Malware detection model training, malware detection method and device

Abstract

The present invention provides a malware detection model training, malware detection method, and device. The malware detection model training method includes: obtaining multiple malware; determining a training synthetic behavior graph corresponding to each malware; adding a first label to the training synthetic behavior graph; obtaining one or more training public behavior graphs based on the training synthetic behavior graphs, each training public behavior graph corresponding to a malware family, and adding a second label to the training public behavior graphs; inputting the training synthetic behavior graphs and the training public behavior graphs into a graph matching model to obtain a first similarity coefficient; if the difference between the first similarity coefficient and the second similarity coefficient is less than a preset similarity coefficient, determining the current graph matching model as a malware detection model. By extracting the training public behavior graphs, the present invention narrows the detection range when detecting malware, improves the detection speed of the malware detection model, and improves the accuracy of the detection results.

Description

Technical Field

[0001] The present invention belongs to the technical field of security monitoring, and in particular relates to a malware detection model training, a malware detection method and a malware detection device. Background Art

[0002] With the continuous development of mobile Internet, the number of power mobile terminals in the power industry is growing. However, the rapid growth of malware has brought huge harm to power mobile terminal users, including fee consumption, privacy theft, and remote control. Industrial control systems in key areas such as the power industry, as important infrastructure related to national economy and people's livelihood, have always been the focus of network security attacks and are easily the primary target of cyber warfare. Therefore, a fast and efficient malware detection method is needed to protect the security of power mobile Internet terminals.

[0003] Currently, malware detection technology can be divided into three categories: static analysis technology, dynamic analysis technology, and machine learning-based analysis technology.

[0004] Static analysis analyzes the entire app's code and resources, achieving high code coverage. However, since the application is not actually executed, this method cannot obtain the software's true execution path and execution context, and cannot avoid interference caused by code obfuscation and dynamic code loading.

[0005] Dynamic analysis analyzes malicious behavior based on the runtime behavior of an app. Typically, apps run on an Android virtual machine or a real physical machine. Dynamic analysis technology can avoid code obfuscation and interference caused by dynamic code loading. However, this method has problems such as low code coverage, long analysis time, and low efficiency.

[0006] The basic principle of machine learning-based malware detection methods is to extract different features through program analysis and other techniques to describe the different behaviors of the sample to be analyzed. Each feature sample is then represented by a fixed-dimensional vector. Finally, existing machine learning algorithms are used to train known feature samples and build a classifier, thereby enabling prediction and judgment of unknown samples. However, most existing feature extraction methods directly analyze the software itself, resulting in features in the form of strings that are easily tampered with by existing obfuscation technologies, thereby bypassing malware detection. Therefore, accurate malware detection cannot be achieved through traditional machine learning algorithms. Summary of the Invention

[0007] Therefore, in response to the problems in the prior art, the present invention provides a malware detection model training, a malware detection method and an apparatus to solve the problems in the prior art.

[0008] In a first aspect, the present invention provides a malware detection model training method, comprising: obtaining a software sample library, the software sample library including multiple malware; analyzing the malware in the software sample library to obtain a training synthetic behavior graph corresponding to each malware; adding a first label to the training synthetic behavior graph; obtaining one or more training public behavior graphs based on the training synthetic behavior graph, each training public behavior graph corresponding to a malware family, and adding a second label to the training public behavior graph; inputting the training synthetic behavior graph and the training public behavior graph into a graph matching model to obtain a first similarity coefficient between the training synthetic behavior graph and the training public behavior graph; determining a second similarity coefficient between the first label and the second label, subtracting the first similarity coefficient and the second similarity coefficient, and if the difference between the first similarity coefficient and the second similarity coefficient is less than a preset similarity coefficient, determining the current graph matching model as a malware detection model.

[0009] Optionally, in the malware detection model training method provided by the present invention, the malware in the software sample library is analyzed to obtain a training synthetic behavior graph corresponding to each malware, including: decompiling the malware in the software sample library to obtain decompiled code and a manifest configuration file; generating a training basic behavior graph based on the decompiled code; generating a test script based on the decompiled code and the manifest configuration file, and using the test script to dynamically test the malware to obtain dynamic operation information; and generating a training synthetic behavior graph through the dynamic operation information and the training basic behavior graph.

