Code classification method and device, computer readable storage medium, and electronic device

Abstract

The present disclosure is about a code classification method and device, a computer-readable storage medium, and an electronic device, and relates to the technical field of malicious code classification. The method includes: extracting a first code feature of the code to be classified, and calculating a first feature sensitivity factor of the first code feature based on a sensitive factor calculation model included in a preset sensitive function library; wherein the first code feature includes a first static feature and a first dynamic feature; constructing a first family feature to be classified corresponding to the code to be classified according to the first code feature and the first feature sensitivity factor; calculating the similarity between the first family feature to be classified and the original family feature included in a preset malicious code family feature library; determining the family category of the malicious code family to which the code to be classified belongs according to the similarity calculation result. The present disclosure improves the accuracy of the classification results.

Description

Background Art

[0002] With the development of the Internet, the types and impact of malicious codes are gradually increasing. In the specific application process, the vast majority of malicious codes are family-based. Although they have different codes, they have the same malicious behavior characteristics. Therefore, how to accurately identify and classify malicious codes, and then accurately locate defects in code audits, is an urgent problem to be solved.

[0003] In order to solve the above problems, in some technical solutions, discrimination and classification can be performed in the following two ways: one is to perform static analysis on the code and perform discrimination and classification based on the static analysis results; the other is to perform dynamic analysis on the code and perform discrimination and classification based on the dynamic analysis results.

[0004] However, the above method has the following defects: on the one hand, if only static analysis is performed, it will lead to a high false alarm rate, which will lead to low accuracy of code classification results; on the other hand, if only dynamic analysis is performed, it will lead to a high false alarm rate, which will lead to low accuracy of code classification results.

[0005] Therefore, it is necessary to provide a new code classification method and device.

[0006] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0007] The purpose of the present disclosure is to provide a code classification method, a code classification device, a computer-readable storage medium and an electronic device, thereby at least to a certain extent overcoming the problem of low accuracy of code classification results caused by limitations and defects of related technologies.

[0008] According to one aspect of the present disclosure, a code classification method is provided, comprising:

[0009] Extracting a first code feature of the code to be classified, and calculating a first feature sensitivity factor of the first code feature based on a sensitivity factor calculation model included in a preset sensitive function library; wherein the first code feature includes a first static feature and a first dynamic feature;

[0010] Constructing a first to-be-classified family feature corresponding to the to-be-classified code according to the first code feature and the first feature sensitivity factor;

[0011] Calculating the similarity between the first family feature to be classified and the original family feature included in the preset malicious code family feature library;

[0012] The family category of the malicious code family to which the code to be classified belongs is determined according to the similarity calculation result.

[0013] In an exemplary embodiment of the present disclosure, extracting a first code feature of a code to be classified includes:

[0014] Performing file structure analysis on the code to be classified to obtain a first analysis result, and disassembling and / or decompiling the first analysis result to obtain a first static feature; wherein the first static feature includes one or more of a first API call feature, a string feature, a sequence feature, and a semantic feature of the code to be classified;

[0015] Executing the code to be classified based on a preset virtual machine to obtain the first dynamic feature; wherein the first dynamic feature includes a first system file operation feature, a first process access feature, a first registry operation feature, and a second API call feature of the code to be classified;

[0016] The first static feature and the first dynamic feature are superimposed to obtain the first code feature.

[0017] In an exemplary embodiment of the present disclosure, calculating the first feature sensitivity factor of the first code feature based on a sensitivity factor calculation model included in a preset sensitive function library includes:

[0018] Matching a sensitivity factor calculation model corresponding to the first code feature in a preset sensitive function library; wherein each first code feature corresponds to a sensitivity factor calculation model;

[0019] Calculate the first feature occurrence frequency and the first feature execution frequency of the first code feature in the code to be classified;

[0020] Based on the sensitivity factor calculation model corresponding to the first code feature, the first feature occurrence frequency, and the first feature execution frequency, the first feature sensitivity factor of the first code feature is calculated.

[0021] In an exemplary embodiment of the present disclosure, the code classification method further includes:

[0022] Acquire the second code feature of the malicious code that has completed family classification in history, and calculate the number of occurrences of the second feature of the second code feature in the malicious code that has completed family classification and the second feature execution frequency; wherein the second code feature includes a second static feature and a second dynamic feature;

[0023] Inputting the number of occurrences of the second feature and the execution frequency of the second feature into the machine learning model to be trained, and obtaining the second predicted sensitivity level of the second code feature to the malicious code that has completed family classification and the severity of the impact of the second predicted feature;

[0024] Constructing a first loss function according to the second predicted sensitivity level and the second standard sensitivity level, the second predicted feature impact severity and the second standard feature impact severity, and adjusting the parameters included in the machine learning model to be trained based on the first loss function to obtain a sensitivity factor calculation model corresponding to the second code feature;

[0025] A mapping relationship between the second code feature and the sensitive factor calculation model is established, and based on the mapping relationship and the sensitive factor calculation model, the preset sensitive function library is generated.

