Network virus identification method, device, computer equipment and storage medium

Abstract

The present application provides a method, device, computer equipment and storage medium for identifying network viruses, which relates to the field of computing security technology and is used to improve the efficiency and accuracy of identifying network viruses. The method mainly includes: determining the original features and virus labels corresponding to various types of virus samples; processing the original features; training the processed original features and the virus labels to obtain a virus classification and identification model; extracting some parameters of the virus classification and identification model to generate a feature fusion model; inputting the target program code into the feature fusion model to obtain a specific feature vector of the target program code; determining the cluster corresponding to the specific feature vector of the target program code, and determining whether the target program code belongs to a network virus according to the determined cluster.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, computer equipment and storage medium for identifying network viruses. Background Art

[0002] Malicious code identification objectively solves a complex, ultra-large-scale network virus classification and discrimination task. The traditional method of using manual analysis or automatic extraction of discriminative feature fragments is difficult to provide sufficient generalization ability to discover unknown samples and has a certain lag.

[0003] Meanwhile, the traditional method of analyzing and detecting network viruses is to manually analyze and debug the virus, extract a feature with special meaning based on its behavior pattern, and then use the feature to detect the virus. However, the efficiency and accuracy of manual detection of network viruses are low. Summary of the invention

[0004] The embodiments of the present application provide a method, apparatus, computer device and storage medium for identifying network viruses, which are used to improve the efficiency and accuracy of identifying network viruses.

[0005] An embodiment of the present invention provides a method for identifying a network virus, the method comprising:

[0006] Determine the original features and virus labels corresponding to various types of virus samples;

[0007] Processing the original features;

[0008] Performing model training on the processed original features and the virus labels to obtain a virus classification and recognition model;

[0009] Extracting some parameters of the virus classification and recognition model to generate a feature fusion model;

[0010] Inputting the target program code into the feature fusion model to obtain a specific feature vector of the target program code;

[0011] The cluster corresponding to the specific feature vector of the target program code is determined, and whether the target program code belongs to a network virus is determined according to the determined cluster.

[0012] An embodiment of the present invention provides a network virus identification device, the device comprising:

[0013] A determination module, used to determine the original features and virus labels corresponding to various types of virus samples;

[0014] A preprocessing module, used for processing the original features;

[0015] A training module is used to perform model training on the processed original features and the virus labels to obtain a virus classification and recognition model;

[0016] A generation module, used to extract some parameters of the virus classification and recognition model and generate a feature fusion model;

[0017] An acquisition module, used for inputting the target program code into the feature fusion model to obtain a specific feature vector of the target program code;

[0018] The determination module is further used to determine the cluster corresponding to the specific feature vector of the target program code, and determine whether the target program code belongs to a network virus according to the determined cluster.

[0019] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the above-mentioned network virus identification method is implemented.

[0020] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for identifying network viruses is implemented.

[0021] A computer program product includes a computer program, and when the computer program is executed by a processor, the computer program implements the above-mentioned method for identifying network viruses.

[0022] The present invention provides a method, device, computer equipment and storage medium for identifying network viruses, which determine the original features and virus labels corresponding to various types of virus samples, process the original features, perform model training on the processed original features and virus labels, and obtain a virus classification and identification model; extract some parameters of the virus classification and identification model, and generate a feature fusion model; input the target program code into the feature fusion model to obtain a specific feature vector of the target program code; determine the cluster corresponding to the specific feature vector of the target program code, and determine whether the target program code belongs to a network virus according to the determined cluster. That is, the present invention uses the feature fusion model to realize the fusion of various types of features, that is, to obtain a specific feature vector, which is a fusion expression of the original redundant feature set of the sample, and can simplify the original feature scale, unify the feature form, and standardize the feature structure under the premise of retaining the specificity of the original feature, and then perform clustering calculation according to the specific feature vector to determine whether the target program code belongs to a network virus, thereby improving the efficiency and accuracy of identifying network viruses through the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1A flow chart of a method for identifying network viruses provided in this application;

[0024] Figure 2 A model structure diagram provided for this application;

[0025] Figure 3 A flowchart of another method for identifying network viruses provided by this application;

[0026] Figure 4 A flow chart of another method for identifying network viruses provided by this application;

[0027] Figure 5 A schematic diagram of the structure of a network virus identification device provided in this application.

