Malicious code detection method, device and storage medium based on deep learning

Abstract

The present invention discloses a malicious code detection method, device and storage medium based on deep learning, and belongs to the field of information security technology. The present invention obtains the code to be detected, inputs the code to be detected into a preprocessing module for data processing, obtains feature data after data processing, and then inputs the feature data into a pre-built detection model, and the detection model outputs the malicious code judgment result. The detection model is used to detect the code to be detected, and the malicious code detection result is automatically generated, thereby improving the accuracy of malicious code detection.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a malicious code detection method, device and storage medium based on deep learning. Background Art

[0002] As Web applications occupy the mainstream market with the browser / server (B / S) architecture, browsers and web pages have become important channels for the spread of malicious code. Attackers use website code vulnerabilities, third-party application vulnerabilities, browser vulnerabilities, and operating system vulnerabilities to conduct cross-site scripting attacks on websites, inject network Trojans, tamper with web pages, phishing, and steal personal information.

[0003] JavaScript (JS) is a dynamic, lightweight scripting language used to add more functionality and enhance user experience. It is a ubiquitous technology that allows client-side scripts to interact with users and make websites dynamic and interactive, enabling server-free client interaction, instant feedback, and rich interfaces. Despite its various advantages, JS has been used to perform various cyber attacks. Attackers use malicious JavaScript code to perform functions such as keystroke logging, browser cookie stealing, hacking, website tampering, and Trojans. In addition, botnets can be created by tricking users into downloading malware through social engineering.

[0004] The existing technology uses antivirus and intrusion detection systems (IDS) to detect malicious code, specifically using signatures, pattern matching, and heuristic-based methods to detect attacks. The signature feature code detection method maintains a known malicious code library and compares the feature code of the code sample to be detected with the feature code in the malicious code library; the heuristic rule detection method uses professional analysts to extract rules from existing malicious code and detect the code sample according to the extracted rules. However, these methods have many shortcomings, such as launching 0-day attacks or other types of attacks against new vulnerabilities, which cannot be effectively detected according to existing detection rules. Summary of the invention

[0005] The main purpose of the present invention is to provide a malicious code detection method, device and storage medium based on deep learning, aiming to solve the problem that the existing technology cannot effectively detect malicious code.

[0006] To achieve the above object, the present invention provides a malicious code detection method based on deep learning, and the malicious code detection method based on deep learning comprises the following steps:

[0007] Acquire the code to be detected, pre-process the code to be detected, and obtain the data to be detected after data processing;

[0008] The data to be detected is input into a pre-built detection model, and the detection model outputs a malicious code judgment result. The detection model is constructed based on word-level word vector representation and character-level one-hot encoding.

[0009] Optionally, before the step of inputting the data to be detected into a pre-built detection model, and outputting a malicious code judgment result by the detection model, wherein the detection model is constructed based on a word-level word vector representation and a character-level one-hot encoding, the method further includes:

[0010] Obtain a labeled data set and an unlabeled data set, and divide the labeled data set into a labeled training set and a labeled test set;

[0011] The sample codes in the unlabeled data set and the labeled training set are divided to obtain corresponding sample word units, and the sample word units are input into a pre-training model to obtain a word vector representation data set of the sample word units.

[0012] Optionally, after the step of dividing the codes in the unlabeled data set and the labeled training set to obtain corresponding sample word units, inputting the sample word units into a pre-training model, and obtaining a word vector representation data set of the sample word units, the method further comprises:

[0013] Using the word vector representation dataset as a parameter of the first layer deep learning model;

[0014] Dividing the labeled training set to obtain training word units corresponding to the labeled training set;

[0015] and inputting the training word unit into the deep learning model to obtain a first word vector representation of the training word unit;

[0016] Performing one-hot encoding conversion on the characters in the labeled training set to obtain a first one-hot encoding data set;

[0017] The first word vector representation and the first one-hot encoding data set are input into a deep learning model for supervised training, and the accuracy is calculated through the labeled test set to construct a detection model.

[0018] Optionally, the step of obtaining the code to be detected, preprocessing the code to be detected, and obtaining the processed data includes:

[0019] Acquire the code to be detected, perform data processing on the code to be detected, and obtain the target code after data processing;

[0020] Dividing the target code to obtain corresponding target word units;

[0021] Convert the target code into a one-hot encoding format to obtain a second one-hot encoding data set;

[0022] The target word-unit and the second one-hot encoding data set are used as data to be detected.

[0023] Optionally, the step of performing data processing on the code to be detected to obtain a target code after data processing includes:

[0024] Obtaining numerical data in the code to be detected;

[0025] The numerical data is normalized to obtain the target code.

[0026] Optionally, the step of dividing the target code to obtain corresponding target word units includes:

[0027] Obtain a preset number of special characters as separators to divide the target code into first word units;

[0028] Filter the first word-units whose length is not less than a preset threshold value in the first word-units to obtain a second word-unit;

[0029] The second word is converted into lowercase to obtain a target word.