[0026] In an exemplary embodiment of the present disclosure, calculating the similarity between the first to-be-classified family feature and the original family feature included in the preset malicious code family feature library includes:

[0027] Calculating a first feature vector of the first family feature to be classified according to the first code feature and a first feature sensitivity factor corresponding to the first code feature;

[0028] Calculate a second feature vector of the original family feature according to the feature value of the original family feature included in the preset malicious code family feature library;

[0029] A cosine value between the first eigenvector and the second eigenvector is calculated, and the similarity calculation result is obtained according to the cosine value.

[0030] In an exemplary embodiment of the present disclosure, determining the family category of the malicious code family to which the code to be classified belongs according to the similarity calculation result includes:

[0031] Determine whether the similarity calculation result is greater than a preset similarity threshold;

[0032] If the similarity calculation result is greater than or equal to a preset similarity threshold, it is determined that the family category of the malicious code family to which the to-be-classified code belongs is the same as the family category to which the original family feature belongs.

[0033] In an exemplary embodiment of the present disclosure, the code classification method further includes:

[0034] If the similarity calculation result is less than the preset similarity threshold, calculating the maliciousness of the code to be classified according to the first code feature and the first feature sensitivity factor;

[0035] Determining whether the maliciousness level is greater than a preset malicious code threshold;

[0036] If the maliciousness level is greater than or equal to the preset malicious code threshold, constructing a new family feature set according to the first code feature and the first feature sensitivity factor, and adding the new family feature set to the family feature set library;

[0037] If the maliciousness level is less than a preset malicious code threshold, the code to be classified is determined to be a safe code sample.

[0038] According to one aspect of the present disclosure, a code classification device is provided, comprising:

[0039] A first code feature extraction module, used to extract a first code feature of the code to be classified, and calculate a first feature sensitivity factor of the first code feature based on a sensitivity factor calculation model included in a preset sensitive function library; wherein the first code feature includes a first static feature and a first dynamic feature;

[0040] A first family feature construction module, used to construct a first to-be-classified family feature corresponding to the to-be-classified code according to the first code feature and a first feature sensitivity factor;

[0041] A first similarity calculation module, used to calculate the similarity between the first family feature to be classified and the original family feature included in the preset malicious code family feature library;

[0042] The family category determination module is used to determine the family category of the malicious code family to which the code to be classified belongs according to the similarity calculation result.

[0043] According to one aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the code classification method described in any of the above example embodiments is implemented.

[0044] According to one aspect of the present disclosure, there is provided an electronic device, including:

[0045] Processor; and

[0046] A memory, configured to store executable instructions of the processor;

[0047] The processor is configured to execute the code classification method described in any of the above example embodiments by executing the executable instructions.

[0048] A code classification method provided by an embodiment of the present disclosure, on the one hand, extracts a first code feature of the code to be classified, and calculates a first feature sensitivity factor of the first code feature based on a sensitive factor calculation model included in a preset sensitive function library; then, based on the first code feature and the first feature sensitivity factor, constructs a first family feature to be classified corresponding to the code to be classified; then calculates the similarity between the first family feature to be classified and the original family feature included in a preset malicious code family feature library; finally, determines the family category of the malicious code family to which the code to be classified belongs based on the similarity calculation result. Since the first code feature includes a first static feature and a first dynamic feature, and the code to be classified can be determined based on the first code feature and the first feature sensitivity factor corresponding thereto, The category of class code realizes the combination of static features and dynamic features, thereby solving the problem of low accuracy of code classification results caused by high false alarm rate due to only static analysis, or high missed alarm rate due to only dynamic analysis in the prior art, reducing the false alarm rate of static analysis and the missed alarm rate of dynamic analysis; on the other hand, since the first feature sensitivity factor of the first code feature can be calculated based on the sensitive factor calculation model included in the preset sensitive function library; then, according to the first code feature and the first feature sensitivity factor, the first family feature to be classified corresponding to the code to be classified is constructed, thereby making the behavioral representation of the code to be classified more accurate, improving the accuracy of the first family feature to be classified, and at the same time improving the accuracy of the code classification result.

[0049] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0051] Figure 1 The following schematically shows a flowchart of a code classification method according to an exemplary embodiment of the present disclosure.

[0052] Figure 2 A block diagram schematically shows a code classification system according to an exemplary embodiment of the present disclosure.

[0053] Figure 3 A flowchart of a method for generating a preset sensitive function library according to an exemplary embodiment of the present disclosure is schematically shown.

[0054] Figure 4 A diagram schematically shows an example of a calculation scenario of a second code feature according to an example embodiment of the present disclosure.

[0055] Figure 5 A diagram schematically shows an example scenario of calculating a first feature sensitivity factor according to an example embodiment of the present disclosure.

