is labeled. k∈{1,2,3,4} represents the number of the functional component category.

[0113] Preferably, the virus samples are automatically labeled using a Hidden Markov Model in the following manner:

[0114] The input is a dynamic API call sequence (a sequence of numerical identifiers for each API's actual name, where the API identifier refers to the position of the corresponding API in the API library of size Num). The output is the automatic labeling result of each virus sample API. For the Hidden Markov Model, the Viterbi algorithm is used to find the most likely hidden state sequence corresponding to the observed sequence by searching for the maximum likelihood path.

[0115] For example, in step 1, for the API number sequence to be labeled for virus sample n (obtained from Λ), API_SEQ_N

[100] , the first state does not need to consider the transition state probability, only the observation probability, so its labeling result Label_result is calculated as follows:

[0116] Label_result[1] = Max(N i1 N i2 N i3 N i4 )

[0117] Where i represents the API number corresponding to API_SEQ_N[1], which is why the API number sequence is used as input. Max obtains the number of the hidden state with the highest probability, that is, if N i1 If the maximum value is found, then the result of Max is 1.

[0118] Step 2: For API_SEQ_N[n] (1 < n < 100), the transition probability needs to be considered, so the calculation method for its labeling result is as follows:

[0119] Label_result[n] = Max(M Label_result[n-1] k*N ik (k = 1, 2, 3, 4)

[0120] Among them, M API_SEQ_N[n-1]i This represents the probability that API_SEQ_N[n-1] will transition from a hidden state to a hidden state i, where i represents the API functional component category number corresponding to API_SEQ_N[n].

[0121] Step 3: This completes the labeling of sample n.

[0122] Step 4: Repeat steps 1 to 3 for all samples to complete the automatic detection and labeling of the virus sample API for all virus samples.

[0123] System Implementation Examples

[0124] Another embodiment of the present invention discloses a Windows PE virus sample API annotation system.

[0125] Since the system embodiment and the above method embodiment are based on the same working principle, the parts that are repeated can be referred to the above method embodiment, and will not be repeated here.

[0126] Specifically, the system includes:

[0127] The virus sample API acquisition module is used to dynamically analyze each virus sample in the acquired virus sample set to obtain the corresponding virus sample API, wherein the virus sample API includes a dynamic API call sequence.

[0128] The initial annotation module is used to perform initial annotation of the virus sample API based on the API information defined by the Windows operating system and the dynamic API call sequence to obtain the initial annotation result;

[0129] The annotation module is used to automatically perceive and annotate the virus sample API based on the initial annotation results and dynamic API call sequence of the trained Hidden Markov Model.

[0130] The Windows PE virus sample API annotation method and system disclosed in this invention firstly, considering the four common operational stages of virus sample APIs and their corresponding functional components, classifies the functional components of virus sample APIs to more effectively analyze their characteristics, and then performs efficient and accurate annotation based on these characteristics. Secondly, the Windows PE virus sample API annotation method and system disclosed in this invention performs initial annotation of virus sample APIs based on their functional feature information and dynamic API sequence information, and then uses a trained Hidden Markov Model to automatically perceive and annotate virus sample APIs based on the initial annotation results and the corresponding dynamic API call sequence, thereby improving the annotation efficiency of virus sample APIs.

