A method for detecting malicious code in a customer virtual machine in a cloud platform

Abstract

The application discloses a method for detecting malicious code of a client virtual machine in a cloud platform, comprising the following steps: S1, obtaining a memory dump file; S2, extracting information by virtual machine introspection; S3, model training; and S4, malicious code detection. The method can avoid attacks of malicious code on agents in the client machine, make the agents invalid or even bypass detection software, improve detection efficiency and detection accuracy, and does not need to be re-adapted for different types of operating systems.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cloud security, and particularly relates to a method for detecting malicious code of a customer virtual machine in a cloud platform. BACKGROUND

[0002] Cloud computing is a kind of distributed computing, which refers to dividing a huge data computing process into numerous small programs through a network "cloud", and then processing and analyzing the small programs through a system composed of multiple servers to obtain results and return them to the user.

[0003] In recent years, with the rapid development of cloud computing, cloud security problems have become increasingly serious. In the traditional cloud platform, malicious code detection is mostly achieved by setting up an agent in the client to obtain the state information of the client at runtime. This cannot avoid attacks by malicious code on the agent in the client, which makes the agent invalid or even bypasses the detection software. At the same time, the traditional method is generally based on expert analysis or feature-based machine learning classification for malicious code detection, which consumes a lot of time in analysis or data preprocessing. Moreover, the existing detection methods need to be adapted and changed for different types of operating systems, and cannot well detect operating systems without a visual interface. SUMMARY

[0004] The main purpose of the present application is to provide a method for detecting malicious code of a customer virtual machine in a cloud platform, which can avoid attacks by malicious code on the agent in the client, making it invalid or even bypassing the detection software, improving the detection efficiency and accuracy, and not needing to be re-adapted for different types of operating systems.

[0005] To achieve the above purpose, the present application provides a method for detecting malicious code of a customer virtual machine in a cloud platform, comprising the following steps:

[0006] Step S1, obtaining a memory dump file, creating and starting a customer virtual machine in a cloud platform, and obtaining a memory dump file of the customer virtual machine by using a memory dump function of a virtualization platform;

[0007] Step S2, virtual machine introspection to extract information, analyzing the memory dump file, and obtaining various running state features of the customer virtual machine by using a virtual machine introspection technology;

[0008] Step S3, model training, training the various running state features in sequence by using a BERT model, obtaining a trained BERT model and a model classification accuracy corresponding to each type of running state feature;

[0009] Step S4: Malicious code detection. The detected runtime features are sequentially input into the trained BERT model for detection to obtain the detection results of various runtime features. The weight of the detection result of each runtime feature is assigned according to the model classification accuracy corresponding to each runtime feature. The detection result of each runtime feature is multiplied by the corresponding weight and then added together to obtain the final detection result.

[0010] Optionally, step S1 includes:

[0011] Step S101: Create and start the customer virtual machine in the cloud platform;

[0012] Step S102: Save a snapshot of the customer virtual machine as a recovery point, and run normal software and malicious software in the customer virtual machine to simulate the scenarios of normal user use and being invaded by malicious software.

[0013] S103. Use the memory dump function of the virtualization platform to obtain the memory dump file of the customer's virtual machine;

[0014] S104. Restore the client virtual machine to the recovery point, run the remaining software, and repeat step S103.

[0015] Optionally, step S2 includes:

[0016] Step S201: Construct the symbol table of the guest operating system;

[0017] Step S202: Analyze the memory dump file to obtain various running status characteristics of the guest virtual machine during runtime, and save the obtained data in different documents according to categories.

[0018] Optionally, the guest virtual machine includes a Linux system virtual machine and a Windows system virtual machine. The type of the guest virtual machine is determined. If the guest virtual machine is a Windows system virtual machine, then in step S201, the symbol table is obtained using volatility; if the guest virtual machine is a Linux system virtual machine, then in step S201, the symbol table is obtained using dwarf2json.

[0019] Optionally, the Linux system virtual machine uses the Ubuntu 16.04 operating system, and the Windows system virtual machine uses the Windows 7 operating system.

[0020] Optionally, step S3 includes:

[0021] Step S301: Organize and label the running state features obtained in step S2 as the input dataset for the BERT model, and divide the input dataset into training set and validation set;

[0022] Step S302: Adjust the hyperparameter structure of the BERT model;

[0023] Step S303: Input the input dataset into the BERT model for pre-training, complete the mask LM and NSP pre-training tasks, and then use the same input dataset to retrain the pre-trained model to finally obtain the trained BERT classification model and the model classification accuracy corresponding to various running state features.