[0056] Figure 6 A flowchart of a method for calculating the similarity between the first family feature to be classified and the original family feature included in a preset malicious code family feature library according to an exemplary embodiment of the present disclosure is schematically shown.

[0057] Figure 7 A diagram schematically illustrates an example scenario of determining a family category of a malicious code family to which a code to be classified belongs according to an example embodiment of the present disclosure.

[0058] Figure 8 The flowchart schematically shows another code classification method according to an exemplary embodiment of the present disclosure.

[0059] Fig. 9 A block diagram schematically illustrates a code classification device according to an exemplary embodiment of the present disclosure.

[0060] Fig.10 An electronic device for implementing the above code classification method according to an exemplary embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0061] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0062] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0063] This exemplary embodiment first provides a code classification method, which can be run on a server, server cluster or cloud server, etc. Of course, those skilled in the art can also run the method disclosed in this disclosure on other platforms as required, which is not specifically limited in this exemplary embodiment. Figure 1 As shown, the classification method of the code may include the following steps:

[0064] Step S110. extracting a first code feature of the code to be classified, and calculating a first feature sensitivity factor of the first code feature based on a sensitivity factor calculation model included in a preset sensitive function library; wherein the first code feature includes a first static feature and a first dynamic feature;

[0065] Step S120. Constructing a first to-be-classified family feature corresponding to the to-be-classified code according to the first code feature and the first feature sensitivity factor;

[0066] Step S130: Calculate the similarity between the first to-be-classified family feature and the original family feature included in the preset malicious code family feature library;

[0067] Step S140: Determine the family category of the malicious code family to which the code to be classified belongs according to the similarity calculation result.

[0068] In the above code classification method, on the one hand, by extracting the first code feature of the code to be classified, and based on the sensitive factor calculation model included in the preset sensitive function library, the first feature sensitivity factor of the first code feature is calculated; then, according to the first code feature and the first feature sensitivity factor, a first family feature to be classified corresponding to the code to be classified is constructed; then the similarity between the first family feature to be classified and the original family feature included in the preset malicious code family feature library is calculated; finally, the family category of the malicious code family to which the code to be classified belongs is determined according to the similarity calculation result. Since the first code feature includes the first static feature and the first dynamic feature, and the first code feature and the first feature sensitivity factor corresponding thereto can be used to determine the family category of the code to be classified. Category, realizes the combination of static features and dynamic features, thereby solving the problem of low accuracy of code classification results caused by high false alarm rate due to only static analysis, or high missed alarm rate due to only dynamic analysis in the prior art, reducing the false alarm rate of static analysis and the missed alarm rate of dynamic analysis; on the other hand, since the first feature sensitivity factor of the first code feature can be calculated based on the sensitive factor calculation model included in the preset sensitive function library; then, according to the first code feature and the first feature sensitivity factor, the first family feature to be classified corresponding to the code to be classified is constructed, thereby making the behavioral representation of the code to be classified more accurate, improving the accuracy of the first family feature to be classified, and at the same time improving the accuracy of the code classification result.

[0069] Hereinafter, the code classification method of the exemplary embodiment of the present disclosure will be explained and illustrated in detail with reference to the accompanying drawings.

[0070] First, the application scenarios of the example embodiments of the present disclosure are explained and illustrated. Specifically, the code classification method provided by the example embodiments of the present disclosure can be used in the malicious code family classification scenario in software development security audits. In the more specific classification process, the extraction process adopts a combination of static analysis and dynamic analysis to reduce the false alarm rate of static analysis and the missed alarm rate of dynamic analysis, increase the feature matching of sensitive function libraries obtained by sample training, and define different sensitive factor weights for different feature behavior influencing factors to make the malicious code behavior representation more accurate; the combined static and dynamic behavior features make the family feature set more comprehensive during feature extraction. In addition, the example embodiments of the present disclosure provide a method for calculating the similarity of malicious code features based on an improved cosine similarity algorithm, and compare the malicious code family classification to make the extraction result more accurate.

[0071] Next, the classification system of the code of the exemplary embodiment of the present disclosure is explained and illustrated. Figure 2As shown, the code classification system may include a computing engine 210, a sensitive function library 220 and a malicious code family feature library 230; the computing engine is respectively connected to the sensitive function library and the malicious code family feature library network; the computing engine may be a Spark computing engine or other computing engines, and this example does not impose any special restrictions on this. The computing engine may be used to implement the code classification method described in the present disclosure; the sensitive function library and the malicious code family feature library may be implemented based on a Redis database or a Hive database, the sensitive function library may be used to store a sensitive factor calculation model, and the malicious code family feature library may be used to store family features of malicious codes.