[0030] Optionally, the step of converting the target code into a one-hot encoding format to obtain a second one-hot encoding data set includes:

[0031] Obtaining a preset number of characters in the target code;

[0032] The characters are converted into a one-hot encoding format to obtain a second one-hot encoding data set.

[0033] In addition, to achieve the above-mentioned purpose, the present invention also provides a malicious code detection device based on deep learning, the device comprising:

[0034] An acquisition module is used to acquire the code to be detected, pre-process the code to be detected, and obtain the data to be detected after data processing;

[0035] The detection module is used to input the data to be detected into a pre-built detection model, and the detection model outputs the malicious code judgment result. The detection model is constructed based on word-level word vector representation and character-level one-hot encoding.

[0036] Optionally, the detection module is further used for:

[0037] Obtain a labeled data set and an unlabeled data set, and divide the labeled data set into a labeled training set and a labeled test set;

[0038] The sample codes in the unlabeled data set and the labeled training set are divided to obtain corresponding sample word units, and the sample word units are input into a pre-training model to obtain a word vector representation data set of the sample word units.

[0039] Optionally, the detection module is further used for:

[0040] Using the word vector representation dataset as a parameter of the first layer deep learning model;

[0041] Dividing the labeled training set to obtain training word units corresponding to the labeled training set;

[0042] and inputting the training word unit into the deep learning model to obtain a first word vector representation of the training word unit;

[0043] Performing one-hot encoding conversion on the characters in the labeled training set to obtain a first one-hot encoding data set;

[0044] The first word vector representation and the first one-hot encoding data set are input into a deep learning model for supervised training, and the accuracy is calculated through the labeled test set to construct a detection model.

[0045] Optionally, the acquisition module is further used for:

[0046] Acquire the code to be detected, perform data processing on the code to be detected, and obtain the target code after data processing;

[0047] Dividing the target code to obtain corresponding target word units;

[0048] Convert the target code into a one-hot encoding format to obtain a second one-hot encoding data set;

[0049] The target word-unit and the second one-hot encoding data set are used as data to be detected.

[0050] Optionally, the acquisition module is further used for:

[0051] Obtaining numerical data in the code to be detected;

[0052] The numerical data is normalized to obtain the target code.

[0053] Optionally, the acquisition module is further used for:

[0054] Obtain a preset number of special characters as separators to divide the target code into first word units;

[0055] Filter the first word-units whose length is not less than a preset threshold value in the first word-units to obtain a second word-unit;

[0056] The second word is converted into lowercase to obtain a target word.

[0057] Optionally, the acquisition module is further used for:

[0058] Obtaining a preset number of characters in the target code;

[0059] The characters are converted into a one-hot encoding format to obtain a second one-hot encoding data set.

[0060] In addition, to achieve the above-mentioned purpose, the present invention also provides a deep learning-based malicious code detection device, the device comprising: a memory, a processor, and a deep learning-based malicious code detection program stored in the memory and executable on the processor, the deep learning-based malicious code detection program being configured to implement the steps of the deep learning-based malicious code detection method as described above.

[0061] In addition, to achieve the above-mentioned purpose, the present invention also provides a storage medium, characterized in that a deep learning-based malicious code detection program is stored on the storage medium, and when the deep learning-based malicious code detection program is executed by the processor, the steps of the deep learning-based malicious code detection method as described above are implemented.

[0062] The malicious code detection method, device, system and storage medium based on deep learning proposed in the present invention obtain the code to be detected, pre-process the code to be detected, obtain the data to be detected after data processing, and then input the data to be detected into a pre-built detection model, and the detection model outputs the malicious code judgment result. The detection model based on deep learning is used to detect the code to be detected, and the detection model automatically generates the malicious code detection result, thereby improving the accuracy of malicious code detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a structural diagram of a malicious code detection device based on deep learning in a hardware operating environment involved in an embodiment of the present invention;

[0064] Figure 2 This is a flow chart of a first embodiment of a malicious code detection method based on deep learning according to the present invention;

[0065] Figure 3 This is a detailed flow chart of step S10 in the first embodiment of the malicious code detection method based on deep learning of the present invention;

[0066] Figure 4 A schematic diagram of a pre-training model generation process of a third embodiment of a malicious code detection method based on deep learning of the present invention;

[0067] Figure 5A schematic diagram of the relationship between the pre-training model and the detection model of the third embodiment of the malicious code detection method based on deep learning of the present invention;

[0068] Figure 6 A schematic diagram of a model structure of an embodiment of a malicious code detection method based on deep learning of the present invention;

[0069] Figure 7 This is a schematic diagram of the functional modules of an embodiment of a malicious code detection method based on deep learning of the present invention.

[0070] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0071] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0072] Reference Figure 1 , Figure 1 It is a structural diagram of a deep learning-based malicious code detection device in a hardware operating environment involved in an embodiment of the present invention.

[0073] like Figure 1 As shown, the malicious code detection device based on deep learning may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0074] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the deep learning-based malicious code detection device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0075] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module, and a malicious code detection program based on deep learning.

