A malicious code detection method for power enterprise security protection

Abstract

The present application relates to a kind of malicious code detection methods for electric power enterprise security protection, by the instruction set generated by system program to the sampling of original data set, according to the characteristics of instruction set in data set, by analyzing the content of sample, the relationship between samples extracts malicious feature, using the algorithm of taint propagation analysis to the taint marking of instruction set, constructs behavior dependency graph, and to behavior dependency graph enhancement processing, constructs positive and negative example sample, according to the comparison learning of the positive and negative sample data obtained, generate enough sample, then the new sample data generated with original data set form enhanced data set, input with the feature extractor of neural network as encoder in contrast learning to learn the representation feature of malicious code of enhanced data set, finally by back propagation algorithm to the loss function of neural network parameter optimization, save the optimal model of training and detect identification of malicious code.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a malicious code detection method for security protection of a power enterprise. BACKGROUND

[0002] With the improvement of the automation level of the power system, the enrichment of functions, the extension of the coverage range of the dispatching data network, and the increase of users, the information security threats of the power system are increasingly diversified. In the power industry, high-risk vulnerabilities, medium-risk vulnerabilities, and low-risk vulnerabilities account for 21%, 55%, and 24%, respectively. Attackers can obtain control permissions of the power industrial control end, arbitrarily modify the states of components such as switches, interrupt and interfere with normal power supply services, and launch attacks on the upper-level network and horizontal network through the industrial control end as a stepping stone to control a larger range of power supply systems, causing serious consequences. The power system is an independent network and is physically isolated from the public Internet of Things. The malicious code library of the Windows operating system cannot update viruses in a timely manner, and other types of operating systems do not have malicious code protection functions. Malicious code attacks can cause communication interruption, data loss, signal errors, system crashes, and other problems in the power system. Therefore, it is very important to effectively deploy a malicious code protection system in the power enterprise network system independently.

[0003] Malicious code detection in enterprise security protection is one of the challenges in the field of network security. The malicious codes collected in real scenarios are mostly distributed unevenly. Current methods for malicious code detection and identification mainly include static analysis, dynamic analysis, and hybrid analysis. In static identification technology, there are identification technology based on feature codes, malicious code detection technology based on binary summary information, and malicious code detection technology based on reverse analysis. Dynamic analysis methods mainly include function parameter analysis, function call detection, information flow tracking, and instruction tracking. Static analysis is a method of identifying malicious codes without the need for actual operation on special analysis tools or virtual machines. The method of analyzing the behavior of executable files actually running in virtual machines, sandboxes, and other environments is called dynamic analysis. A hybrid detection method is proposed by combining the advantages and disadvantages of static and dynamic malicious code detection.

[0004] Due to the rapid development of malicious code detection technology, the current method of combining deep learning with malicious code analysis has greatly improved the efficiency and accuracy of malicious code detection. However, from the current theoretical and practical perspectives, these malicious code detection methods have the following problems:

[0005] (1) The method of static code analysis mainly disassembles the executable program, analyzes and extracts the characteristic information of the code. Static analysis can comprehensively analyze the code, and does not need to execute the code, so the damage to the system is small. However, the analyzed code may not be the executed code and may not be the final executed code, and the static analysis has strong dependence on the disassembly technology. The method of using static code analysis has the advantages of fast detection speed and high efficiency, but is easily affected by the obfuscation technology.

[0006] (2) The method of dynamic code analysis mainly analyzes the code during the execution of the code, which is to analyze the actually executed code. The dynamic analysis of the execution process can only obtain single path behavior, but malicious code exists in multiple path execution.

[0007] In recent years, with the development of deep learning technology, how to combine deep learning technology with malicious code detection technology has greatly improved the accuracy of malicious code detection, and has become a problem concerned by technical personnel in the field. SUMMARY

[0008] In view of the above situation, in order to overcome the defects of the prior art, the purpose of the present application is to provide a malicious code detection method for power enterprise security protection, which can effectively improve the efficiency and accuracy of power enterprise malicious code detection.