[0072] Further, the generation method of the preset sensitive function library involved in the exemplary embodiment of the present disclosure is explained and illustrated. Figure 3 As shown, the method for generating the preset sensitive function library may include the following steps:

[0073] Step S310, obtaining the second code feature of the malicious code that has completed family classification in the past, and calculating the number of occurrences of the second feature of the second code feature in the malicious code that has completed family classification and the second feature execution frequency; wherein the second code feature includes a second static feature and a second dynamic feature;

[0074] Step S320, inputting the number of occurrences of the second feature and the execution frequency of the second feature into the machine learning model to be trained, and obtaining the second predicted sensitivity level of the second code feature to the malicious code that has completed family classification and the severity of the impact of the second predicted feature;

[0075] Step S330, constructing a first loss function according to the second predicted sensitivity level and the second standard sensitivity level, the second predicted feature impact severity and the second standard feature impact severity, and adjusting the parameters included in the machine learning model to be trained based on the first loss function to obtain a sensitivity factor calculation model corresponding to the second code feature;

[0076] In step S340, a mapping relationship between the second code feature and the sensitive factor calculation model is established, and based on the mapping relationship and the sensitive factor calculation model, the preset sensitive function library is generated.

[0077] The following will be combined Figure 4Steps S310 to S340 are explained and illustrated. Specifically, the machine learning model to be trained may include a Bayesian classification model, a logistic regression model or a Softmax regression model, etc., and this example does not impose any special restrictions on this; and the second static feature of the malicious code that has completed the family classification in the history may include the third API (Application Programming Interface) call feature, the second string feature, the second sequence feature and the second semantic feature of the malicious code that has completed the family classification in the history; the second dynamic feature may include the second system file operation feature, the second process access, the second registry operation and the fourth API call feature; wherein, the third API call feature and the fourth API call feature may be the same or different, and this example does not impose any special restrictions on this.

[0078] Furthermore, in the process of training each machine learning model to be trained, first, extract the second static feature (third API call feature, second string feature, second sequence feature, second semantic feature) 401 and the second dynamic feature (second system file operation, second process access, second registry operation and fourth API call feature) 402; then construct the second code feature (second dynamic and static feature set) 403; further, calculate the number of occurrences of the second features of the third call feature, the second string feature, the second sequence feature, and the second semantic feature, and the second feature execution frequency through the control flow chart and function flow chart 404 included in the malicious code that has completed family classification in the history; The malicious code of the class is dynamically monitored 405, and the second feature occurrence times and the second feature execution frequency of the second system file operation feature, the second process access, the second registry operation and the fourth API call feature in the malicious code that has completed the family classification in the history are obtained, and then the corresponding feature vector is generated according to the second feature occurrence times and the second feature execution frequency, and the feature vector is input into the machine learning model to be trained to obtain the second predicted sensitivity level and the severity of the impact of the second predicted feature; further, the corresponding loss function is constructed, and the machine learning model to be trained is trained by the loss function; wherein, the loss function can be a cross entropy loss function or other loss functions, and the present invention does not make any special restrictions on this.

[0079] Finally, after obtaining the sensitive factor calculation model corresponding to each second code feature, a mapping relationship between each second code feature and the sensitive factor calculation model can be established, and based on the mapping relationship and the sensitive factor calculation model, the above-mentioned preset sensitive function library is generated.

[0080] Furthermore, in a code classification method provided in an exemplary embodiment of the present disclosure:

[0081] In step S110, a first code feature of the code to be classified is extracted, and a first feature sensitivity factor of the first code feature is calculated based on a sensitivity factor calculation model included in a preset sensitive function library; wherein the first code feature includes a first static feature and a first dynamic feature.

[0082] In the embodiment of the present invention, firstly, the code to be classified sent by an external device or server can be accepted. The code to be classified can be the code of an application program or the code of other offensive programs. The present invention does not impose any special restrictions on this. Specifically, in the process of extracting the first code feature, it can be implemented in the following ways: firstly, the file structure of the code to be classified is analyzed to obtain a first analysis result, and the first analysis result is disassembled and / or decompiled to obtain a first static feature; wherein, the first static feature includes one or more of the first API call feature, string feature, sequence feature and semantic feature of the code to be classified; secondly, the code to be classified is executed based on a preset virtual machine to obtain the first dynamic feature; wherein, the first dynamic feature includes the first system file operation feature, the first process access feature, the first registry operation feature and the second API call feature of the code to be classified; finally, the first static feature and the first dynamic feature are superimposed to obtain the first code feature.

[0083] Specifically, refer to Figure 5 As shown, S501, obtain the code to be classified (that is, the unknown sample), S502, perform file structure analysis, disassemble and decompile the code to be classified to obtain the above-mentioned first static feature, S503, execute the code to be classified based on the virtual machine to obtain the first dynamic feature; S504, superimpose and extract the first static feature and the first dynamic feature to obtain the first code feature. It should be supplemented here that the above-mentioned first API calling interface and the second API calling interface can be the same or different; wherein, the first API calling interface can represent the interface information written during the development process of the code to be classified, and the second API calling interface can represent the interface information used by the code to be classified during operation.