[0076] exist Figure 1 In the deep learning-based malicious code detection device shown, the network interface 1004 is mainly used for data communication with other devices; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the deep learning-based malicious code detection device of the present invention can be set in the malicious code detection device, and the malicious code detection device calls the deep learning-based malicious code detection program stored in the memory 1005 through the processor 1001, and executes the deep learning-based malicious code detection method provided by the embodiment of the present invention.

[0077] The embodiment of the present invention provides a malicious code detection method based on deep learning. Figure 2 , Figure 2 This is a flow chart of the first embodiment of the malicious code detection method based on deep learning of the present invention.

[0078] In this embodiment, the malicious code detection method based on deep learning includes:

[0079] Step S10, obtaining a code to be detected, and performing data processing on the code to be detected to obtain feature data after data processing;

[0080] Step S20, inputting the feature data into a pre-built detection model;

[0081] Step S30: The detection model outputs a malicious code determination result.

[0082] In this embodiment, a malicious code detection method based on deep learning is provided, which is used to detect malicious JavaScript code in browsers and web pages. In the malicious code detection system, for the convenience of description, the malicious code detection system is referred to below. JavaScript is a lightweight, interpreted or just-in-time compiled programming language with function priority, which can implement complex functions on web pages, such as being able to change HTML content. Due to the universality of JavaScript, JavaScript has been used to perform various network attacks. An attacker can use JavaScript to automatically download and install malware on a computer without the user's knowledge, or perform a cross-site scripting (XSS) attack, in which the attacker injects malicious scripts into legitimate websites, and when users visit such websites, steal user sensitive information (such as passwords, cookies, and accounts), as well as a cross-site request forgery (XSRF) attack, which tricks users who have passed the Web application authentication to perform unnecessary operations, and inserts illegal malicious advertisements into web pages. Therefore, in this embodiment, the code to be detected is obtained, and the data of the code to be detected is processed to obtain feature data after data processing, and then the feature data is input into a pre-built detection model, and the detection result of the code to be detected is obtained by the detection model.

[0083] The following is a detailed description of each step:

[0084] Step S10, obtaining a code to be detected, preprocessing the code to be detected, and obtaining data to be detected after data processing;

[0085] In one embodiment, a code to be detected is obtained, and data processing is performed on the code to be detected to obtain corresponding data to be detected. Specifically, when detecting an unknown web page, the code to be detected is obtained by extracting the embedded JavaScript code, and the obtained code to be detected is first input into a preprocessing module for data processing, and its token is extracted, and the characters in the code to be detected are converted into a one-hot encoding format, and the data in the one-hot encoding format and the token are used together as feature data after data processing.

[0086] Step S20, input the data to be detected into a pre-built detection model, and the detection model outputs a malicious code judgment result, wherein the detection model is constructed based on word-level word vector representation and character-level one-hot encoding.

[0087] In one embodiment, the data to be detected obtained by the preprocessing module is input into a pre-built detection model for detection, and the detection model is used to detect whether it is malicious code. After the data to be detected is input into the pre-built detection model, the word vector representation of the word unit is first obtained by the first layer of the detection model and then input into the second layer of the detection model together with the character-level unique hot encoding. It should be noted that the pre-built detection model is specifically constructed according to the input data to be detected. In this embodiment, the input feature data is the word unit-level word vector representation and the character-level (token) unique hot encoding, so the same level of feature data is also used when constructing the model. After the detection model is constructed, when detection is needed, it is only necessary to load the saved detection model, and the data to be detected obtained by the preprocessing module as input can be used to detect whether it is a malicious program.

[0088] This embodiment obtains the data to be detected by preprocessing the code to be detected, and then automatically extracts the features of the token through the detection model to obtain the word vector representation of the token. The word vector representation of the token and the one-hot encoding of the characters are then input into the detection model. The detection model predicts the malicious code detection result, thereby realizing automatic detection of malicious code and improving the accuracy of detecting malicious code.

[0089] Furthermore, based on the first embodiment of the malicious code detection method based on deep learning of the present invention, a second embodiment of the malicious code detection method based on deep learning of the present invention is proposed.

[0090] Reference Figure 3 , Figure 3 The detailed flow diagram of step S10 in the first embodiment of the present invention is shown in FIG. 2 . The difference between the second embodiment of the malicious code detection method based on deep learning of the present invention and the first embodiment of the malicious code detection method based on deep learning is that the steps of obtaining the code to be detected, preprocessing the code to be detected, and obtaining the data to be detected after data processing include:

[0091] Step S11, obtaining a code to be detected, performing data processing on the code to be detected, and obtaining a target code after data processing;

[0092] Step S12, dividing the target code to obtain corresponding target word units;

[0093] Step S13, converting the target code into a one-hot encoding format to obtain a second one-hot encoding data set;

[0094] Step S14, using the target word and the second one-hot encoding data set as data to be detected;

[0095] This embodiment obtains the code to be detected and preprocesses the code to be detected. The preprocessing includes: data processing, dividing the target word units and extracting the character one-hot encoding, extracting feature data of different dimensions, thereby avoiding the problem of inaccurate results obtained by the detection model only detecting the character-level word vector representation when the text to be detected is short, thereby improving the accuracy of detection using the detection model.