[0131] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0132] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for annotating Windows PE virus sample APIs, characterized in that, include: Each virus sample in the acquired virus sample set is dynamically analyzed to obtain the corresponding virus sample API, wherein the virus sample API includes a dynamic API call sequence; Initial annotation results were obtained by initially labeling the API of the virus sample based on the API information defined by the Windows operating system and the dynamic API call sequence. The trained Hidden Markov Model is used to automatically perceive and annotate the API of the virus sample based on the initial annotation results and dynamic API call sequence of the virus sample API. The API information includes a description of the API's functional characteristics; Specifically, the initial annotation results are obtained by performing initial annotation on the virus sample API using the following method: For one of the APIs in the dynamic API call sequence, based on the API functional feature description defined by the Windows operating system, the functional component category to which the API belongs and the probability of belonging to the functional component category are determined, thereby obtaining the first functional component probability distribution of the API; The API in the dynamic API call sequence is matched with the API category matching set set in the Windows operating system to determine the category of the API, and then the functional component category to which the API belongs and the probability of belonging to the functional component category are determined, thereby obtaining the second functional component probability distribution of the API. If the maximum probability in the probability distribution of the first functional component is greater than the maximum probability in the probability distribution of the second functional component, then the functional component category corresponding to the maximum probability in the probability distribution of the first functional component is used as the initial annotation result of one of the APIs; if it is less than, then the functional component category corresponding to the maximum probability in the probability distribution of the second functional component is used as the initial annotation result of one of the APIs; if they are equal, then either the functional component category corresponding to the maximum probability in the probability distribution of the first functional component or the functional component category corresponding to the maximum probability in the probability distribution of the second functional component is selected as the initial annotation result of one of the APIs. By traversing each API in the dynamic API call sequence, the initial annotation result of each API is obtained, thereby obtaining the initial annotation result of the virus sample API; The Hidden Markov Model is obtained by training in the following manner: The length of the dynamic API call sequence corresponding to each virus sample API is normalized. For each virus sample API, a dynamic API call sequence of a preset length is selected as the input of the Hidden Markov Model. The preset length represents the number of APIs included in the dynamic API call sequence. Based on the selected input, the state transition probability matrix, observation probability matrix, and initial state distribution vector of the Hidden Markov Model are obtained, thereby obtaining the trained Hidden Markov Model.

2. The Windows PE virus sample API annotation method according to claim 1, characterized in that, The types of hidden states in the Hidden Markov Model correspond to the functional component categories of the virus sample API, including control functional components, detection functional components, infection functional components, and destruction functional components; the types of observed states in the Hidden Markov Model correspond to the actual names of the virus sample API.

3. The Windows PE virus sample API annotation method according to claim 2, characterized in that, Specifically, the state transition probability matrix in the Hidden Markov Model is obtained in the following manner: Each hidden state type is numbered; Define a first two-dimensional matrix corresponding to the virus sample API. The first and second dimensions of the first two-dimensional matrix both correspond to the hidden state type number. The elements in the first two-dimensional matrix represent the probability that the hidden state corresponding to the first dimension will transition to the hidden state corresponding to the second dimension. Based on the initial annotation results of the virus sample API, each API in the dynamic API call sequence of a preset length corresponding to the virus sample API is annotated, and the set of functional component categories to which the virus sample API belongs is determined based on the API annotation results. Set up a second two-dimensional matrix corresponding to the virus sample API. The first and second dimensions of the second two-dimensional matrix both correspond to the hidden state type number. The elements in the second two-dimensional matrix represent the number of times the hidden state corresponding to the first dimension transitions to the hidden state corresponding to the second dimension. And determine the element values ​​in the second two-dimensional matrix based on the API annotation results; The first two-dimensional matrix corresponding to the virus sample API is calculated based on the determined element values ​​in the second two-dimensional matrix. By traversing each virus sample API, the first two-dimensional matrix corresponding to each virus sample API is determined. Based on multiple first two-dimensional matrices, the state transition probability matrix in the hidden Markov model is calculated.

4. The Windows PE virus sample API annotation method according to claim 3, characterized in that, The first two-dimensional matrix corresponding to the virus sample API is calculated based on the determined element values ​​in the second two-dimensional matrix, including: Where Msample_n ij In the first two-dimensional matrix, the first dimension represents the element with index i and the second dimension represents the element with index j. Label_sample_n ij In the second two-dimensional matrix, the first dimension represents the element with index i and the second dimension represents the element with index j. Label_sample_n ik Let i represent the element value corresponding to the number i in the first dimension and the number k in the second dimension in the second two-dimensional matrix, where i,j,k∈{1,2,3,4}.