[0084] Furthermore, after obtaining a specific first code feature, the first feature sensitivity factor of the first code feature can be calculated based on the sensitivity factor calculation model included in the preset sensitive function library. Specifically, it can include: first, matching the sensitivity factor calculation model corresponding to the first code feature in the preset sensitive function library; wherein each first code feature corresponds to a sensitivity factor calculation model; second, calculating the first feature occurrence frequency and the first feature execution frequency of the first code feature in the code to be classified; finally, based on the sensitivity factor calculation model corresponding to the first code feature and the first feature occurrence frequency and the first feature execution frequency, calculate the first feature sensitivity factor of the first code feature.

[0085] For details, please refer to Figure 5 As shown, first, based on the mapping relationship between the first code feature and the sensitive factor calculation model, the sensitive factor calculation model corresponding to the first code feature can be matched from the sensitive function library (S505), and then the first feature occurrence frequency and the first feature execution frequency of the first code feature in the code to be classified are calculated, and the first feature occurrence frequency and the first feature execution frequency are input into the sensitive factor calculation model to obtain the corresponding first feature sensitivity factor (S506).

[0086] In step S120, a first to-be-classified family feature corresponding to the to-be-classified code is constructed according to the first code feature and the first feature sensitivity factor.

[0087] For details, please refer to Figure 5 As shown, after the first feature sensitivity factor is obtained, the first family feature to be classified (ie, the sample feature set to be classified, S507) can be constructed based on the first code feature and the first feature sensitivity factor corresponding to the first code feature.

[0088] In step S130, the similarity between the first family feature to be classified and the original family feature included in the preset malicious code family feature library is calculated.

[0089] In this embodiment, reference Figure 6 As shown, calculating the similarity between the first family feature to be classified and the original family feature included in the preset malicious code family feature library may include the following steps:

[0090] Step S610, calculating a first feature vector of the first family feature to be classified according to the first code feature and a first feature sensitivity factor corresponding to the first code feature;

[0091] Step S620, calculating a second feature vector of the original family feature according to the feature value of the original family feature included in the preset malicious code family feature library;

[0092] Step S630, calculating the cosine value between the first feature vector and the second feature vector, and obtaining the similarity calculation result according to the cosine value.

[0093] The following will explain and illustrate step S610 to step S630. Specifically, the calculation formula of cosine similarity can be shown as the following formula (1):

[0094]

[0095] Among them, cosθ represents the cosine value, x i represents the second eigenvector, y i δ i represents the first eigenvector, y i represents the i-th first code feature, δ i Represents the first feature sensitivity factor of the i-th first code feature; n represents the dimension of the code feature. It should be noted here that in the process of calculating the first feature vector and the second feature vector, the vector set can be determined as an n-dimensional vector according to the maximum dimension; the family feature set (second feature vector) is a known universal family feature, so it is directly vectorized as 0 (no feature) or 1 (feature) according to the presence or absence of the feature, and the sample feature (first vector feature) is increased by the product of the sensitivity factor according to the sensitivity factor allocation. By obtaining the similarity calculation result based on the improved cosine similarity algorithm, the accuracy of the similarity calculation result can be greatly improved, thereby improving the accuracy of the classification result.

[0096] In step S140, the family category of the malicious code family to which the code to be classified belongs is determined according to the similarity calculation result.

[0097] In this example embodiment, first, it is determined whether the similarity calculation result is greater than a preset similarity threshold; second, if the similarity calculation result is greater than or equal to the preset similarity threshold, it is determined that the family category of the malicious code family to which the code to be classified belongs is the same as the family category to which the original family feature belongs.

[0098] Furthermore, if the similarity calculation result is less than the preset similarity threshold, the maliciousness level of the code to be classified is calculated based on the first code feature and the first feature sensitivity factor; then, it is determined whether the maliciousness level is greater than the preset malicious code threshold; if the maliciousness level is greater than or equal to the preset malicious code threshold, a new family feature set is constructed based on the first code feature and the first feature sensitivity factor, and the new family feature set is added to the family feature set library; finally, if the maliciousness level is less than the preset malicious code threshold, the code to be classified is determined to be a safe code sample.

[0099] The following, combined Figure 7 The specific process of determining the family category of the malicious code family to which the classified code belongs is explained and illustrated. Figure 7 As shown, S701, determine whether the similarity calculation result is greater than the similarity threshold; if so, jump to step S702; if not, jump to step S703; S702, determine whether the family category of the malicious code family to which the code to be classified belongs is the same as the family category to which the original family feature belongs; S703, calculate the maliciousness of the code to be classified according to the first code feature and the first feature sensitivity factor; S704, determine whether the maliciousness is greater than the malicious code threshold; if so, jump to step S705, if not, jump to step S706; S705, construct a new family feature set according to the first code feature and the first feature sensitivity factor, and add the new family feature set to the family feature set library; S706, determine that the code to be classified is a safe code sample.