[0028] Figure 6 A schematic diagram of a computer device provided for this application. DETAILED DESCRIPTION

[0029] In order to better understand the above-mentioned technical scheme, the technical scheme of the embodiments of the present application is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical scheme of the embodiments of the present application, rather than limitations on the technical scheme of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments may be combined with each other.

[0030] Embodiment 1

[0031] See also Figure 1 , is a method for identifying a network virus provided by an embodiment of the present invention, the method specifically comprises steps S101 to S106:

[0032] Step S101, determining original features and virus labels corresponding to multiple types of virus samples respectively.

[0033] Among them, the original features include numerical features, character features, serialization features and graph features. The original features refer to the malicious code feature information extracted from the sample through static and dynamic feature analysis and other means. The original features include static features and dynamic features. Specifically, static features can be obtained through static analysis, and the static features include file format information, file attribute information, string information, binary information, and instruction feature information; dynamic features can be obtained through dynamic analysis, and the dynamic features include local behavior features, network behavior features, API call features, etc., which are not specifically limited in the embodiments of the present invention.

[0034] For the embodiment of the present invention, the virus label is used to indicate the type of virus. In this embodiment, there are multiple virus labels corresponding to the number of virus types. The types of viruses can be divided into categories such as viruses, Trojans, and worms. Each category has many different malicious code families. Each family may have many different variants, and each variant has many different files. The different sample categories here can be any different malicious code (sample program code) variants.

[0035] It should be noted that the virus label in this embodiment can not only indicate the corresponding virus type, but also indicate the form of expression of the corresponding virus, which can be a self-extracting package, a shell, etc. This embodiment does not specifically limit its form of expression.

[0036] Step S102, processing the original features.

[0037] The processing of the original features includes: normalizing the numerical features to obtain target numerical values, and converting the character features, serialization features and graph features into corresponding first vectors, second vectors and third vectors.

[0038] Specifically, character features and serialized features can be converted into word vectors (i.e., the representation of the first vector and the second vector) and graph features can be converted into graph vectors (i.e., the third vector) through methods such as Embedding.

[0039] Step S103: Perform model training on the processed original features and virus labels to obtain a virus classification and recognition model.

[0040] Specifically, in this embodiment, model training can be performed based on the processed original features consisting of the first vector, the second vector, the third vector and the target value, as well as the virus label, to obtain a virus classification and recognition model.

[0041] In this embodiment, the first vector, the second vector, the third vector and the target value can be directly concatenated to obtain the processed original feature. It should be noted that this embodiment does not limit the order of concatenation.

[0042] Step S104: extract some parameters of the virus classification and recognition model to generate a feature fusion model.

[0043] Specifically, extracting some parameters of the virus classification and recognition model includes: removing the output layer in the virus classification and recognition model, extracting the remaining model parameters of the virus classification and recognition model; using the input-specific feature vector of the output layer as the output of the feature fusion model; and using the remaining model parameters to generate a feature fusion model.

[0044] The constructed virus classification and recognition models include but are not limited to CNN structure network, RNN structure network, and Bert structure network. Figure 2 As shown in the figure, the model has a multi-layer structure, with the original features of the samples preprocessed by normalization, embedding and other methods as the input of the model, the corresponding virus labels as the output for model training, and the model parameters are updated until the model is stable. Then, the model parameters in the model are extracted to generate a feature fusion model, the output layer in the virus classification and recognition model is removed, and the specific feature vector input to the output layer is used as the output of the feature fusion model.

[0045] Among them, the specific feature vector has a fixed form and value range. It is a fusion expression of the original redundant feature set of the sample (numerical features, character features, serialized features and graph features). It can simplify the original feature scale, unify the feature form, and standardize the feature structure while retaining the specificity of the original features. Then, clustering calculations can be performed based on the specific feature vector to determine whether the target program code belongs to a network virus.