[0096] The following is a detailed description of each step:

[0097] Step S11, obtaining a code to be detected, performing data processing on the code to be detected, and obtaining a target code after data processing;

[0098] In one embodiment, the code to be detected is first processed to obtain a first code. The data processing includes, for example, screening the code to be detected and deleting the garbled code in the code to be detected. It is understandable that when the script to be detected is obtained from a website, the obtained data may be erroneous, for example, some emoticons and Chinese characters may be converted into garbled code in Javascript, so the obtained data is processed to screen out useless data and reduce the workload of subsequent detection.

[0099] Step S12, dividing the target code to obtain corresponding target word units;

[0100] In one embodiment, the preprocessed target code is string-segmented to obtain target tokens. It is understandable that to obtain features from a text, the text needs to be split first. The feature here is a token from the text. A token is any combination of characters, that is, a continuous character segment. The commonality of a token is that such a word or a phrase corresponds to only one semantic vector (embedding). The first code can be split according to matching a given regular expression to split the string. Or use the function substr, substr(start,length) to indicate intercepting a string of length starting from the start position, and so on.

[0101] Step S13, converting the target code into a one-hot encoding format to obtain a second one-hot encoding data set;

[0102] In one embodiment, the characters in the target code are converted into a one-hot encoding format to obtain a second one-hot encoding data set. The difference between the second one-hot encoding data set and the first one-hot encoding data set is that the second one-hot encoding data set is obtained from the code to be detected, and the first one-hot encoding data set is obtained from a labeled training set. One-hot encoding is also called one-bit effective encoding, One-Hot encoding. One-hot encoding is a representation of a categorical variable as a binary vector, which can ensure that only one bit of a single feature in each sample is in state 1, and the others are all 0. It can be understood that if it is to be used as the input of a machine learning algorithm, we usually need to digitize the features of the data to be detected, so it needs to be done through one-hot encoding conversion. The specific conversion process to one-hot encoding can be achieved through existing technologies and will not be repeated here.

[0103] Step S14: taking the target word-unit and the second one-hot encoding data set as data to be detected.

[0104] In one embodiment, the target word unit and the one-hot encoding are used as feature data. That is, two levels of data of the preprocessed first code are obtained, one is the character-level one-hot encoding, and the other is the word unit, and then the word vector representation of the word unit is obtained through the pre-built detection model, and then the character-level one-hot encoding and the word unit-level word vector representation are detected. The two levels of data can complement each other to obtain more accurate malicious code detection results.

[0105] Furthermore, in one embodiment, the step of performing data processing on the code to be detected to obtain a target code after data processing includes:

[0106] Step S111, obtaining numerical data in the code to be detected;

[0107] Step S112, normalizing the numerical data to obtain the target code.

[0108] In one embodiment, the step of data processing the code to be detected also includes obtaining numerical data in the code to be detected and normalizing the numerical data. Specifically, in order to better process numerical data such as random numerical values, IP addresses, random domain names (including numbers in many cases), dates, version numbers, etc. in the code, these numerical values ​​are normalized and numbers are replaced with '*' to eliminate the influence of the same (or almost the same) code on subsequent processing, thereby improving the detection result.

[0109] Furthermore, in one embodiment, the step of dividing the target code to obtain corresponding target word units includes:

[0110] Step S121, obtaining a preset number of special characters as separators, and dividing the target code into first word units;

[0111] In one embodiment, a preset number of special characters are obtained as delimiters to divide the target code. Because the target code is a whole paragraph of text, it is not realistic to detect the whole paragraph of data. It is necessary to extract features in the text to facilitate subsequent detection. Therefore, the text is divided first. Specifically, in JavaScript, in addition to strings, there are other punctuation marks, and the string needs to start and end with double quotes (") or single quotes ('), then single quotes and double quotes can be used as special characters to split the string. Of course, there are other special characters that can be used to split the string, such as: space, brackets (}), semicolon (;), colon (:), equal sign (=), backslash (\) and special characters composed of backslash, such as the Enter key (\r), etc. Among them, the number of special characters can be set according to actual conditions.

[0112] Step S122, selecting first word-grams whose length is not less than a preset threshold in the first word-grams to obtain second word-grams;

[0113] In one embodiment, the first word unit obtained after the division is screened, and the word units in the first word unit whose length is not less than the preset threshold are retained to obtain the second word unit. Because a single character itself has no meaning, in one embodiment, only tokens with a length of at least 2 are retained, and of course, tokens with a length of at least 3 can also be retained. The preset threshold can be set according to the actual situation, but if the preset threshold is set too large, it is easy to miss the detection problem.

[0114] Step S123: convert the second word into lowercase to obtain a target word.

[0115] In one embodiment, the filtered second token is converted to lowercase. Since JavaScript code is case-sensitive, the token needs to be converted to lowercase to unify the format for easy subsequent processing.