[0100] The following, combined Figure 8 The classification method of the code of the exemplary embodiment of the present disclosure is further explained and illustrated. Figure 8 As shown, the classification method of the code may include the following steps:

[0101] S801, obtaining unknown samples;

[0102] S802, performing static analysis to obtain a first static feature, and performing dynamic analysis to obtain a first dynamic feature;

[0103] S803, performing feature superposition extraction on the first static feature and the first dynamic feature to obtain a first code feature;

[0104] S804, calculating a first feature sensitivity factor of the first code feature according to a sensitivity factor calculation model included in the sensitive function library;

[0105] S805, constructing a first feature vector according to the first feature sensitivity factor and the first code feature;

[0106] S806, calculating a second feature vector according to the feature values ​​of the original family features included in the malicious code family feature library;

[0107] S807, calculating the feature similarity between the first feature vector and the second feature vector;

[0108] S808, determine whether the feature similarity meets the similarity threshold; if so, jump to step S809; if not, jump to step S810;

[0109] S809, determining that the family category of the malicious code family to which the code to be classified belongs is the same as the family category to which the original family feature belongs;

[0110] S810, determining whether the maliciousness of the code to be classified is greater than the malicious code threshold; if so, jumping to step S811, if not, jumping to step S812;

[0111] S811, construct a new family feature set, and add the new family feature set to the family feature set library;

[0112] S812: Determine whether the code to be classified is a security code sample.

[0113] It can be known that the code classification method recorded in the example embodiment of the present disclosure, combining dynamic and static methods, can obtain a more comprehensive set of family malicious code behavior characteristics; and, perform structured analysis on the characteristics, and dynamically add sensitivity factors to the characteristics based on multiple factors such as feature occurrence frequency, execution frequency, impact severity, and sensitive function level; further, the code classification method disclosed in the example embodiment of the present disclosure adopts an improved cosine similarity algorithm, which uses a feature library as a classification standard, increases feature sensitivity factors, and makes the similarity calculation results more accurate.

[0114] The exemplary embodiment of the present disclosure also provides a code classification device. Fig. 9 As shown, the code classification device may include a first code feature extraction module 910, a first family feature construction module 920, a first similarity calculation module 930 and a family category determination module 940. Among them:

[0115] The first code feature extraction module 910 may be used to extract a first code feature of the code to be classified, and calculate a first feature sensitivity factor of the first code feature based on a sensitivity factor calculation model included in a preset sensitive function library; wherein the first code feature includes a first static feature and a first dynamic feature;

[0116] A first family feature construction module 920 may be used to construct a first to-be-classified family feature corresponding to the to-be-classified code according to the first code feature and the first feature sensitivity factor;

[0117] A first similarity calculation module 930, which may be used to calculate the similarity between the first family feature to be classified and the original family feature included in the preset malicious code family feature library;

[0118] The family category determination module 940 may be used to determine the family category of the malicious code family to which the code to be classified belongs according to the similarity calculation result.

[0119] In an exemplary embodiment of the present disclosure, extracting a first code feature of a code to be classified includes:

[0120] Performing file structure analysis on the code to be classified to obtain a first analysis result, and disassembling and / or decompiling the first analysis result to obtain a first static feature; wherein the first static feature includes one or more of a first API call feature, a string feature, a sequence feature, and a semantic feature of the code to be classified;

[0121] Executing the code to be classified based on a preset virtual machine to obtain the first dynamic feature; wherein the first dynamic feature includes a first system file operation feature, a first process access feature, a first registry operation feature, and a second API call feature of the code to be classified;

[0122] The first static feature and the first dynamic feature are superimposed to obtain the first code feature.

[0123] In an exemplary embodiment of the present disclosure, calculating the first feature sensitivity factor of the first code feature based on a sensitivity factor calculation model included in a preset sensitive function library includes:

[0124] Matching a sensitivity factor calculation model corresponding to the first code feature in a preset sensitive function library; wherein each first code feature corresponds to a sensitivity factor calculation model;

[0125] Calculate the first feature occurrence frequency and the first feature execution frequency of the first code feature in the code to be classified;

[0126] Based on the sensitivity factor calculation model corresponding to the first code feature, the first feature occurrence frequency, and the first feature execution frequency, the first feature sensitivity factor of the first code feature is calculated.

[0127] In an exemplary embodiment of the present disclosure, the code classification device further includes:

[0128] A second code feature acquisition module, used to acquire a second code feature of malicious code that has completed family classification in the past, and calculate the number of occurrences of the second feature of the second code feature in the malicious code that has completed family classification and the second feature execution frequency; wherein the second code feature includes a second static feature and a second dynamic feature;

[0129] A sensitivity level prediction module, used to input the number of occurrences of the second feature and the execution frequency of the second feature into the machine learning model to be trained, and obtain a second predicted sensitivity level of the second code feature on the malicious code that has completed family classification and the severity of the impact of the second predicted feature;

[0130] a parameter adjustment module, configured to construct a first loss function according to the second predicted sensitivity level and the second standard sensitivity level, the second predicted feature impact severity and the second standard feature impact severity, and adjust the parameters included in the machine learning model to be trained based on the first loss function to obtain a sensitivity factor calculation model corresponding to the second code feature;

[0131] A sensitive function library generation module is used to establish a mapping relationship between the second code feature and the sensitive factor calculation model, and generate the preset sensitive function library based on the mapping relationship and the sensitive factor calculation model.