[0046] Step S105, inputting the target program code into the feature fusion model to obtain a specific feature vector of the target program code.

[0047] In this embodiment, since the output layer in the classification recognition model has been removed, after the target program code is input into the feature fusion model, a feature vector specific to the target program code can be obtained.

[0048] Step S106, determining the cluster corresponding to the specific feature vector of the target program code, and determining whether the target program code belongs to a network virus according to the determined cluster.

[0049] The clusters are obtained by clustering the specific feature vectors corresponding to the samples. Each cluster corresponds to a virus label, and the samples in the cluster belong to the type of virus corresponding to the virus label. In this embodiment, the Hamming distance can be used as a feature distance metric, and the specific feature vectors corresponding to each sample are used as input to perform clustering calculations to obtain multiple clusters. Then, according to the distribution of the number of virus labels corresponding to the specific feature vectors in the clusters, the virus label with the largest proportion is selected as the virus label of the cluster. The virus label can be the name of the malware family to which the sample belongs, whether it is a self-extracting package, whether it is a shell, whether it is an APT tool, and other marking information.

[0050] The present invention provides a method for identifying network viruses, which includes determining original features and virus labels corresponding to various types of virus samples, processing the original features, and training the processed original features and virus labels to obtain a virus classification and identification model; extracting some parameters of the virus classification and identification model to generate a feature fusion model; inputting a target program code into the feature fusion model to obtain a specific feature vector of the target program code; determining a cluster corresponding to the specific feature vector of the target program code, and determining whether the target program code belongs to a network virus according to the determined cluster. That is, the present invention uses a feature fusion model to achieve the fusion of various types of features, that is, to obtain a specific feature vector, which is a fusion expression of the original redundant feature set of the sample, and can simplify the original feature scale, unify the feature form, and standardize the feature structure under the premise of retaining the specificity of the original features, and then perform clustering calculation according to the specific feature vector to determine whether the target program code belongs to a network virus, thereby improving the efficiency and accuracy of identifying network viruses through the present invention.

[0051] Embodiment 2

[0052] See also Figure 3 , is a method for identifying a network virus provided by an embodiment of the present invention, the method specifically comprises steps S301 to S305:

[0053] Step S301, determining original features and virus labels corresponding to multiple types of virus samples respectively.

[0054] After determining each type of feature in the original feature, this embodiment needs to perform corresponding preprocessing according to the feature value type corresponding to the original feature. The feature value type refers to the original representation form of the extracted feature. For example, for a person, the feature value type of his height and weight is a numerical value, the feature value type of gender is a Boolean variable, and the fingerprint is a picture. Specifically, this embodiment can divide the original features into numerical features (number of file resources, number of file sections), character features, serialization features (disassembled instruction sequence) and graph features (system call flow chart), Boolean features (whether there is an executable section), etc. according to the data type of the original features in the sample.

[0055] Step S302, calculating the hash codes corresponding to the numerical features, character features, serialized features and graph features in the original features.

[0056] In an optional embodiment provided by the present invention, calculating the hash codes corresponding to the numerical feature, the character feature, the serialization feature and / or the graph feature respectively includes:

[0057] Step S3021, performing hash calculation on the numerical feature and the character feature to obtain hash codes corresponding to the numerical feature and the character feature respectively.

[0058] Specifically, the feature values ​​of character features (such as IP, domain name) are directly hashed to obtain the hash codes corresponding to the character features. For numerical features (such as the number of PE file sections, the number of resource files), the corresponding hash codes can be directly hashed according to their feature names, or the corresponding hash codes can be hashed according to the feature value names and the corresponding feature values, which are not specifically limited in this embodiment.

[0059] For example, if the feature value of a numerical feature is named "number of called files" and the feature value is 50, then a hash calculation can be performed on the "number of called files" to obtain the corresponding hash code, or a hash calculation can be performed based on the "number of called files" combined with the feature value 50 to obtain the corresponding hash code.