[0009] The technical scheme adopted by the present application is:

[0010] A malicious code detection method for power enterprise security protection, comprising the following steps:

[0011] Step 1, performing a taint propagation analysis on the collected instruction set of system running, using the taint propagation analysis on the data in the instruction set of system running to analyze the data dependency relationship between malicious codes, and obtaining accurate data flow propagation information;

[0012] Step 2, constructing a behavior dependency graph based on the result of the taint propagation analysis in step 1, and obtaining a dependency graph data set;

[0013] Step 3, transforming and processing the constructed behavior dependency graph data set, constructing positive and negative example samples, and combining the original data set to form an enhanced data set;

[0014] Step 4, performing standardization processing on the enhanced data set constructed in step 3, that is, converting the data to a three-dimensional spherical surface with a unit length of 1; that is, uniformly converting the length factor in the data to 1 in the projection space, and mapping the data to a unit hyperspherical surface with a length of 1, so as to improve the stability of the model and increase its linear separability in the projection space;

[0015] Step 5, constructing a mapping function, calculating the similarity between the mapped samples, respectively projecting into the row and column space for instance and class contrast learning;

[0016] Step 6, feature extraction, the graph convolutional neural network feature extractor traverses each sample in the enhanced dataset (training set), adjusts the weights and biases of the neural network, so that the neural network learns the representation features of the graph data at a deeper level;

[0017] Step 7, constructing a loss function, calculating the gradient by the back propagation algorithm, obtaining the distance between positive and negative example sample data and original data, so that the positive example sample is infinitely close to the original data, and the negative example sample is far away from the original data;

[0018] Step 8, back propagation training, gradient calculation by back propagation algorithm, adjusting parameters, minimizing loss function, optimizing model, so that the generated data and the original data get the ideal similar probability, which can not only continuously optimize the entire encoder, but also reduce the error rate of the classification algorithm;

[0019] Step 9, save the trained optimal model to detect and identify malicious code, use deep graph neural network to learn the representation features of graph data, use standardization layer to initialize the parameters of scale and bias layer, after initialization, the scale and bias of graph data are taken as trainable parameters independent of data, after training, the soft label of each sample is calculated directly, and the class with the maximum probability is taken as the prediction result, realizing the detection of malicious code class.

[0020] Preferably, step 1 is specifically: using the data dependency relationship between system calls executed by malicious code obtained by using the taint propagation analysis in the instruction set to describe the behavior characteristics of the malicious code, and obtaining accurate data flow propagation information.

[0021] Preferably, the behavior dependency graph obtained in step 2 is represented as G={in,out,node,control,data,code};

[0022] Wherein: in represents the entry node of the graph; out represents the exit node of the graph; node represents other nodes; control represents control dependency edge; data represents data dependency edge; code represents the access instruction record in the execution process of the graph;

[0023] The entry node of the graph is the return value of the sensitive call operation as the taint source in the taint propagation analysis, and multiple graphs are generated in the analysis process, and the set of graphs is denoted as T={G1,G 2,......, G n}, n is N; the taint propagation analysis of the malicious code is to generate a dependency graph G of a system call generating a taint, and then update the shadow memory record to the starting address, length, state and type information of the current taint to obtain a dependency graph dataset, facilitating subsequent analysis of each instruction executed by the malicious code.

[0024] Preferably, the step 3 is specifically: performing augmentation processing on a feature space of the behavior dependency graph, performing node and edge operations on the data of the behavior dependency graph, the behavior dependency graph being composed of nodes and edges, automatically constructing sub-views according to the attributes of the nodes and edges through contrast learning of the self-supervised learning algorithm, and deleting and randomly adding nodes and edges to the graph data when constructing the graph to obtain new sub-graph data, so as to construct positive example samples; in the contrast learning, a plurality of negative examples are randomly selected in the negative example queue, the more the number of negative examples, the better the training effect of the model, and the sub-graph data obtained under different views has a complementary effect, so that the graph data obtained from the two views through contrast learning can obtain rich global and local information encodings at the same time, and finally the obtained positive and negative example samples and the original behavior dependency graph dataset are jointly composed into an enhanced dataset.

[0025] Preferably, the step 5 is specifically: converting the data of the enhanced dataset to a unit length of 1 on a three-dimensional spherical surface.

[0026] The method of the present application samples the original dataset of the instruction set generated by the system program, extracts malicious features according to the characteristics of the instruction set in the dataset, marks the instruction set with a taint propagation analysis algorithm, constructs a behavior dependency graph, and performs enhancement processing on the behavior dependency graph to construct positive and negative example samples, compares and learns according to the obtained positive and negative sample data, generates enough samples, and then combines the newly generated sample data with the original dataset to form an enhanced dataset, inputs the enhanced dataset into a feature extractor of a contrast learning neural network encoder to learn the representation features of the malicious code, and finally optimizes the loss function of the neural network through a back propagation algorithm, saves the trained optimal model for malicious code detection and recognition. Through practical application, the method of the present application not only does not need data labeling, but also has a classification effect far higher than that of existing artificial intelligence malicious code detection and recognition methods.