[0024] Optionally, step S302 adjusts the hyperparameter structure of the BERT model as follows:

[0025] The number of hidden layers L = 2, the size of the hidden layers H = 512, and the number of attention heads A = 8.

[0026] Optionally, step S4 includes:

[0027] Select the n operational state features with the highest classification accuracy of the model;

[0028] The weight of the detection result for each operational state feature is calculated based on the model classification accuracy of the selected operational state features. The weight calculation formula is as follows:

[0029]

[0030] Among them, w i For the weight of the i-th running state feature, acc i Let the model classification accuracy be the value of the i-th running state feature. The sum of the model classification accuracies for n running state features, where n is an integer greater than zero;

[0031] When performing malware detection on the client virtual machine under test, firstly, n selected runtime state features of the client virtual machine under test are obtained. Then, the trained BERT model is used to classify and detect the selected runtime state features to obtain the detection results of each type of runtime state feature. The final detection result is calculated using the following formula:

[0032]

[0033] Where R0 is the probability that malicious code exists in the guest virtual machine, w i R represents the weight of the i-th feature. i Let r be the classification accuracy of the i-th feature of the client virtual machine to be tested. i Let 1 represent that the detection result of the i-th feature is malicious.

[0034] Optionally, the filtered runtime status features include filescan, netscan, malfind, privs, modules, psxview, pslist, svcscan, thrdscan, and mutantscan.

[0035] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0036] 1. This method can perform malware detection on guest virtual machines using different operating systems without any changes or adjustments, and also without requiring additional settings for the guest operating system;

[0037] 2. This method obtains the memory dump file of the virtual client and uses virtual machine introspection technology to extract various running state characteristics of the client virtual machine, thereby obtaining client information from the hypervisor layer and effectively avoiding damage or bypassing of the detection system by malicious software.

[0038] 3. Utilizing the BERT model for classifying runtime information avoids the complex feature extraction steps (such as sliding windows) found in existing technologies, eliminating the need for additional analysis or feature extraction and reducing time overhead. Furthermore, BERT's output includes word vectors, text vectors, and position vectors, strengthening the contextual relationship of runtime status information and improving detection accuracy. This method achieves a classification accuracy of 99.9%, effectively ensuring the security of the cloud platform. Attached Figure Description

[0039] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a design architecture diagram of the method for detecting malicious code in a client virtual machine in a cloud platform provided by the present invention;

[0041] Figure 2 This is a schematic diagram illustrating the working principle of the BERT model in this embodiment of the invention;

[0042] Figure 3 This is a flowchart of a method for detecting malicious code in a client virtual machine on a cloud platform, provided by the present invention. Detailed Implementation

[0043] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0044] This invention provides a method for detecting malicious code on guest virtual machines in a cloud platform, comprising four parts: data acquisition, virtual machine introspection extraction, model training, and classification detection. The data acquisition part primarily obtains the runtime data of instances on the cloud platform, providing data for subsequent model classification. The actual environment for this part is an OpenStack train version environment installed on Ubuntu 18.04. Multiple instances, i.e., guest virtual machines, are created on the OpenStack cloud platform, and runtime dump file contents are obtained. The virtual machine introspection extraction part primarily uses virtual machine introspection technology to obtain specific runtime information of the guest machines from the dump file contents extracted from the cloud platform. This part can extract guest machine runtime information from different systems, not limited to the same system, allowing the classification model to still exhibit good detection rates when facing data from different systems.

[0045] The main function of the model training section is to classify the probability of a client machine being attacked by malicious code after training the BERT model. BERT model training includes two parts: pre-training and training. Pre-training ensures that the vector representation of each character / word in the model's output can comprehensively and accurately depict the overall information of the input text, providing better initial values ​​for the model parameters in subsequent training. After pre-training, the same dataset is used again for training to obtain the BERT classification model for malicious code detection. During detection, the classification accuracy of each feature is obtained using multiple client virtual machine runtime state features and the trained BERT classification model. Combined with a weight formula, the probability of malicious code existing in the client virtual machine is calculated.

[0046] Please see Figure 1 , Figure 2 and Figure 3 The specific steps of a method for detecting malicious code in a client virtual machine in a cloud platform according to an embodiment of the present invention are as follows.