[0060] Furthermore, before calculating the hash code corresponding to the numerical feature, this embodiment may perform normalization processing on the numerical feature, and then perform hash calculation based on the normalized numerical feature to obtain the corresponding hash code.

[0061] Step S3022: Convert each feature in the serialized features into a feature vector of fixed length.

[0062] The length of the feature vector is the same as the length of the hash code.

[0063] Step S3023, adding the feature vectors of each feature in the serialized features to obtain a target feature vector.

[0064] Step S3024: Determine a hash code corresponding to the serialization feature according to the target feature vector.

[0065] Among them, determining the hash code corresponding to the serialization feature according to the target feature vector includes: obtaining the size of the value of each vector in the target feature vector; resetting the value of the vector whose value is greater than 0 in the target feature vector to 1, and resetting the value of the vector whose value is less than or equal to 0 to 0, to obtain the hash code corresponding to the serialization feature.

[0066] For example, the serialization feature is a disassembled instruction sequence, and its sequence content is (lea, mov, mov, cmp, jz). The serialization feature is embedded to obtain the vector of each feature in the serialization feature, that is, the fixed-length (128)-dimensional vector representation corresponding to lea, mov, mov, cmp, and jz in (lea, mov, mov, cmp, jz) is obtained. Each vector of the serialization feature is accumulated to obtain the fixed-length vector of the sequence feature (lea, mov, mov, cmp, jz). Then each value in the vector is truncated (that is, if the value is greater than 0, it is 1, and if it is less than or equal to 0, it is 0), so as to obtain a binary sequence of fixed length (128) bits, that is, the hash code corresponding to the serialization feature is obtained.

[0067] Graph features can be represented as a collection of points (functions or API calls) and edges (associations). These data can be vectorized into graph points and edges through the Embedding method.

[0068] Step S303, determining a specific feature vector corresponding to the sample according to the hash codes corresponding to the numerical features, character features, serialization features and graph features respectively.

[0069] Specifically, this implementation can add the hash codes corresponding to the numerical features, character features, serialized features, and graph features, respectively, and determine the result of the addition as a specific feature vector corresponding to the sample.

[0070] In an optional embodiment provided by the present invention, determining the specific feature vector corresponding to the sample according to the hash codes respectively corresponding to the numerical feature, the character feature, the serialization feature and the graph feature includes: determining the weight values ​​respectively corresponding to the numerical feature, the character feature, the serialization feature and the graph feature; performing weighted calculation on the hash codes respectively corresponding to the numerical feature, the character feature, the serialization feature and the graph feature to obtain the specific feature vector corresponding to the sample.

[0071] In an embodiment of the present invention, the weight values ​​corresponding to numerical features, character features, serialized features and graph features can be determined by: normalizing the numerical features to obtain corresponding weight values; determining the weight values ​​corresponding to the character features by using the term frequency-inverse file frequency TF-IDF algorithm; the weight values ​​corresponding to the serialized features and graph features are pre-set. Specifically, for character features or Boolean features, the weights are calibrated using the TF-IDF method by counting the frequency TF of the occurrence of feature values ​​and the frequency IDF of the occurrence of feature values ​​in the entire sample set; for the Embedding hash code obtained for the serialized feature, the pre-calibrated empirical weight is used as the weight of the corresponding hash code.

[0072] In addition, the method for determining the weight values ​​corresponding to the numerical features, character features, serialized features and graph features respectively can also be: combining the numerical features, the character features, the serialized features and the graph features to obtain summary features; inputting the summary features into the weight recognition model to obtain the weight values ​​corresponding to each feature respectively, the weight recognition model is trained based on the summary feature samples and the weight values ​​corresponding to each feature in the summary feature samples, and the weight value of each feature is determined based on the TF-IDF algorithm.

[0073] Specifically, the hash codes corresponding to the numerical feature, the character feature, the serialized feature and the graph feature are combined to obtain a summary feature, and then the summary feature is input into a weight recognition model to obtain the weight value corresponding to each feature.