[0116] Further, in one embodiment, the step of converting the target word into a one-hot encoding format to obtain a second one-hot encoding data set includes:

[0117] Step S131, obtaining the preset number of characters;

[0118] Step S132, converting the characters into a one-hot encoding format to obtain a second one-hot encoding data set.

[0119] In one embodiment, a preset number of characters are obtained, and then the preset number of characters are converted into a one-hot encoding format to obtain a second one-hot encoding data set. The Javascipt file can exist as a .js file alone, or it can be inserted into an Html web page. When inserted into an Html web page, it is usually shorter. When the text is shorter or the text data may be less, only a few tokens are segmented, so we extract the One-hot of the characters as a supplement to improve the prediction effect. If the script to be detected is short, then when extracting a preset number of characters, all the characters of the script can be included. Because it is a character-level conversion, if all the characters in a text are converted into One-hot encoding, the amount of data is very large, resulting in a large calculation space. For this reason, we also need to extract some characters in the word unit. The specific preset number can be determined by experimental data. After testing by researchers, the first 1,000 characters can be selected for conversion. According to the situation where the characters are 26 English letters, selecting 1,000 characters to convert into a matrix is ​​already very large, so when determining the preset number, the volume of data should be considered. Therefore, a preset number of characters are first obtained, and then the characters are formatted and converted into a one-hot encoding format to obtain a second one-hot encoding data set. It should be noted that the preset number of characters obtained here is a preset number of characters obtained from all word units from top to bottom. Assuming that the preset number is n, the first n characters in the word unit are obtained.

[0120] This embodiment obtains the code to be detected and performs data processing, further obtains the numerical data in the code to be detected, normalizes the numerical data, obtains the target code, and then divides the first code into first word units using a preset number of special characters as separators, screens the first word units whose length is not less than a preset threshold in the first word units, obtains the second word units, and then converts the second word units to lowercase to obtain the corresponding target word units, and then obtains a preset number of characters in the target, and converts the characters into a one-hot encoding format. This embodiment performs data processing on the obtained code to be detected, improves the data quality, and inputs two levels of code to be detected when subsequently inputting the detection model: character-level one-hot encoding and word units, avoiding the problem of too few features due to too few codes to be detected, thereby improving the accuracy of detection.

[0121] Further, refer to Figure 4 , Figure 4 The present invention provides a schematic diagram of a pre-training model generation process for a third embodiment of a malicious code detection method based on deep learning according to the present invention, and proposes a third embodiment of a malicious code detection method based on deep learning according to the present invention.

[0122] The third embodiment of the malicious code detection method based on deep learning of the present invention is different from the first and second embodiments in that, before the step of obtaining the code to be detected, inputting the code to be detected into a pre-built preprocessing module, and obtaining feature data after data processing, the method further includes:

[0123] Step S40, obtaining a labeled data set and an unlabeled data set, and dividing the labeled data set into a labeled training set and a labeled test set;

[0124] Step S50, divide the sample codes in the unlabeled data set and the labeled training set to obtain corresponding sample word units, input the sample word units into a pre-training model, and obtain a word vector representation data set of the sample word units.

[0125] In this embodiment, we obtain a sample downloaded from a website, and we clearly know that this sample is malicious. Then we collect some normal codes, such as obtaining a web page from Baidu, so we also clearly know that this website is normal, but I obtain codes from some other web pages that are not frequently visited, so we don’t know whether this web page has malicious code. Therefore, this part of the data set where we don’t know whether there is malicious code is our unlabeled data set. The labeled ones are divided into training sets and test sets. After the model is obtained by training the training set, the model accuracy is calculated using the test set. All word vectors are obtained, which is equivalent to constructing a dictionary. The existing malicious code data set includes a labeled data set and an unlabeled data set, and the labeled data set is divided into a labeled training set and a labeled test set, and then the unlabeled data set and part of the training set in the labeled training set are input into the initial pre-training model to train the pre-training model, and the pre-training model is used to construct the word vector corresponding to the word unit.

[0126] The following is a detailed description of each step:

[0127] Step S40, obtaining a malicious code data set, including a labeled data set and an unlabeled data set, and dividing the labeled data set into a labeled training set and a labeled test set;

[0128] In one embodiment, a malicious code data set is obtained, including a labeled data set and an unlabeled data set, and then the labeled data set is divided into a labeled training set and a labeled test set. The malicious code data set is a series of data with and without malicious code. Since malicious code is to be detected by machine learning, it is first necessary to obtain samples of malicious code for machine learning. Generally speaking, there are several ways to obtain malicious code samples. (1) User-side sampling, which is the main acquisition method of most antivirus software manufacturers. The end user who uses the antivirus software uploads the malicious code sample to the manufacturer. This method has good real-time performance and can cooperate with security manufacturers to obtain sample data. (2) Public network databases, such as VirusBulletin, Open Malware, VX Heavens, etc., obtain these shared data. (3) Other technical approaches, crawl data through crawler tools such as honeypots (such as Nepenthes honeypots). Among them, the label is the thing we want to predict, that is, the y variable in simple linear regression, and the feature is the input variable, that is, the x variable in simple linear regression. Then the labeled samples are samples that contain both features and labels, and the unlabeled samples are samples that contain features but no labels. In order to evaluate the model effect, the labeled data set is further divided into a labeled training set and a labeled test set. It depends on whether the leave-one-out method or cross-validation method is used later. If the leave-one-out method is used, the data set can be statically divided into training set and test set according to a certain ratio.