[0010] Optionally, in the malware detection model training method provided by the present invention, the training synthetic behavior graph includes one or more maximal connected subgraphs, the maximal connected subgraphs include one or more edges, and one or more training public behavior graphs are obtained based on the training synthetic behavior graph, including: classifying and combining the training synthetic behavior graphs according to the first label to obtain one or more training synthetic behavior graph sets; determining the weights of the edges of each maximal connected subgraph in each training synthetic behavior graph set; and determining the training public behavior graphs corresponding to each training synthetic behavior graph set based on the weights of the edges of each maximal connected subgraph in each training synthetic behavior graph set.

[0011] Optionally, in the malware detection model training method provided by the present invention, based on the edge weights of each maximal connected subgraph in the training synthetic behavior graph set, a training common behavior graph corresponding to the training synthetic behavior graph set is determined, including: determining the average edge weights of each maximal connected subgraph and the average weight value between subgraphs of the training synthetic behavior graph set according to the edge weights of each maximal connected subgraph in the training synthetic behavior graph set, the average weight value between subgraphs being the mean of the average edge weights of the maximal connected subgraphs in the training synthetic behavior graph set; deleting the edges with weights less than a preset value in the maximal connected subgraphs whose average edge weights are greater than the average weight value between subgraphs to form an intermediate graph; and determining the intermediate graph with the largest sum of edge weights as the training common behavior graph corresponding to the training synthetic behavior graph set.

[0012] Optionally, the malware detection model training method provided by the present invention also includes: if the difference between the first similarity coefficient and the second similarity coefficient is greater than or equal to the preset similarity coefficient, the graph matching model is optimized and trained using the back propagation algorithm, and the training synthetic behavior graph and the training public behavior graph are returned to the step of inputting the training synthetic behavior graph and the training public behavior graph into the graph matching model to obtain the first similarity coefficient between the training synthetic behavior graph and the training public behavior graph, until the difference between the first similarity coefficient and the second similarity coefficient is less than the preset similarity coefficient.

[0013] In a second aspect, the present invention provides a malware detection method, comprising: obtaining a synthetic behavior graph of the software to be detected; inputting the synthetic behavior graph and the common behavior graph of the malware into a malware detection model, calculating the similarity between the synthetic behavior graph and the common behavior graph, and if the similarity is greater than a preset similarity, determining that the software to be detected is malware, and the malware detection model is determined by any one of the malware detection model training methods of the present invention.

[0014] Optionally, in the malware detection method provided by the present invention, obtaining a synthetic behavior graph of the software to be detected includes: decompiling the software to be detected to obtain the decompiled code of the software to be detected; generating a control flow graph based on the decompiled code of the software to be detected; obtaining a basic behavior graph of the software to be detected based on the control flow graph; dynamically analyzing the software to be detected to collect dynamic operation information of the software to be detected, and adding the dynamic operation information of the software to be detected to the basic behavior graph to obtain a synthetic behavior graph.

[0015] In a third aspect, the present invention provides a malware detection model training device, comprising: a data acquisition module for acquiring a software sample library, the software sample library including multiple malware; a data analysis module for analyzing the malware in the software sample library to obtain a training synthetic behavior graph corresponding to each malware; a label adding module for adding a first label to the training synthetic behavior graph; an extraction module for obtaining one or more training public behavior graphs based on the training synthetic behavior graph, each training public behavior graph corresponding to a malware family, and adding a second label to the training public behavior graph; an input module for inputting the training synthetic behavior graph and the training public behavior graph into a graph matching model to obtain a first similarity coefficient between the training synthetic behavior graph and the training public behavior graph; a model determination module for determining a second similarity coefficient between the first label and the second label, subtracting the first similarity coefficient and the second similarity coefficient, and if the difference between the first similarity coefficient and the second similarity coefficient is less than the preset similarity coefficient, the current graph matching model is determined as a malware detection model.

[0016] In a fourth aspect, the present invention provides a malware detection device, comprising: a graph acquisition module for acquiring a synthetic behavior graph of the software to be detected; a graph processing module for inputting the synthetic behavior graph and the public behavior graph of the malware into a malware detection model, calculating the similarity between the synthetic behavior graph and the public behavior graph, and if the similarity is greater than a preset similarity, determining that the software to be detected is malware, and the malware detection model is determined by any one of the malware detection model training methods of the present invention.

[0017] In a fifth aspect, the present invention provides a computer device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, thereby executing the malware detection model training method provided in the first aspect of the present invention, or the malware detection method provided in the second aspect of the present invention.