[0074] Step S304: perform clustering calculations on the specific feature vectors and virus labels corresponding to the samples according to a clustering algorithm to obtain a plurality of clusters.

[0075] Step S305 , determining the cluster corresponding to the specific feature vector of the target program code, and determining whether the target program code is a network virus according to the determined cluster.

[0076] Among them, identifying whether the target program code belongs to a network virus according to multiple clustering clusters includes: obtaining the original features of the target program code; determining the specific feature vector corresponding to the original features of the target program code; determining whether the specific feature vector of the target program code belongs to a clustering cluster through the clustering algorithm; if the specific feature vector of the target program code belongs to a clustering cluster, determining it as a network virus corresponding to the target program code according to the clustering label corresponding to the clustering cluster, and the clustering label is used to indicate the virus type of the corresponding clustering cluster; if the specific feature vector of the target program code does not belong to a clustering cluster, determining that the target program code does not belong to a network virus.

[0077] For example, if the target program code is searched by K nearest neighbors, and the maximum effective distance threshold is set to 6 and K is 20, then the samples with virus labels whose distance between specific feature vectors is less than 6 are valid neighbors. A total of 100 valid neighbors are found, and their distances range from 0 to 5. The 100 neighbors are arranged from small to large in distance, and the nearest 20 are selected. Then the virus labels of these 20 samples themselves (sample family, whether it is a package, whether it is a shell) are voted to give a judgment result (19 out of 20 are marked as Trojans, 1 is marked as a worm, all are marked as not shelled, and all are marked as not self-extracting packages), then the target program code is judged to be a Trojan, a non-sub-extracting package, and a non-shelled file.

[0078] The present invention provides a method for identifying network viruses, which determines the original features and virus labels corresponding to samples of multiple virus types, the original features including numerical features, character features, serialized features and graph features; calculates the hash codes corresponding to each feature in the original features; determines the specific feature vector corresponding to the sample according to the hash codes corresponding to all features; performs clustering calculations on the specific feature vectors and virus labels corresponding to the sample according to a clustering algorithm to obtain multiple cluster clusters; finally determines the cluster cluster corresponding to the specific feature vector of the target program code, and determines whether the target program code belongs to a network virus according to the determined cluster cluster. That is, the present invention utilizes the specific feature vector fusion technology to achieve feature dimension reduction and formatted expression while retaining the sample specific information in the multi-source features to a great extent, and then performs clustering calculations according to the specific feature vectors to determine whether the target program code belongs to a network virus, thereby improving the efficiency and accuracy of identifying network viruses through the present invention.

[0079] Embodiment 3

[0080] See also Figure 4 , is another network virus identification method provided by an embodiment of the present invention, the method specifically comprises steps S401 to S405:

[0081] Step S401, determining a specific feature vector of the target program code.

[0082] It should be noted that the method for determining the specific feature vector in step S401 of this embodiment is the same as Figure 3 The descriptions of the corresponding steps in are the same and will not be repeated in this embodiment.

[0083] Step S402, based on the specific feature vector of the target program code, obtaining the network virus corresponding to the target program code determined by the clustering algorithm and the network virus corresponding to the target program code determined by the virus library.

[0084] It should be noted that, in this embodiment, the specific implementation method of obtaining the network virus corresponding to the target program code determined by the clustering algorithm according to the specific feature vector of the target program code is similar to Figure 3 The description contents of the corresponding steps are the same and will not be repeated here in this embodiment.

[0085] In this embodiment, based on the specific feature vector of the target program code, a network virus corresponding to the target program code determined by the virus library is obtained, including: calculating the similarity between the specific feature vector of the target program code and various types of virus features in the virus library; and determining the type of virus corresponding to the specific feature vector whose similarity with the specific feature vector in the virus library exceeds a preset value as the network virus corresponding to the target program code.

[0086] The virus database stores virus types corresponding to specific feature vectors of various types of viruses. After acquiring the specific feature vector of the target program code, this embodiment calculates the similarity between the specific feature vector of the target program code and the specific feature vector in the virus database, and finally determines the virus type corresponding to the virus feature in the virus database whose similarity exceeds a preset value as the network virus corresponding to the target program code. The preset value can be set according to actual needs, such as 80%, 85% or 90%, etc., which is not specifically limited in this embodiment.