[0129] Step S50, divide the sample codes in the unlabeled data set and the labeled training set to obtain corresponding sample word units, input the sample word units into a pre-training model, and obtain a word vector representation data set of the sample word units.

[0130] In one embodiment, an unlabeled data set and a labeled training set are divided to obtain sample word units, and the sample word units are input into a pre-training model to obtain a word vector representation data set of the sample word units. Specifically, on the labeled training set and the unlabeled data set, a word vector corresponding to each token is obtained using a word2vec or fasttext model. The word vectors corresponding to these tokens are equivalent to a dictionary, and then the tokens of the code to be detected are searched for the corresponding word vectors in this dictionary. In this embodiment, both the unlabeled data set and the labeled data set are put into a pre-training model to generate word vectors, so that a large amount of vector data is extracted, which is convenient for the subsequent word vector extraction of the code to be detected. Among them, the pre-training model is constructed in the model training stage.

[0131] Furthermore, in one embodiment, after the pre-training model is obtained through training, the method further includes:

[0132] Step S51, using the word vector representation data set as a parameter of the first layer deep learning model;

[0133] Step S52, dividing the labeled training set to obtain training word units corresponding to the labeled training set;

[0134] Step S53, inputting the training word unit into the deep learning model to obtain a first word vector representation of the training word unit;

[0135] Step S54, performing one-hot encoding conversion on the characters in the labeled training set to obtain a first one-hot encoding data set;

[0136] Step S55, input the first word vector representation and the first one-hot encoding data set into the deep learning model for supervised training, and calculate the accuracy through the labeled test set to construct a detection model.

[0137] This embodiment further embeds the word vector representation dataset into the deep learning model, performs word unit division on the labeled training set, obtains the word vector representation of the training word unit by the deep learning model, and performs one-hot encoding conversion on the characters in the labeled training set to obtain a one-hot encoded dataset. The one-hot encoded dataset and the word unit word vector representation are input into the deep learning network, and supervised training is performed with the labeled training set to construct a detection model.

[0138] The following is a detailed description of each step:

[0139] Step S51, using the word vector representation data set as a parameter of the first layer deep learning model;

[0140] In one embodiment, the data set obtained by the pre-training model is used as the parameter of the first-layer deep learning model, that is, it is embedded in the deep learning model. After embedding the deep learning model, when a word unit is input, the deep learning model can find the word vector corresponding to the word unit for subsequent calculation.

[0141] Step S52, dividing the labeled training set to obtain training word units corresponding to the labeled training set;

[0142] In one embodiment, the labeled training set is divided to obtain training tokens corresponding to the labeled training set. Since a detection model based on character-level unique hot encoding and token-level word vector needs to be constructed, the data used in the construction must be corresponding, so the data in the labeled training set is divided to obtain training tokens.

[0143] Step S53, inputting the training word unit into the deep learning model to obtain a first word vector representation of the training word unit;

[0144] In one embodiment, the first word vector representation of the training word is obtained by the deep learning model. In step S52, the word vector representation data set has been used as a parameter of the first-layer deep learning model, so the training word is directly input into the deep learning model, and the word vector corresponding to the training word is obtained inside the deep learning model. The word vector corresponding to the token is used for calculation.

[0145] Step S54, performing one-hot encoding conversion on the characters in the labeled training set to obtain a first one-hot encoding data set;

[0146] In one embodiment, the characters in the labeled training set are converted into a one-hot encoding format to obtain a first one-hot encoding data set converted into a binary one-hot encoding format. Considering that the input detection data format is a one-hot encoding format, it is necessary to learn how to identify malicious code in a one-hot encoding format when building the model. Therefore, we convert the data in the training set into a one-hot encoding format.

[0147] Step S55, input the first word vector representation and the first one-hot encoding data set into the deep learning model for supervised training, and calculate the accuracy through the labeled test set to construct a detection model.

[0148] In one embodiment, the first word vector representation and the first unique hot encoding data set obtained from the first layer of the model are input into the deep learning network, supervised training is performed using a labeled training set, and the accuracy is calculated by a labeled test set to obtain a detection model. Specifically, in the training phase: the word vector and one-hot of the labeled training set are input into the deep learning model to construct a detection model. In the testing phase: the labeled test set is treated as the code to be detected to calculate the model detection accuracy. By extracting the character-level one-hot encoding and the token-level word vector representation at the same time, the deep learning model can learn features based on a combination from two levels to improve the performance of the model. The deep learning framework used in this embodiment is Keras. Similarly, other deep learning frameworks such as TensorFlow and PyTorch can be used. Among them, a deep learning framework is an interface, library or tool that enables us to build deep learning models more easily and quickly without having to deeply understand the details of the underlying algorithm. The deep learning framework defines the model using a pre-built and optimized set of components, providing a clear and concise method for the implementation of the model. Among them, common deep learning models mainly include fully connected (FC) network structure, convolutional neural network (CNN) and recurrent neural network (RNN).