[0132] In an exemplary embodiment of the present disclosure, calculating the similarity between the first to-be-classified family feature and the original family feature included in the preset malicious code family feature library includes:

[0133] Calculating a first feature vector of the first family feature to be classified according to the first code feature and a first feature sensitivity factor corresponding to the first code feature;

[0134] Calculate a second feature vector of the original family feature according to the feature value of the original family feature included in the preset malicious code family feature library;

[0135] A cosine value between the first eigenvector and the second eigenvector is calculated, and the similarity calculation result is obtained according to the cosine value.

[0136] In an exemplary embodiment of the present disclosure, determining the family category of the malicious code family to which the code to be classified belongs according to the similarity calculation result includes:

[0137] Determine whether the similarity calculation result is greater than a preset similarity threshold;

[0138] If the similarity calculation result is greater than or equal to a preset similarity threshold, it is determined that the family category of the malicious code family to which the to-be-classified code belongs is the same as the family category to which the original family feature belongs.

[0139] In an exemplary embodiment of the present disclosure, the code classification device further includes:

[0140] A maliciousness calculation module, configured to calculate the maliciousness of the code to be classified according to the first code feature and the first feature sensitivity factor if the similarity calculation result is less than the preset similarity threshold;

[0141] A first judging module, used to judge whether the maliciousness is greater than a preset malicious code threshold;

[0142] A family feature set construction module, configured to construct a new family feature set according to the first code feature and the first feature sensitivity factor if the maliciousness is greater than or equal to the preset malicious code threshold, and add the new family feature set to the family feature set library;

[0143] The second category determination module is used to determine that the code to be classified is a safe code sample if the maliciousness is less than a preset malicious code threshold.

[0144] The specific details of each module in the above code classification device have been described in detail in the corresponding code classification method, so they will not be repeated here.

[0145] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0146] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0147] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0148] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0149] Refer to the following Fig.10 The electronic device 1000 according to this embodiment of the present disclosure is described. Fig.10 The electronic device 1000 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0150] like Fig.10 As shown, the electronic device 1000 is in the form of a general computing device. The components of the electronic device 1000 may include, but are not limited to: the at least one processing unit 1010, the at least one storage unit 1020, a bus 1030 connecting different system components (including the storage unit 1020 and the processing unit 1010), and a display unit 1040.

[0151] The storage unit stores program codes, which can be executed by the processing unit 1010, so that the processing unit 1010 performs the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 1010 can perform the following steps: Figure 1 Step S110 shown in: extracting the first code feature of the code to be classified, and calculating the first feature sensitivity factor of the first code feature based on the sensitivity factor calculation model included in the preset sensitive function library; wherein the first code feature includes a first static feature and a first dynamic feature; step S120: constructing a first family feature to be classified corresponding to the code to be classified according to the first code feature and the first feature sensitivity factor; step S130: calculating the similarity between the first family feature to be classified and the original family feature included in the preset malicious code family feature library; step S140: determining the family category of the malicious code family to which the code to be classified belongs according to the similarity calculation result.

[0152] The storage unit 1020 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 10201 and / or a cache storage unit 10202 , and may further include a read-only storage unit (ROM) 10203 .

[0153] The storage unit 1020 may also include a program / utility 10204 having a set (at least one) of program modules 10205, such program modules 10205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0154] Bus 1030 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0155] The electronic device 1000 may also communicate with one or more external devices 1100 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1000, and / or may communicate with any device that enables the electronic device 1000 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1050. Furthermore, the electronic device 1000 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 1060. As shown, the network adapter 1060 communicates with other modules of the electronic device 1000 via a bus 1030. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1000, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0156] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0157] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above "Exemplary Method" section of the present specification.

[0158] According to the program product for implementing the above method in the embodiment of the present disclosure, it can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0159] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0160] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0161] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0162] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0163] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0164] Other embodiments of the present disclosure will be readily apparent to those skilled in the art after considering the specification and practicing the inventions invented herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not invented by the present disclosure. The specification and examples are to be considered merely exemplary, and the true scope and spirit of the present disclosure are indicated by the claims.