[0087] For example, the virus database includes virus features of five specific feature vectors, namely virus type 1, virus type 2, virus type 3, virus type 4 and virus type 5. After calculating that the similarity between the specific feature vector corresponding to the target program code and the specific feature vector of virus type 1 is 65%, the similarity between the specific feature vector corresponding to the target program code and the specific feature vector of virus type 2 is 60%, the similarity between the specific feature vector corresponding to the target program code and the specific feature vector of virus type 3 is 90%, the similarity between the specific feature vector corresponding to the target program code and the specific feature vector of virus type 4 is 54%, and the similarity between the specific feature vector corresponding to the target program code and the specific feature vector of virus type 5 is 89%, if the preset value is 85%, it can be determined that virus type 3 and virus type 5 are network viruses corresponding to the target program code.

[0088] Step S403, calculating the probability values ​​of the network viruses determined by the clustering algorithm and the virus database belonging to the same network virus.

[0089] Step S404: determine the network virus with the highest probability value as the network virus corresponding to the target program code.

[0090] For example, in step S402, the network viruses corresponding to the target program code determined according to the virus library are virus type 3 and virus type 5, wherein the similarity of virus type 3 is 90% (i.e., probability value), and the similarity of virus type 5 is 89%; the network viruses corresponding to the target program code determined according to the clustering algorithm are virus type 3 and virus type 2, wherein the probability value of belonging to the cluster where virus type 3 is located is 90%, and the probability value of belonging to the cluster where virus type 2 is located is 20%, then the average of the same network viruses (virus type 3) is obtained, and the corresponding probability value of virus type 3 is 90%, the probability value of virus type 5 is 89%, and the probability value of virus type 2 is 20%, and the network virus with the highest probability value is virus type 3, that is, the virus type of the target program code is determined to be network virus 3.

[0091] The present invention provides a method for identifying network viruses. According to the specific feature vector of the target program code, the network virus corresponding to the target program code determined by a clustering algorithm and the network virus corresponding to the target program code determined by a virus library are obtained, and then the network virus corresponding to the target program code is determined by combining the clustering algorithm and the virus library to further improve the accuracy of network virus identification.

[0092] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0093] In one embodiment, a network virus identification device is provided, and the network virus identification device corresponds to the network virus identification method in the above embodiment. Figure 5 As shown, the functional modules of the network virus identification device are described in detail as follows:

[0094] A determination module 51 is used to determine original features and virus labels corresponding to various types of virus samples;

[0095] A preprocessing module 52, used for processing the original features;

[0096] A training module 53 is used to perform model training on the processed original features and the virus labels to obtain a virus classification and recognition model;

[0097] A generating module 54 is used to extract some parameters of the virus classification and recognition model and generate a feature fusion model;

[0098] An acquisition module 55, used for inputting the target program code into the feature fusion model to obtain a specific feature vector of the target program code;

[0099] The determination module 51 is further used to determine the cluster corresponding to the specific feature vector of the target program code, and determine whether the target program code belongs to a network disease according to the determined cluster.

[0100] In an optional embodiment, the original features include numerical features, character features, serialized features and graph features; the preprocessing module 52 is specifically used to normalize the numerical features to obtain target values, and convert the character features, the serialized features and the graph features into corresponding first vectors, second vectors and third vectors.

[0101] In an optional embodiment, the generating module 54 is specifically configured to:

[0102] Removing the output layer in the virus classification and recognition model, and extracting the remaining model parameters of the virus classification and recognition model;

[0103] Using the input specific feature vector of the output layer as the output of the feature fusion model;

[0104] A feature fusion model is generated using the remaining model parameters.