[0149] like Figure 5 The schematic diagram of the relationship between the pre-trained model and the detection model of the third embodiment of the malicious code detection method based on deep learning of the present invention is shown, and the overall model generation process is explained, which includes two stages. In the first stage, the pre-trained model is trained using an unlabeled data set and a labeled partial training set to obtain the word vector representation (embedding) of the token. In the second stage, a deep learning model is constructed, and the embedding obtained in the first stage is used as the parameter of the first layer of token input, followed by multi-layer CNN and LSTM-RNN neural network units. The input of the deep neural network consists of character-level unique hot encoding and character-level word vector representation, and then supervised training is performed using a labeled training set to construct a detection model to detect JavaScript malicious code.

[0150] refer to Figure 6 , Figure 6 This is a schematic diagram of the model structure of an embodiment of malicious code detection based on deep learning of the present invention, which illustrates the malicious code detection method of the present invention. The structure converts the input JavaScript code into character-level one-hot encoding and token-level word vector representation (which has the same meaning as the token embedding in the figure). The character-level one-hot encoding and token-level word vector representation are respectively input into the convolution layer, the pooling layer, and the Dropout layer, and then they are connected and input into the LSTM layer, and finally the prediction result is output.

[0151] Among them, the convolution layer is used for feature extraction. Max Pooling is the most common downsampling operation in the CNN model in NLP. Max Pooling refers to selecting the maximum value in the pooling window. It means that for a certain filter, when a number of feature values ​​are extracted, only the value with the largest score is taken as the reserved value of the Pooling layer, and all other feature values ​​are discarded. The maximum value means that only the strongest of these features are retained, while other weak features of this type are discarded to reduce the dimension. Max Pooling can reduce the number of model parameters and help reduce the problem of model overfitting. Global Max Pooling is to set the pool size equal to the input size so that max calculates the entire input as the output value. Dropout layer refers to the process of training a deep learning network. For a neural network unit, it is temporarily discarded from the network according to a certain probability. Therefore, this model uses the dropout layer to prevent overfitting and improve the stability and robustness of the model. Bidirectional Long Short-Term Memory is a time recurrent neural network (RNN). It should be noted that convolution, pooling, Dropout and LSTM are all structures of neural networks. Similarly, they can be replaced by similar neural network layers, such as RNN and GRU.

[0152] This embodiment obtains a malicious code dataset, including a labeled dataset and an unlabeled dataset, and divides the labeled dataset into a labeled training set and a labeled test set. Then, the unlabeled dataset and part of the labeled training set are input into a pre-training model. The pre-training model obtains the word vector representation of the word unit, and the characters in the labeled training set are converted into a one-hot encoding to obtain a one-hot encoding dataset. The word vector representation and the one-hot encoding dataset are input into a deep learning network, and the accuracy is calculated through the labeled training set to construct a detection model. The constructed detection model achieves three beneficial effects: (1) The unlabeled malicious code dataset is put into the pre-training model to enhance the performance of the pre-training model. (2) The character-level one-hot encoding and token-level word vector representation are extracted simultaneously, so that the deep learning model can learn features based on the combination from the two levels, thereby improving the performance of the model. (3) The deep learning model automatically extracts features through character-level one-hot encoding and token-level word vectors, without the need to manually design features or extract semantic features of the code through abstract syntax trees.

[0153] Reference Figure 7 , Figure 7The following is a functional module diagram of an embodiment of a malicious code detection device based on deep learning of the present invention. The present invention also provides a malicious code detection device. The malicious code detection device of the present invention includes:

[0154] The acquisition module 10 is used to acquire the code to be detected, pre-process the code to be detected, and obtain the data to be detected after data processing;

[0155] The detection module 20 is used to input the data to be detected into a pre-built detection model, and the detection model outputs a malicious code judgment result. The detection model is constructed based on word-level word vector representation and character-level one-hot encoding.

[0156] Optionally, the detection module is further used for:

[0157] Obtain a labeled data set and an unlabeled data set, and divide the labeled data set into a labeled training set and a labeled test set;

[0158] The sample codes in the unlabeled data set and the labeled training set are divided to obtain corresponding sample word units, and the sample word units are input into a pre-training model to obtain a word vector representation data set of the sample word units.

[0159] Optionally, the detection module is further used for:

[0160] Using the word vector representation dataset as a parameter of the first layer deep learning model;

[0161] Dividing the labeled training set to obtain training word units corresponding to the labeled training set;

[0162] and inputting the training word unit into the deep learning model to obtain a first word vector representation of the training word unit;

[0163] Performing one-hot encoding conversion on the characters in the labeled training set to obtain a first one-hot encoding data set;

[0164] The first word vector representation and the first one-hot encoding data set are input into a deep learning model for supervised training, and the accuracy is calculated through the labeled test set to construct a detection model.