[0047] Step 1: Obtain the memory dump file

[0048] (1) Create multiple guest virtual machines in the cloud platform, install different versions of Linux and Windows systems on each, and start the guest virtual machines. Specifically, use OpenStack to create multiple guest virtual machines, install Ubuntu 16.04 (a Linux system) and Windows 7 operating systems on each, and start these guest virtual machines. By setting up two types of virtual machines, the running information of guest machines with different systems can be extracted, enabling the detection of the running status characteristics of multiple operating systems.

[0049] (2) Save snapshots of the customer virtual machines as recovery points, and run normal software and malware within the customer virtual machines to simulate scenarios of normal user use and malware intrusion. Use OpenStack's dump file function to create dump files for these customer virtual machines, and run normal software and malware within the customer virtual machines to simulate scenarios of normal user use and malware intrusion.

[0050] (3) Then, the memory dump function of the virtualization platform is used, specifically the libvirt virsh dump command to obtain the memory dump file of the guest virtual machine.

[0051] (4) Restore the client virtual machine to the recovery point, run the remaining software and repeat step (3).

[0052] Step 2: Virtual machine introspection extracts information

[0053] After obtaining the memory dump file of the guest virtual machine, virtual machine introspection technology is used to acquire the runtime state information of the guest virtual machine. Virtual machine introspection technology can obtain the internal runtime state information of the virtual machine from outside the guest virtual machine. The following are the steps for performing virtual machine introspection using Volatility.

[0054] (1) Construct the symbol table of the guest operating system. For Windows operating system, the symbol table provided by Volatility can be used, while for Linux operating system, dwarf2json is used. The function of dwarf2json is to process the DWARF and symbol table information from the ELF file and the symbols from the System.map input file to generate a JSON file that can be used by Volatility to analyze Linux.

[0055] (2) Analyze the memory dump file obtained in the previous step. Use Volatility's callbacks, dlllist, filescan, handles and other plugins to obtain the runtime status characteristics of the guest virtual machine, such as API call sequence, memory operation, network activity, registry, and file operation. Save the obtained data in different documents according to categories.

[0056] The malware detection method in this embodiment differs from previous malware detection methods. This method selects offline classification detection. In the above steps, the runtime status feature acquisition is obtained from the hypervisor layer, avoiding malware damage or bypassing the detection system. Furthermore, the virtual machine introspection technology used is adaptable to multiple systems, allowing the extraction of necessary runtime status information from different systems for subsequent classification and prediction without requiring re-adaptation.

[0057] Step 3: Model Training

[0058] This method uses the BERT model, whose training process consists of two phases: pre-training and training. The pre-training phase helps the BERT model understand word meanings and relationships between sentences, while the training phase allows the BERT model to learn word dependencies within sentences and capture their internal structure. For the BERT model's detection principles, please refer to [link to relevant documentation]. Figure 2 The transformer encoder is used to learn contextual word information to enhance the semantic representation of the target word. Figure 2 The left-hand flowchart illustrates the complete process of a transformer encoder in the right-hand diagram. After inputting data into the BERT model, it first passes through a multi-head self-attention module, which enhances the semantic vector representation of each character in the text. The input data and the output data from the multi-head self-attention module are then added together via residual connections as a new input and standardized. Next, each character undergoes two linear transformations to enhance the overall expressive power of the model. The dataset used in this method comprises runtime features extracted from a cloud platform using virtual machine introspection techniques, exhibiting strong contextual relationships. Since the BERT model considers the contextual relationships of the text during classification, which helps improve detection accuracy, this method chooses the BERT model as the classification model.

[0059] (1) Collect various runtime state features obtained using virtual machine introspection techniques and label them as input data. After obtaining the runtime state features obtained using virtual machine introspection techniques, they need to be organized and labeled as input data for training models. Use the text_dataset_from_directory function to read the dataset and divide it into training and validation sets in a ratio of 8:2.

[0060] (2) Pre-training the BERT model. Pre-training allows for adjustments to the BERT model's parameters, ensuring its output accurately represents semantics. The BERT model used in this method comprises the following adjustable hyperparameters: number of hidden layers L (L = [2, 4, 8, 12]), size of each hidden layer H (H = [128, 256, 512, 768]), and number of attention heads A (A = [2, 4, 8, 12]). By adjusting the hyperparameters, the model structure with the best classification performance was selected. In this experiment, the best classification results were achieved when the parameters were L = 2, H = 512, and A = 8.