[0018] The technical solution of the present invention has the following advantages:

[0019] The malware detection model training method provided by the present invention analyzes malware in a software sample library to obtain a training synthetic behavior graph, extracts training common behavior graphs of different malware families from the training synthetic behavior graph, and inputs the training synthetic behavior graph and the training common behavior graph into a graph matching model for training to obtain a malware detection model. In the malware detection model training method provided by the present invention, extracting the training common behavior graph narrows the detection range when detecting malware, thereby improving the detection speed of the malware detection model and the accuracy of the detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0021] Figure 1 This is a flowchart of a specific example of a malware detection model training method according to an embodiment of the present invention;

[0022] Figure 2 A flowchart of a specific example of a method for forming an intermediate graph in an embodiment of the present invention;

[0023] Figure 3 This is a flowchart of a specific example of a malware detection method according to an embodiment of the present invention;

[0024] Figure 4 This is a schematic structural diagram of a specific example of a malware detection model training device according to an embodiment of the present invention;

[0025] Figure 5 1 is a schematic structural diagram of a specific example of a malware detection device according to an embodiment of the present invention;

[0026] Figure 6 Schematic diagram of the structure of a specific example of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0028] Unless the context clearly requires otherwise, throughout the specification and claims, the words "include," "comprising," and similar words should be construed in an inclusive sense rather than an exclusive or exhaustive sense; that is, in the sense of "including but not limited to."

[0029] In the description of the present invention, it should be understood that the terms "first", "second", etc. are used for descriptive purposes only and should not be understood to indicate or imply relative importance. In addition, in the description of the present invention, unless otherwise specified, "plurality" means two or more.

[0030] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0031] The embodiment of the present invention provides a malware detection model training method, such as Figure 1 As shown, the method includes:

[0032] Step S1: Obtain a software sample library, which includes multiple malware.

[0033] In an optional embodiment, malware is obtained through the Drebin dataset, wherein each malware includes a corresponding family label, and the family label is manually verified to have a high degree of accuracy.

[0034] Step S2: Analyze the malware in the software sample library to obtain a training synthetic behavior graph corresponding to each malware.

[0035] In an optional embodiment, the malware in the software sample library is analyzed by combining static analysis and dynamic analysis to obtain a training synthetic behavior graph corresponding to each malware.

[0036] In an embodiment of the present invention, by combining static analysis and dynamic analysis of malware, the obtained training synthetic behavior graph has high code coverage and avoids interference caused by code obfuscation and dynamic code loading.

[0037] Step S3: Add a first label to the training synthetic behavior graph.

[0038] In an optional embodiment, a family label of malware corresponding to the training synthetic behavior graph is added to the training synthetic behavior graph.

[0039] Step S4: obtaining one or more training public behavior graphs according to the training synthetic behavior graph, each training public behavior graph corresponding to a malware family, and adding a second label to the training public behavior graph.

[0040] In an optional embodiment, a training public behavior graph corresponding to the malicious family can be obtained based on the training synthetic behavior graphs belonging to the same malicious family, and a corresponding family label is added to the training public behavior graph.

[0041] Step S5: Input the training synthetic behavior graph and the training common behavior graph into the graph matching model to obtain a first similarity coefficient between the training synthetic behavior graph and the training common behavior graph.

[0042] In an optional embodiment, the graph matching model includes an encoding unit, a propagation unit, and an aggregation unit.

[0043] The encoding unit can be constructed by a multi-layer perceptron, and the encoding unit includes a word2vec model and a one-hot encoding. The word2vec model is used to vectorize the feature information of each node in the training synthetic behavior graph and the training public behavior graph to obtain the vectorized feature information of the node. The feature information of the node can be the node name. The one-hot encoding is used to vectorize the feature information of each edge in the training synthetic behavior graph and the training public behavior graph to obtain the vectorized feature information of the edge.

[0044] The propagation unit uses an attention mechanism.

[0045] The aggregation unit uses the aggregation function to calculate the aggregation information of all nodes, embeds the obtained aggregation information into a new vector space, and uses the new vector space to represent the entire graph.

[0046] Step S6: Determine the second similarity coefficient between the first label and the second label, and make a difference between the first similarity coefficient and the second similarity coefficient. If the difference between the first similarity coefficient and the second similarity coefficient is less than the preset similarity coefficient, the current graph matching model is determined as a malware detection model.