[0105] In an optional embodiment, the device further comprises: a calculation module 56;

[0106] A calculation module 56, used to calculate the hash codes corresponding to the numerical feature, the character feature, the serialization feature and the graph feature respectively;

[0107] The determination module 51 is further used to determine the specific feature vector corresponding to the sample according to the hash codes corresponding to the numerical feature, the character feature, the serialization feature and the graph feature respectively.

[0108] In an optional embodiment, the determining module 51 is specifically configured to:

[0109] Determine weight values ​​corresponding to the numerical feature, the character feature, the serialization feature, and the graph feature respectively;

[0110] A weighted calculation is performed on the hash codes corresponding to the numerical feature, the character feature, the serialization feature and the graph feature, respectively, to obtain a specific feature vector corresponding to the sample.

[0111] In an optional embodiment, the determination module 51 is specifically configured to:

[0112] Determine whether the specific feature vector of the target program code belongs to a cluster cluster by using the clustering algorithm;

[0113] If the specific feature vector of the target program code has a cluster to which it belongs, the target program code is determined to be a network virus according to a cluster label corresponding to the cluster, wherein the cluster label is used to indicate the virus type of the corresponding cluster;

[0114] If the specific feature vector of the target program code does not belong to any cluster, it is determined that the target program code does not belong to a network virus.

[0115] In an optional embodiment, the calculation module 56 is further used to calculate the similarity between the specific feature vector of the target program code and various types of virus features in the virus library; the virus library stores virus types corresponding to the specific feature vectors of various types of viruses;

[0116] The determination module 51 is further configured to determine the virus type corresponding to the specific feature vector having a similarity with the virus database exceeding a preset value as the network virus corresponding to the target program code.

[0117] In an optional embodiment, the calculation module 56 is further used to obtain the network virus corresponding to the target program code determined by the clustering algorithm and the network virus corresponding to the target program code determined by the virus library; calculate the probability value of the network viruses determined by the clustering algorithm and the virus library belonging to the same network virus;

[0118] The determination module 51 is further configured to determine the network virus with the highest probability value as the network virus corresponding to the target program code.

[0119] The specific definition of the network virus identification device can be found in the definition of the network virus identification method above, which will not be repeated here. Each module in the above device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0120] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for identifying a network virus is implemented.

[0121] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0122] Determine the original features and virus labels corresponding to various types of virus samples;

[0123] Processing the original features;

[0124] Performing model training on the processed original features and the virus labels to obtain a virus classification and recognition model;

[0125] Extracting some parameters of the virus classification and recognition model to generate a feature fusion model;

[0126] Inputting the target program code into the feature fusion model to obtain a specific feature vector of the target program code;

[0127] The cluster corresponding to the specific feature vector of the target program code is determined, and whether the target program code belongs to a network virus is determined according to the determined cluster.

[0128] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0129] Determine the original features and virus labels corresponding to various types of virus samples;

[0130] Processing the original features;

[0131] Performing model training on the processed original features and the virus labels to obtain a virus classification and recognition model;

[0132] Extracting some parameters of the virus classification and recognition model to generate a feature fusion model;

[0133] Inputting the target program code into the feature fusion model to obtain a specific feature vector of the target program code;

[0134] The cluster corresponding to the specific feature vector of the target program code is determined, and whether the target program code belongs to a network virus is determined according to the determined cluster.

[0135] In one embodiment, a computer program product is provided, the computer program product comprising a computer program, the computer program being executed by a processor to implement the following steps:

[0136] Determine the original features and virus labels corresponding to various types of virus samples;

[0137] Processing the original features;

[0138] Performing model training on the processed original features and the virus labels to obtain a virus classification and recognition model;

[0139] Extracting some parameters of the virus classification and recognition model to generate a feature fusion model;

[0140] Inputting the target program code into the feature fusion model to obtain a specific feature vector of the target program code;

[0141] The cluster corresponding to the specific feature vector of the target program code is determined, and whether the target program code belongs to a network virus is determined according to the determined cluster.

[0142] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0143] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0144] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention.