5. The Windows PE virus sample API annotation method according to claim 4, characterized in that, The step of calculating the state transition probability matrix in the hidden Markov model based on multiple first two-dimensional matrices includes: Among them, M ij The state transition probability matrix represents the element value corresponding to number i in the first dimension and number j in the second dimension, with total representing the total number of virus samples.

6. The Windows PE virus sample API annotation method according to claim 2, characterized in that, Specifically, the observation probability matrix in the Hidden Markov Model is obtained in the following way: N tj =U t [j], as well as, N tj =V t [j], Where, N tj U represents the probability that the virus sample API with actual name number t belongs to hidden state j, where j∈{1,2,3,4}. t [j] represents the probability distribution of the first functional component of the virus sample API, V t [j] represents the probability distribution of the second functional component of the virus sample API.

7. The Windows PE virus sample API annotation method according to claim 4, characterized in that, Specifically, the initial state distribution vector in the Hidden Markov Model is obtained in the following way: Determine the number of times that the API contained in the dynamic API call sequence of a preset length corresponding to the virus sample API is marked as hidden state j, where j∈{1,2,3,4}. The APIs contained in the dynamic API call sequence of a preset length corresponding to each virus sample API are traversed to obtain the number of annotations corresponding to each hidden state. Based on the number of annotations corresponding to each hidden state, the initial state distribution vector is calculated using the following formula: Among them, Π j Let represent the initial state distribution vector, Label[j] represent the number of times the hidden state j is labeled, and Label[k] represent the number of times the hidden state k is labeled, where k∈{1,2,3,4}.

8. A Windows PE virus sample API annotation system, characterized in that, include: The virus sample API acquisition module is used to dynamically analyze each virus sample in the acquired virus sample set to obtain the corresponding virus sample API, wherein the virus sample API includes a dynamic API call sequence. The initial annotation module is used to perform initial annotation of the virus sample API based on the API information defined by the Windows operating system and the dynamic API call sequence to obtain the initial annotation result; The annotation module is used to automatically perceive and annotate the virus sample API based on the initial annotation results and dynamic API call sequence of the trained Hidden Markov Model. The API information includes a description of the API's functional characteristics; Specifically, the initial annotation results are obtained by performing initial annotation on the virus sample API using the following method: For one of the APIs in the dynamic API call sequence, based on the API functional feature description defined by the Windows operating system, the functional component category to which the API belongs and the probability of belonging to the functional component category are determined, thereby obtaining the first functional component probability distribution of the API; The API in the dynamic API call sequence is matched with the API category matching set set in the Windows operating system to determine the category of the API, and then the functional component category to which the API belongs and the probability of belonging to the functional component category are determined, thereby obtaining the second functional component probability distribution of the API. If the maximum probability in the probability distribution of the first functional component is greater than the maximum probability in the probability distribution of the second functional component, then the functional component category corresponding to the maximum probability in the probability distribution of the first functional component is used as the initial annotation result of one of the APIs; if it is less than, then the functional component category corresponding to the maximum probability in the probability distribution of the second functional component is used as the initial annotation result of one of the APIs; if they are equal, then either the functional component category corresponding to the maximum probability in the probability distribution of the first functional component or the functional component category corresponding to the maximum probability in the probability distribution of the second functional component is selected as the initial annotation result of one of the APIs. By traversing each API in the dynamic API call sequence, the initial annotation result of each API is obtained, thereby obtaining the initial annotation result of the virus sample API; The Hidden Markov Model is obtained by training in the following manner: The length of the dynamic API call sequence corresponding to each virus sample API is normalized. For each virus sample API, a dynamic API call sequence of a preset length is selected as the input of the Hidden Markov Model. The preset length represents the number of APIs included in the dynamic API call sequence. Based on the selected input, the state transition probability matrix, observation probability matrix, and initial state distribution vector of the Hidden Markov Model are obtained, thereby obtaining the trained Hidden Markov Model.

Images