[0061] (3) Use the dataset collected in step two to pre-train the BERT model, completing two pre-training tasks: mask LM and NextSentence Prediction (NSP), to enable the BERT model to better understand the relationships between words and sentences. Use the same dataset again to retrain the pre-trained model to finally obtain the trained BERT classification model.

[0062] Step 4: Malicious Code Detection

[0063] Malicious code detection involves two steps. First, the weight formula for each feature is calculated based on the classification accuracy of a multi-feature model. Then, the weight formula and a trained BERT model are used to detect malicious code, yielding the final detection result.

[0064] (1) Select the top n features with the highest classification accuracy from all features used when training the model (n is a positive integer). In this embodiment, the top ten features with the highest classification accuracy are selected as the final features for malicious code detection. The classification accuracy of all models using these features is shown in Table 1.

[0065]

[0066]

[0067] Table 1

[0068] Since the weights for high classification accuracy have a greater impact on the final detection results, a weight is assigned to each feature. The weight calculation formula is as follows:

[0069]

[0070] Among them, w i Let acc be the weight of the i-th feature. i Let be the model classification accuracy for the i-th feature. This is the sum of the classification accuracies of the model with n features. As can be seen from the formula, the higher the classification accuracy, the greater the weight of that feature, and the greater its impact on the final detection result.

[0071] (2) When performing malware detection on the client virtual machine under test, obtain the top ten features with high classification accuracy of the client virtual machine under test (system is Ubuntu 16.04) (namely: filescan, netscan, malfind, privs, modules, psxview, pslist, svcscan, thrdscan, mutantscan), and use the BERT model trained in step three to classify and detect them respectively, and obtain the classification accuracy of each feature, that is, the classification accuracy R of malware detection using the i-th feature. i The final detection result is obtained by multiplying the classification accuracy of each feature by its corresponding weight and the detection result, and then summing the results. The formula is as follows.

[0072]

[0073] Where R0 is the probability that malicious code exists in the guest virtual machine, w i R represents the weight of the i-th feature. i Let r be the classification accuracy of the i-th feature of the client virtual machine to be tested. i Let 1 represent that the detection result of the i-th feature is malicious.

[0074] In this embodiment, there are two instances of "acc" that relate to classification accuracy. i and R i . acc i It is achieved by training the BERT model using the dataset as input, and the output is the accuracy. i This refers to the classification accuracy of the model. R i It takes the data of the i-th feature of the virtual machine under test as input, uses the trained BERT model for classification, and the output is R. i This refers to the classification accuracy of using the i-th feature for malicious code detection. i and R i acc is used as the output of training the model and the output of classifying the model, respectively. i The input data includes runtime status characteristic data for two types of clients, while R i Then, the i-th running state feature of the virtual machine under test is used as input, acc i It combines two systems, while R i This applies to the system under test, and neither of these methods requires additional calculation steps to obtain.

[0075] This embodiment first utilizes the virtualization platform's memory dump function to obtain the memory dump files of the guest virtual machine from outside. Then, it uses the guest virtual machine's introspection software to analyze these dump files and obtain the guest virtual machine's runtime status information. This effectively prevents malicious code from damaging or bypassing the detection system. Furthermore, it requires no adjustments or modifications for different types of guest operating systems, whereas existing methods require adaptation and modification for different operating systems and are ineffective for operating systems without a visual interface. This method uses the BERT architecture to classify the obtained runtime status information, eliminating the need for additional analysis or feature extraction and reducing time overhead. Moreover, this method achieves a classification accuracy of 99.9%, effectively ensuring the security of the cloud platform.

[0076] The terms used in this embodiment are explained below.

[0077] Hypervisor, also known as a virtual machine monitor, is software, firmware, or hardware used to create and run virtual machines.

[0078] BERT stands for Bidirectional IEncoder Representations from Transformer. The goal of the BERT model is to train on a large-scale unlabeled corpus to obtain a representation of text containing rich semantic information, that is, a semantic representation of the text. Then, the semantic representation of the text is fine-tuned for a specific NLP task and finally applied to that NLP task.

[0079] Volatility: A memory forensics tool.

[0080] dwarf2json: A tool for retrieving symbol tables and saving them as JSON files.

[0081] API: Application Programming Interface.

[0082] Mask LM: Full name Mask Language Model, a pre-trained language model based on the mask mechanism.

[0083] Next Sentence Prediction (NSP): A training task for learning relationships between sentences.