[0027] Compared with the existing technology, the present application has the following advantages:

[0028] (1) The present application extracts the call information between malicious codes by using a contrast learning algorithm, which is a self-supervised learning algorithm, can automatically cluster, and uses the rich information of the data itself to guide the representation learning process without label information. Compared with the method of supervised learning which needs to label data, the method of the present application can significantly improve the efficiency of malicious code detection of power enterprises.

[0029] (2) In the face of high-dimensional classification problems, a contrast learning algorithm is used to automatically construct positive and negative example samples according to rules, to learn the prior knowledge distribution from the enhanced data set, and to obtain a pre-training model. Compared with methods such as reinforcement learning, the method requires label information and has a small training cost. In view of the current explosive growth of data, it has a high application prospect in power enterprises.

[0030] (3) In the present application, the encoder learns the node-level features and the graph-level features, and then combines the two features to obtain total features that include both local features and global features, so that the method can fully retain information and learn comprehensive multi-level data features. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 is the overall flowchart of the method of the present application;

[0032] Figure 2 is the flowchart of the taint propagation analysis method of the present application;

[0033] Figure 3 is the contrast learning principle diagram of the present application. DETAILED DESCRIPTION

[0034] The present application is further described in detail in combination with the specific embodiments of the accompanying drawings.

[0035] As shown in Figure 1 , in view of the weak protection capability of power enterprise security protection, the present application proposes a malicious code detection method suitable for enterprise security protection, analyzes the instruction set generated by the system program, uses a taint propagation analysis algorithm to mark the instruction set according to the characteristics of the data and the instruction set, constructs a behavior dependency graph, performs enhancement processing on the constructed behavior dependency graph, constructs positive and negative example samples, compares the positive and negative example sample data, generates enough samples, and then forms an enhanced data set with the original data set; then, a differentiable classification algorithm is used to estimate the probability by calculating the class mean, and a negative feedback gradient descent algorithm is used to continuously optimize the classification algorithm and the feature extractor, to perform feature extraction, model training and parameter optimization, and finally a cross-entropy function classification algorithm is used for classification, to realize the detection and classification of malicious codes. The specific method is as follows:

[0036] Step 1, sample from the original data set (instruction set of system running) and perform taint propagation analysis (flowchart as shown in Figure 2The data dependency between malicious codes is analyzed, and accurate data flow propagation information is obtained. The taint analysis refers to whether the data introduced by the taint source can be directly propagated to the taint sink without harmless processing. If yes, it indicates that there is a security problem, otherwise, it indicates that there is no security problem. Specifically, the malicious code program is marked and processed into a form of a triple <taint source, taint sink, harmless processing>, and the taint propagation analysis mainly includes three stages: obtaining the taint source and sink, taint propagation analysis, and harmless processing. Through the taint propagation analysis, the data dependency, control dependency and other instruction information between system calls executed by the malicious code are obtained to further describe the behavior characteristics of the malicious code.

[0037] Step 2, the dependency relationship between the malicious codes obtained from step 1 is used to construct a behavior dependency graph, and the behavior dependency graph is represented as G={in, out, node, control, data, code}, in represents the entry node of the graph, out represents the exit node of the graph, node represents other nodes, control represents the control dependency edge, data represents the data dependency edge, and code represents the access instruction record in the execution process of the graph. The entry of the graph is the return value of the sensitive call operation as the taint source in the taint propagation analysis, and multiple graphs are often generated in the analysis process, and the set of graphs is denoted as T={G1, G 2,......, G n}, n∈N; the analysis of the malicious code is to generate a dependency graph G from a system call that generates a taint, and then update the shadow memory record to the start address, length, state and type information of the current taint to obtain a dependency graph data set, which facilitates subsequent analysis of each instruction executed by the malicious code.