[0047] In an optional embodiment, the number of tags of all first tags and all second tags is counted to obtain a first quantity ratio of malicious tags in the first tag and a second quantity ratio of malicious tags in the second tag, the first quantity ratio and the second quantity ratio are divided to obtain a second similarity coefficient, the first similarity coefficient and the second similarity coefficient are subtracted, and if the difference between the first similarity coefficient and the second similarity coefficient is less than a preset similarity coefficient, the current graph matching model is determined as a malware detection model, and the preset similarity coefficient is set according to actual needs. For example, the preset similarity coefficient can be set to 0.1.

[0048] In an embodiment of the present invention, malware in a software sample library is analyzed to obtain a training synthetic behavior graph, and training common behavior graphs of different malware families are extracted from the training synthetic behavior graph. The training synthetic behavior graph and the training common behavior graph are input into a graph matching model for training to obtain a malware detection model. In the malware detection model training method provided in an embodiment of the present invention, the detection range when detecting malware is narrowed by extracting the training common behavior graph, thereby improving the detection speed of the malware detection model and the accuracy of the detection results.

[0049] In an optional embodiment, malware in a software sample library is analyzed to obtain a training synthetic behavior graph corresponding to each malware, including:

[0050] First, the malware in the software sample library is decompiled to obtain the decompiled code and manifest configuration file.

[0051] In an optional embodiment, for an Android application, the APK file of the application is decompiled to obtain a decompiled code, an AndroidManifest.xml file, and a .dex file.

[0052] Then, the training basic behavior graph is generated based on the decompiled code.

[0053] In an optional embodiment, application programming interface (API) call information is obtained according to the AndroidManifest.xml file and the .dex file, and intent (Intent) call information is searched and obtained.

[0054] According to the decompiled code, a control flow graph corresponding to the component class in the decompiled code is generated. The caller and call target of the API call information and Intent call information are located using the arrival definition algorithm. Corresponding links are added to the control flow graph according to the API call information, Intent call information, API call information and Intent call information, and the caller and call target to obtain the training basic behavior graph.

[0055] In an optional embodiment, the application software generates API call information and call relationships when completing a specific function. The API call information is connected to obtain a function call graph containing nodes and edges, where the nodes represent the API call information names and the edges represent the call relationships.

[0056] For example, for API call information of a specific function, such as:

[0057]

[0058] The above code is the API call information when sending information, where the API call information is connected in the order of Uri.parse, intent, intent.putExtra, and startActivity.

[0059] Secondly, a test script is generated based on the decompiled code and the manifest configuration file, and the test script is used to dynamically test the malware to obtain dynamic operation information.

[0060] In an optional embodiment, the step of generating a test script includes first processing the .dex file through the soot framework to convert the Dalvik bytecode in the .dex file into Jimple code; then obtaining the jump relationship between activities based on the Jimple code, and then generating an activity transition graph based on the activity jump relationship, and finally generating a test script based on the activity transition graph.

[0061] In an optional embodiment, the application software is dynamically tested under the Appium framework to obtain dynamic operation information.

[0062] Dynamic operation information includes API call information, Intent call information and Content Provider (ContentProvider) call information.

[0063] In an optional embodiment, when dynamically testing malware, you can hook at the JNI layer to obtain binder-related API call information between the Java layer and the native layer, and hook at the Service Manager layer to obtain Intent call information and Content Provider call information from the application software.

[0064] Since the Java layer calls the binder driver through the JNI interface, and the binder request needs to go through the ServiceManager, and the underlying implementation of the Intent call information and the Content Provider call information are both binder mechanisms, hooking on the JNI layer can obtain the Intent call information and the Content Provider call information.

[0065] Finally, the training synthetic behavior graph is generated through the dynamic operation information and the training basic behavior graph.

[0066] In an optional embodiment, the edge calling relationship in the dynamic operation information is compared with the edge calling relationship in the training basic behavior graph. If the calling relationship is consistent, the calling relationship between the edge and the edge in the dynamic operation information is replaced with the calling relationship between the edge and the edge in the training basic behavior graph. If the calling relationship is inconsistent, a new calling relationship between the edge and the edge is established in the training basic behavior graph.

[0067] In an optional embodiment, the training synthetic behavior graph includes one or more maximal connected subgraphs, each maximal connected subgraph includes one or more edges, and obtaining one or more training public behavior graphs based on the training synthetic behavior graph includes:

[0068] First, the training synthetic behavior graphs are classified and combined according to the first label to obtain one or more training synthetic behavior graph sets.