[0084] It should be understood that the specific embodiments described above are merely illustrative or explanatory of the principles of the invention and do not constitute a limitation thereof. Therefore, any modifications, equivalent substitutions, improvements, etc., made without departing from the spirit and scope of the invention should be included within the protection scope of the invention. Furthermore, the appended claims are intended to cover all variations and modifications falling within the scope and boundaries of the appended claims, or equivalent forms of such scope and boundaries.

Claims

1. A method for detecting malicious code on customer virtual machines in a cloud platform, characterized in that, Includes the following steps: Step S1: Obtain the memory dump file. Create and start the customer virtual machine in the cloud platform, and use the memory dump function of the virtualization platform to obtain the memory dump file of the customer virtual machine. Step S2: Extract information through virtual machine introspection, analyze the memory dump file, and obtain various running state characteristics of the customer's virtual machine through virtual machine introspection technology; Step S3: Model training. The BERT model is used to train the model on various running state features in sequence to obtain the trained BERT model and the model classification accuracy corresponding to various running state features. Step S4: Malicious code detection. The detected runtime features are sequentially input into the trained BERT model for detection to obtain the detection results of various runtime features. The weight of the detection result of each runtime feature is assigned according to the model classification accuracy corresponding to each runtime feature. The detection result of each runtime feature is multiplied by the corresponding weight and then added together to obtain the final detection result. Step S3 includes: Step S301: Organize and label the running state features obtained in step S2 as the input dataset for the BERT model, and divide the input dataset into training set and validation set; Step S302: Adjust the hyperparameter structure of the BERT model as follows: number of hidden layers L = 2, hidden layer size H = 512, number of attention heads A = 8; Step S303: Input the input dataset into the BERT model for pre-training, complete the two pre-training tasks of mask LM and NSP, and then use the same input dataset to retrain the pre-trained model to finally obtain the trained BERT classification model and the model classification accuracy corresponding to various running state features. Step S4 includes: Select the n operational state features with the highest classification accuracy of the model; The weight of the detection result for each operational state feature is calculated based on the model classification accuracy of the selected operational state features. The weight calculation formula is as follows: Among them, w i For the weight of the i-th running state feature, acc i Let the model classification accuracy be the value of the i-th running state feature. The sum of the model classification accuracies for n running state features, where n is an integer greater than zero; When performing malware detection on the client virtual machine under test, firstly, n selected runtime state features of the client virtual machine under test are obtained. Then, the trained BERT model is used to classify and detect the selected runtime state features to obtain the detection results of each type of runtime state feature. The final detection result is calculated using the following formula: Where R0 is the probability that malicious code exists in the guest virtual machine, w i R represents the weight of the i-th feature. i Let r be the classification accuracy of the i-th feature of the client virtual machine to be tested. i Let 1 represent that the detection result of the i-th feature is malicious.

2. The method for detecting malicious code in a client virtual machine on a cloud platform according to claim 1, characterized in that, Step S1 includes: Step S101: Create and start the customer virtual machine in the cloud platform; Step S102: Save a snapshot of the customer virtual machine as a recovery point, and run normal software and malicious software in the customer virtual machine to simulate the scenarios of normal user use and being invaded by malicious software. S103. Use the memory dump function of the virtualization platform to obtain the memory dump file of the customer's virtual machine; S104. Restore the client virtual machine to the recovery point, run the remaining software, and repeat step S103.

3. The method for detecting malicious code in a client virtual machine on a cloud platform according to claim 1, characterized in that, Step S2 includes: Step S201: Construct the symbol table of the guest operating system; Step S202: Analyze the memory dump file to obtain various running status characteristics of the guest virtual machine during runtime, and save the obtained data in different documents according to categories.

4. The method for detecting malicious code in a client virtual machine on a cloud platform according to claim 3, characterized in that, The guest virtual machine includes Linux system virtual machines and Windows system virtual machines. The type of guest virtual machine is determined. If the guest virtual machine is a Windows system virtual machine, then in step S201, the symbol table is obtained using volatility; if the guest virtual machine is a Linux system virtual machine, then in step S201, the symbol table is obtained using dwarf2json.

5. The method for detecting malicious code in a client virtual machine on a cloud platform according to claim 4, characterized in that, The Linux system virtual machine uses the Ubuntu 16.04 operating system, and the Windows system virtual machine uses the Windows 7 operating system.

6. The method for detecting malicious code in a client virtual machine on a cloud platform according to claim 1, characterized in that, The filtered runtime status features include filescan, netscan, malfind, privs, modules, psxview, pslist, svcscan, thrdscan, and mutantscan.

Images