[0038] Step 3, the behavior dependency graph obtained is subjected to data enhancement processing before being input into the graph convolutional neural network contrast learning model. Positive and negative example samples are constructed. The feature space of the behavior dependency graph is augmented by the present application, and the nodes and edges of the behavior dependency graph data are operated. The behavior dependency graph is composed of nodes and edges, and the contrast learning is a self-supervised learning algorithm, so the model automatically constructs a sub-view according to the attributes of the nodes and edges. When constructing the graph, the nodes and edges of the graph data are deleted and randomly added, and new sub-graph data is obtained to construct positive example samples. In the contrast learning, a certain number of negative examples are randomly selected from the negative example queue, and the negative examples are introduced, which helps to uniformly distribute all instances in the projection space. The more the number of negative examples, the better the training effect of the model. The sub-graph data obtained under different views has a complementary effect, so the graph data obtained from two views can simultaneously obtain rich global and local information encoding through contrast learning, and finally the obtained positive and negative example samples and the original data set are jointly composed into an enhanced data set.

[0039] Step 4, data standardization: in order to improve the stability of the model and increase its linear separability in the projection space, the enhanced enhanced data set is standardized, that is, the length factor in the data is uniformly converted to 1 in the projection space, that is, the data is mapped to a unit hypersphere with a length of 1. This technology is prior art.

[0040] Step 5, constructing a mapping function: calculating the similarity between the mapped samples, respectively projecting into the row and column spaces for instance and category contrast learning, the mapping function, that is, the Encder projection function, encodes the input data and then maps it into the projection space of GCN.

[0041] Step 6, feature extraction.

[0042] According to the mapping function constructed in step 5, the graph data gets a mapping vector in the GCN encoder.

[0043] The GCN layer is a special encoder for learning the features of graph data, which is represented as follows: And δ(SXθ), since it is a nonlinear encoder, it needs a nonlinear activation function δ to activate, is the local feature provided by the adjacency matrix, S is the global feature provided by the diffusion matrix, θ is the weight coefficient, and X is the feature matrix of the graph data; then the learned feature representation is input into the multilayer perception neural network as follows:

[0044]

[0045] Through the above function, the node representation set H α ,h β is obtained. In order to obtain the graph-level representation, the total representation of the nodes of each graph convolution layer is spliced, and in order to ensure the consistency of the dimensions of the node representation and the graph representation, the total representation is input into a single-layer feedforward network to obtain:

[0046]

[0047] The graph-level representation obtained by the above steps is input into the mapping head of the multilayer perception neural network, as shown in the following formula:

[0048]

[0049] Finally, the graph data representation h α ,h β is obtained. Finally, the total representation, that is, the total feature extracted, is obtained by aggregating the graph-level representation and the node-level representation:

[0050] Step 7, constructing a loss function.

[0051] Step 6 yields the total features of the data representation, which are used to train the encoder and achieve the desired classification effect on malicious code.

[0052] This invention employs the Infomax loss function to maximize the mutual information function, as shown in the following formula:

[0053]

[0054] Where D is the number of graphs and g is the number of nodes. The nodes are represented in graphs i and g from the perspectives of α and β, θ, ω, These are the parameters of the neural network. To obtain the desired discrimination result, the MI discriminator selects a conditional distribution p(g)... t+k |c t Take a positive sample g i From the specified distribution p(g) t+k Take N-1 negative samples.

[0055] g i It is a positive sample, and i = t + k, where c represents the variable representing the relationship between the data. t This represents the data before t, accurately identifying the positive sample g. t+k The probability of N-1 negative samples is as follows:

[0056]

[0057] In order to adjust g t and c t The joint probability p(x,c) can be obtained from the density ratio, which gives the following formula:

[0058]

[0059] To optimize the above equation, we can transform it into the corresponding cross-entropy loss function as follows:

[0060]

[0061] Minimizing the loss function is equivalent to maximizing g. t+k and c t The lower bound of mutual information between them. Finally, the numerator of the loss function refers to the positive sample pairs (g... t+k ,c t ), the denominator is the negative sample pair (g) j ,c t By optimizing the loss function, we can maximize the mutual information between positive samples and minimize the mutual information between negative samples, so that the positive samples are infinitely close to the original data and the negative samples are far away from the original data.

[0062] Step 8: Model backpropagation training.

[0063] In order to minimize the loss function, the application optimizes the loss function using the back propagation algorithm until an ideal model is trained. By randomly initializing the parameters to be solved, all samples of the model are tested, the loss value is calculated, the model parameters are derived using the model loss value, and finally the parameters such as weight and bias are adjusted based on the gradient until the loss function is minimized.