Claims

1. A method for identifying a network virus, characterized in that: The method comprises: Determine the original features and virus labels corresponding to various types of virus samples; Processing the original features; Performing model training on the processed original features and the virus labels to obtain a virus classification and recognition model; Extracting some parameters of the virus classification and recognition model to generate a feature fusion model; Inputting the target program code into the feature fusion model to obtain a specific feature vector of the target program code; Determine the cluster corresponding to the specific feature vector of the target program code, and determine whether the target program code belongs to a network virus according to the determined cluster; The step of extracting some parameters of the virus classification and recognition model to generate a feature fusion model includes: Removing the output layer in the virus classification and recognition model, and extracting the remaining model parameters of the virus classification and recognition model; Using the input specific feature vector of the output layer as the output of the feature fusion model; A feature fusion model is generated using the remaining model parameters.

2. The method according to claim 1, characterized in that The original features include numerical features, character features, serialized features and graph features; The processing of the original features includes: normalizing the numerical features to obtain target numerical values, and converting the character features, the serialized features, and the graph features into corresponding first vectors, second vectors, and third vectors.

3. The method according to claim 2, characterized in that The method further comprises: Calculate the hash codes corresponding to the numerical feature, the character feature, the serialization feature, and the graph feature respectively; A specific feature vector corresponding to the sample is determined according to the hash codes respectively corresponding to the numerical feature, the character feature, the serialization feature and the graph feature.

4. The method according to claim 3, characterized in that The determining, according to the hash codes respectively corresponding to the numerical feature, the character feature, the serialization feature and the graph feature, a specific feature vector corresponding to the sample comprises: Determine weight values ​​corresponding to the numerical feature, the character feature, the serialization feature, and the graph feature respectively; A weighted calculation is performed on the hash codes corresponding to the numerical feature, the character feature, the serialization feature and the graph feature, respectively, to obtain a specific feature vector corresponding to the sample.

5. The method according to any one of claims 1 to 4, characterized in that: The step of determining whether the target program code belongs to a network virus according to the determined clustering clusters includes: Determine whether the specific feature vector of the target program code belongs to a cluster cluster by using the clustering algorithm; If the specific feature vector of the target program code has a cluster to which it belongs, the target program code is determined to be a network virus according to a cluster label corresponding to the cluster, wherein the cluster label is used to indicate the virus type of the corresponding cluster; If the specific feature vector of the target program code does not belong to any cluster, it is determined that the target program code does not belong to a network virus.

6. The method according to claim 5, characterized in that The method further comprises: Calculating the similarity between the specific feature vector of the target program code and the features of various types of viruses in the virus library; the virus library stores the virus types corresponding to the specific feature vectors of various types of viruses; The virus type corresponding to the specific feature vector whose similarity with the virus database exceeds a preset value is determined as the network virus corresponding to the target program code.

7. The method according to claim 6, characterized in that The method further comprises: Acquire the network virus corresponding to the target program code determined by the clustering algorithm, and the network virus corresponding to the target program code determined by the virus library; Calculating the probability value of the network viruses determined by the clustering algorithm and the virus library belonging to the same network virus; The network virus with the highest probability value is determined as the network virus corresponding to the target program code.

8. A network virus identification device, characterized in that: The device comprises: A determination module, used to determine the original features and virus labels corresponding to various types of virus samples; A preprocessing module, used for processing the original features; A training module is used to perform model training on the processed original features and the virus labels to obtain a virus classification and recognition model; A generation module, used to extract some parameters of the virus classification and recognition model and generate a feature fusion model; An acquisition module, used for inputting the target program code into the feature fusion model to obtain a specific feature vector of the target program code; The determination module is further used to determine the cluster corresponding to the specific feature vector of the target program code, and determine whether the target program code belongs to a network virus according to the determined cluster; The step of extracting some parameters of the virus classification and recognition model to generate a feature fusion model includes: Removing the output layer in the virus classification and recognition model, and extracting the remaining model parameters of the virus classification and recognition model; Using the input specific feature vector of the output layer as the output of the feature fusion model; A feature fusion model is generated using the remaining model parameters.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method for identifying a network virus according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for identifying a network virus according to any one of claims 1 to 7 is implemented.

Images