[0069] In an optional embodiment, the first label includes the malicious family to which each trained synthetic behavior graph belongs. The trained synthetic behavior graph is divided into one or more trained synthetic behavior graph sets according to the first label, and each trained synthetic behavior graph set corresponds to a malicious family.

[0070] Then, the weight of the edge of each maximal connected subgraph in each set of training synthetic behavior graphs is determined.

[0071] In an optional embodiment, each training synthetic behavior graph includes one or more maximal connected subgraphs and maximal common subgraphs.

[0072] For the i-th training synthetic behavior graph G in the training synthetic behavior graph set C i The j-th maximal connected subgraph g ij The steps for calculating the edge weights are:

[0073] 1. Obtain g through McSplitRLR algorithm ij and C except G i The maximum common subgraph (MPS) of the synthetic behavior graph for training is obtained from the CNN.

[0074] 2. For g ij Each edge of establishes a weight, if g ij If there is an edge that is the same as MPS in C, the weight of the edge is increased by 1, and the weight of each edge is divided by the number of training synthetic behavior graphs in C to obtain g ij The weight of the edge.

[0075] Refer to the maximal connected subgraph g ij The step of calculating the edge weights is to calculate the edge weights of the remaining maximal connected subgraphs in C.

[0076] In the embodiment of the present invention, the McSplitRLR algorithm is used to calculate g ij and C except G i Compared with the current McSplit algorithm, the maximum common subgraph (MPS) of the synthetic behavior graph trained outside the training set adopts a new branching strategy of vertex conflict learning. It no longer relies on the static attribute vertex degree of the graph, but instead learns the influence of vertices in historical searches, which has higher solving efficiency.

[0077] Finally, based on the edge weights of each maximal connected subgraph in each training synthetic behavior graph set, the training common behavior graphs corresponding to each training synthetic behavior graph set are determined respectively.

[0078] In an optional embodiment, determining a training public behavior graph corresponding to the training synthetic behavior graph set based on the edge weights of each maximal connected subgraph in the training synthetic behavior graph set includes:

[0079] First, based on the edge weights of each maximal connected subgraph in the training synthetic behavior graph set, the average edge weight of each maximal connected subgraph and the average weight value between subgraphs in the training synthetic behavior graph set are determined. The average weight value between subgraphs is the mean of the average edge weights of the maximal connected subgraphs in the training synthetic behavior graph set.

[0080] In an optional embodiment, the average weight of the edges of each maximal connected subgraph is determined, such as determining gij The average edge weight of :

[0081]

[0082] Among them, e k represents the edge numbered k, E ij Indicates g ij The edge set of represents the weight of the edge numbered k, |E ij | indicates E ij The number of middle edges, Indicates g ij The average weight of the edge.

[0083] Refer to the above to determine g ij The average edge weights of the remaining maximal connected subgraphs in C are calculated using the average edge weights method.

[0084] Determine the average weight between subgraphs of the training synthetic behavior graph set, such as determining G in C i The average weight value between subgraphs of :

[0085]

[0086] Refer to the above to determine G i The method of averaging weights between subgraphs calculates the average weights between subgraphs of the remaining training synthetic behavior graphs in C.

[0087] Then, in the maximal connected subgraph whose average edge weight is greater than the average weight between the subgraphs, the edges whose weight is less than a preset value are deleted to form an intermediate graph.

[0088] In an optional embodiment, in a maximal connected subgraph whose average edge weight is greater than the average weight between the subgraphs, Figure 2 The edges with weight less than the preset value are deleted.<a,b> ,side<d,f> and the edge<e,g> The preset value can be set according to actual needs. For example, the preset value is set to the average edge weight. If a node is not connected to any edge, the node is deleted, such as node g.

[0089] Finally, the intermediate graph with the largest sum of edge weights is determined as the training common behavior graph corresponding to the training synthetic behavior graph set.

[0090] In an optional embodiment, it also includes: if the difference between the first similarity coefficient and the second similarity coefficient is greater than or equal to the preset similarity coefficient, the graph matching model is optimized and trained using the back propagation algorithm, and the training synthetic behavior graph and the training common behavior graph are returned to the step of inputting the training synthetic behavior graph and the training common behavior graph into the graph matching model to obtain the first similarity coefficient between the training synthetic behavior graph and the training common behavior graph, until the difference between the first similarity coefficient and the second similarity coefficient is less than the preset similarity coefficient.