[0064] Step 9, detecting and identifying the malicious code.

[0065] The original code instruction set is expanded to enhanced data through the above powerful data analysis and learning, so as to obtain a data set with positive and negative example sample pairs. The enhanced data set is input into a feature extractor of a contrast learning with a graph neural network as an encoder to learn the representation features of the malicious code. Finally, the loss function of the neural network is optimized by the back propagation algorithm, and the optimal model trained is saved for detecting and identifying the malicious code. The final experimental results show that the method of the application does not need data labeling, and the classification efficiency is much higher than that of the existing artificial intelligence malicious code detection and identification method.

Claims

1. A method for detecting malicious code for security protection of a power enterprise, characterized by, The method comprises the following steps: Step 1, performing a taint propagation analysis on the collected instruction set of system operation; Step 2, constructing a behavior dependency graph based on the result of the taint propagation analysis in step 1 to obtain a dependency graph data set; Step 3, transforming the constructed behavior dependency graph data set, constructing positive and negative example samples, and combining the original data set to form an enhanced data set; Step 4, standardizing the enhanced data set constructed in step 3; Step 5, constructing a mapping function, calculating the similarity between the mapped samples, and projecting them into the row and column spaces for instance and category comparison learning; Step 6, feature extraction, the graph convolutional neural network feature extractor traverses each sample in the enhanced data set, adjusts the weights and biases of the neural network, and enables the neural network to learn the representation features of the graph data at a deeper level; Step 7, constructing a loss function, calculating the gradient through a backpropagation algorithm, obtaining the distance between the positive and negative example sample data and the original data, and making the positive example sample infinitely close to the original data and the negative example sample infinitely far away from the original data; Step 8, backpropagation training, gradient calculation through a backpropagation algorithm, parameter adjustment, loss function minimization, and model optimization; Step 9, saving the trained optimal model to detect and identify malicious code; The step 3 specifically comprises augmenting the feature space of the behavior dependency graph, performing node and edge operations on the behavior dependency graph data, and automatically constructing sub-views based on the attributes of the nodes and edges through a self-supervised learning algorithm. In the graph construction, nodes and edges are deleted and randomly added to obtain new sub-graph data, thereby constructing positive example samples. In the contrast learning, a certain number of negative examples are randomly selected from the negative example queue. The more negative examples, the better the training effect of the model. The sub-graph data obtained from different views has a complementary effect. Therefore, the contrast learning of the graph data obtained from two views can simultaneously obtain rich global and local information encoding. Finally, the obtained positive and negative example samples and the original behavior dependency graph data set are combined to form an enhanced data set.

2. The method of claim 1, wherein the method further comprises: The step 1 specifically comprises obtaining the data dependency relationship between system calls executed by the malicious code through taint propagation analysis on the data in the instruction set, and then describing the behavior characteristics of the malicious code to obtain accurate data flow propagation information.

3. The method of claim 1, wherein the method further comprises: The behavior dependency graph obtained in step 2 is represented as G={in,out,node,control,data,code}; Wherein: in represents the entry node of the graph; out represents the exit node of the graph; node represents other nodes; control represents control dependency edges; data represents data dependency edges; code represents access instruction records during the execution of the graph; The entry node of the graph is the return value of the sensitive call operation as the source of the taint in the taint propagation analysis, multiple graphs are generated in the analysis process, and the set of graphs is recorded as T = {G1, G 2,......, G n}, n ∈ N; the taint propagation analysis of malicious code generates a dependency graph G with a system call that generates a taint, then updates the shadow memory record to the start address, length, state and type information of the current taint, obtains the dependency graph data set, and facilitates subsequent analysis of each instruction executed by the malicious code.

4. The method of claim 1, wherein the method further comprises: The step 5 specifically comprises converting the data of the enhanced data set into a unit length of 1 on a three-dimensional spherical surface.

5. The method for malicious code detection for power utility security according to claim 1, wherein: The step 9 is specifically: using a deep graph neural network to learn the representation features of the graph data, using a standardization layer to initialize the parameters of the scale and bias layer; after initialization, the graph data, taking the scale and bias of the graph data as trainable parameters independent of the data, after training, the malicious code category detection is realized by directly calculating the soft labels of each sample and taking the category with the maximum probability as the prediction result.

Images