[0165] Optionally, the acquisition module is further used for:

[0166] Acquire the code to be detected, perform data processing on the code to be detected, and obtain the target code after data processing;

[0167] Dividing the target code to obtain corresponding target word units;

[0168] Convert the target code into a one-hot encoding format to obtain a second one-hot encoding data set;

[0169] The target word-unit and the second one-hot encoding data set are used as data to be detected.

[0170] Optionally, the acquisition module is further used for:

[0171] Obtaining numerical data in the code to be detected;

[0172] The numerical data is normalized to obtain the target code.

[0173] Optionally, the acquisition module is further used for:

[0174] Obtain a preset number of special characters as separators to divide the target code into first word units;

[0175] Filter the first word-units whose length is not less than a preset threshold value in the first word-units to obtain a second word-unit;

[0176] The second word is converted into lowercase to obtain a target word.

[0177] Optionally, the acquisition module is further used for:

[0178] Obtaining a preset number of characters in the target code;

[0179] The characters are converted into a one-hot encoding format to obtain a second one-hot encoding data set.

[0180] In addition, an embodiment of the present invention further provides a storage medium on which a malicious code detection program is stored, and when the malicious code detection program is executed by a processor, the steps of the malicious code detection method described above are implemented.

[0181] Among them, the method implemented when the malicious code detection program running on the processor is executed can refer to the various embodiments of the malicious code detection method of the present invention, and will not be repeated here.

[0182] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0183] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0184] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0185] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A malicious code detection method based on deep learning, characterized in that: The malicious code detection method based on deep learning includes the following steps: Acquire the code to be detected, pre-process the code to be detected, and obtain the data to be detected after data processing; Input the data to be detected into a pre-built detection model, and the detection model outputs a malicious code judgment result, wherein the detection model is constructed based on word-level word vector representation and character-level one-hot encoding; Before the step of inputting the data to be detected into a pre-built detection model, and outputting a malicious code judgment result by the detection model, wherein the detection model is constructed based on a word-level word vector representation and a character-level one-hot encoding, the method further includes: Obtain a labeled data set and an unlabeled data set, and divide the labeled data set into a labeled training set and a labeled test set; Dividing the sample codes in the unlabeled data set and the labeled training set to obtain corresponding sample word units, inputting the sample word units into a pre-training model, and obtaining a word vector representation data set of the sample word units; Using the word vector representation dataset as a parameter of the first layer deep learning model; Dividing the labeled training set to obtain training word units corresponding to the labeled training set; and inputting the training word unit into the deep learning model to obtain a first word vector representation of the training word unit; Performing one-hot encoding conversion on the characters in the labeled training set to obtain a first one-hot encoding data set; The first word vector representation and the first one-hot encoding data set are input into a deep learning model for supervised training, and the accuracy is calculated through the labeled test set to construct a detection model.

2. The deep learning-based malicious code detection method according to claim 1, characterized in that: The steps of obtaining the code to be detected, preprocessing the code to be detected, and obtaining the processed data to be detected include: Acquire the code to be detected, perform data processing on the code to be detected, and obtain the target code after data processing; Dividing the target code to obtain corresponding target word units; Convert the target code into a one-hot encoding format to obtain a second one-hot encoding data set; The target word-unit and the second one-hot encoding data set are used as data to be detected.

3. The malicious code detection method based on deep learning as claimed in claim 2, characterized in that: The step of performing data processing on the code to be detected to obtain a target code after data processing comprises: Obtaining numerical data in the code to be detected; The numerical data is normalized to obtain the target code.

4. The deep learning-based malicious code detection method according to claim 2, characterized in that: The step of dividing the target code to obtain corresponding target word units includes: Obtain a preset number of special characters as separators to divide the target code into first word units; Filter the first word-units whose length is not less than a preset threshold value in the first word-units to obtain a second word-unit; The second word is converted into lowercase to obtain a target word.

5. The malicious code detection method based on deep learning as claimed in claim 2, characterized in that: The step of converting the target code into a one-hot encoding format to obtain a second one-hot encoding data set comprises: Obtaining a preset number of characters in the target code; The characters are converted into a one-hot encoding format to obtain a second one-hot encoding data set.

6. A malicious code detection device based on deep learning, characterized in that: The device includes: a memory, a processor, and a deep learning-based malicious code detection program stored in the memory and executable on the processor, wherein the deep learning-based malicious code detection program is configured to implement the steps of the deep learning-based malicious code detection method as described in any one of claims 1 to 5.

7. A storage medium, characterized in that: The storage medium stores a deep learning-based malicious code detection program, and when the deep learning-based malicious code detection program is executed by the processor, the steps of the deep learning-based malicious code detection method according to any one of claims 1 to 5 are implemented.

Images