Claims

1. A code classification method, characterized in that: include: Extracting a first code feature of a code to be classified, and calculating a first feature sensitivity factor of the first code feature based on a sensitivity factor calculation model included in a preset sensitive function library, including: matching a sensitivity factor calculation model corresponding to the first code feature in a preset sensitive function library; calculating a first feature occurrence frequency and a first feature execution frequency of the first code feature in the code to be classified; calculating a first feature sensitivity factor of the first code feature based on the sensitivity factor calculation model corresponding to the first code feature and the first feature occurrence frequency and the first feature execution frequency; wherein the first code feature includes a first static feature and a first dynamic feature; Constructing a first to-be-classified family feature corresponding to the to-be-classified code according to the first code feature and the first feature sensitivity factor; Calculating the similarity between the first family feature to be classified and the original family feature included in the preset malicious code family feature library; The family category of the malicious code family to which the code to be classified belongs is determined according to the similarity calculation result.

2. The code classification method according to claim 1, characterized in that: Extracting the first code feature of the code to be classified includes: Performing file structure analysis on the code to be classified to obtain a first analysis result, and disassembling and / or decompiling the first analysis result to obtain a first static feature; wherein the first static feature includes one or more of a first API call feature, a string feature, a sequence feature, and a semantic feature of the code to be classified; Executing the code to be classified based on a preset virtual machine to obtain the first dynamic feature; wherein the first dynamic feature includes a first system file operation feature, a first process access feature, a first registry operation feature, and a second API call feature of the code to be classified; The first static feature and the first dynamic feature are superimposed to obtain the first code feature.

3. The code classification method according to claim 1, characterized in that: Each first code feature corresponds to a sensitivity factor calculation model.

4. The code classification method according to claim 3, characterized in that: The code classification method also includes: Acquire the second code feature of the malicious code that has completed family classification in history, and calculate the number of occurrences of the second feature of the second code feature in the malicious code that has completed family classification and the second feature execution frequency; wherein the second code feature includes a second static feature and a second dynamic feature; Inputting the number of occurrences of the second feature and the execution frequency of the second feature into the machine learning model to be trained, and obtaining the second predicted sensitivity level of the second code feature to the malicious code that has completed family classification and the severity of the impact of the second predicted feature; Constructing a first loss function according to the second predicted sensitivity level and the second standard sensitivity level, the second predicted feature impact severity and the second standard feature impact severity, and adjusting the parameters included in the machine learning model to be trained based on the first loss function to obtain a sensitivity factor calculation model corresponding to the second code feature; A mapping relationship between the second code feature and the sensitive factor calculation model is established, and based on the mapping relationship and the sensitive factor calculation model, the preset sensitive function library is generated.

5. The code classification method according to claim 1, characterized in that: Calculating the similarity between the first family feature to be classified and the original family feature included in the preset malicious code family feature library includes: Calculating a first feature vector of the first family feature to be classified according to the first code feature and a first feature sensitivity factor corresponding to the first code feature; Calculate a second feature vector of the original family feature according to the feature value of the original family feature included in the preset malicious code family feature library; A cosine value between the first eigenvector and the second eigenvector is calculated, and the similarity calculation result is obtained according to the cosine value.

6. The code classification method according to claim 1, characterized in that: Determining the family category of the malicious code family to which the code to be classified belongs according to the similarity calculation result includes: Determine whether the similarity calculation result is greater than a preset similarity threshold; If the similarity calculation result is greater than or equal to a preset similarity threshold, it is determined that the family category of the malicious code family to which the to-be-classified code belongs is the same as the family category to which the original family feature belongs.

7. The code classification method according to claim 6, characterized in that: The code classification method also includes: If the similarity calculation result is less than the preset similarity threshold, calculating the maliciousness of the code to be classified according to the first code feature and the first feature sensitivity factor; Determining whether the maliciousness level is greater than a preset malicious code threshold; If the maliciousness level is greater than or equal to the preset malicious code threshold, constructing a new family feature set according to the first code feature and the first feature sensitivity factor, and adding the new family feature set to the family feature set library; If the maliciousness level is less than a preset malicious code threshold, the code to be classified is determined to be a safe code sample.

8. A code classification device, characterized in that: include: A first code feature extraction module is used to extract a first code feature of the code to be classified, and calculate a first feature sensitivity factor of the first code feature based on a sensitivity factor calculation model included in a preset sensitive function library, including: matching a sensitivity factor calculation model corresponding to the first code feature in the preset sensitive function library; calculating a first feature occurrence frequency and a first feature execution frequency of the first code feature in the code to be classified; calculating a first feature sensitivity factor of the first code feature based on the sensitivity factor calculation model corresponding to the first code feature and the first feature occurrence frequency and the first feature execution frequency; wherein the first code feature includes a first static feature and a first dynamic feature; A first family feature construction module, used to construct a first to-be-classified family feature corresponding to the to-be-classified code according to the first code feature and a first feature sensitivity factor; A first similarity calculation module, used to calculate the similarity between the first family feature to be classified and the original family feature included in the preset malicious code family feature library; The family category determination module is used to determine the family category of the malicious code family to which the code to be classified belongs according to the similarity calculation result.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the code classification method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the code classification method according to any one of claims 1 to 7 by executing the executable instructions.

Images