[0091] In an optional embodiment, the graph matching model includes an Adam optimizer. When optimizing and training the graph matching model, the Hamming distance can be used as a distance metric to obtain a loss function value, and the loss function value is sent to the Adam optimizer to optimize and train the graph matching model.

[0092] The embodiment of the present invention provides a malware detection method, such as Figure 3 As shown, the method includes:

[0093] Step S7: Obtain a synthetic behavior graph of the software to be detected.

[0094] Step S8: Input the synthetic behavior graph and the common behavior graph of the malware into the malware detection model, calculate the similarity between the synthetic behavior graph and the common behavior graph, and if the similarity is greater than the preset similarity, determine that the software to be detected is malware. The malware detection model is determined by the malware detection model training method of any one of the above embodiments.

[0095] In an optional embodiment, one or more public behavior graphs of malware are stored in a database, the synthetic behavior graph of the software to be detected and the public behavior graph of one malware are input into a malware detection model, and the similarity between the synthetic behavior graph and the public behavior graph is calculated. If the similarity is less than a preset similarity, the synthetic behavior graph of the software to be detected and the public behavior graphs of other malware are input into the malware detection model, until the similarity between the synthetic behavior graph of the software to be detected and the public behavior graphs of all malware in the database is less than the preset similarity, and the software to be detected is determined to be non-malware.

[0096] In an optional embodiment, the preset similarity can be set according to actual needs. For example, the preset similarity is set to 0.9.

[0097] In an optional embodiment, obtaining a synthetic behavior graph of the software to be detected includes:

[0098] First, the software to be detected is decompiled to obtain the decompiled code of the software to be detected, a control flow graph is generated based on the decompiled code of the software to be detected, and then a basic behavior graph of the software to be detected is obtained based on the control flow graph. The steps for obtaining the basic behavior graph of the software to be detected are described in the above embodiment and will not be repeated here.

[0099] Finally, the software to be tested is dynamically analyzed to collect its dynamic operation information, and the dynamic operation information of the software to be tested is added to the basic behavior graph to obtain a synthetic behavior graph.

[0100] In an optional embodiment, the dynamic running information of the software to be detected is directly collected after the software to be detected is run.

[0101] The embodiment of the present invention provides a malware detection model training device, such as Figure 4 As shown, the device includes:

[0102] The data acquisition module 41 is used to acquire a software sample library, which includes multiple malware. For details, please refer to the description of step S1 in the above embodiment, which will not be repeated here.

[0103] The data analysis module 42 is used to analyze the malware in the software sample library and obtain a training synthetic behavior graph corresponding to each malware. For details, please refer to the description of step S2 in the above embodiment and will not be repeated here.

[0104] The label adding module 43 is used to add a first label to the training synthetic behavior graph. For details, please refer to the description of step S3 in the above embodiment, which will not be repeated here.

[0105] The extraction module 44 is used to obtain one or more training common behavior graphs based on the training synthetic behavior graph, each training common behavior graph corresponds to a malware family, and add a second label to the training common behavior graph. For details, please refer to the description of step S4 in the above embodiment and will not be repeated here.

[0106] The input module 45 is used to input the training synthetic behavior graph and the training common behavior graph into the graph matching model to obtain the first similarity coefficient between the training synthetic behavior graph and the training common behavior graph. For details, please refer to the description of step S5 in the above embodiment and will not be repeated here.

[0107] The model determination module 46 is used to determine the second similarity coefficient between the first label and the second label, and to make a difference between the first similarity coefficient and the second similarity coefficient. If the difference between the first similarity coefficient and the second similarity coefficient is less than the preset similarity coefficient, the current graph matching model is determined as a malware detection model. For details, please refer to the description of step S6 in the above embodiment, which will not be repeated here.

[0108] For the specific limitations and beneficial effects of a malware detection model training device, please refer to the limitations of the malware detection model training method above and will not be repeated here. The various modules in the above-mentioned malware detection model training device can be implemented in whole or in part by software, hardware, and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the electronic device in the form of hardware, or can be stored in the memory of the electronic device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0109] The embodiment of the present invention provides a malware detection device, such as Figure 5 As shown, the device includes:

[0110] The graph acquisition module 51 is used to obtain a synthetic behavior graph of the software to be detected. For details, please refer to the description of step S7 in the above embodiment, which will not be repeated here.

[0111] The graph processing module 52 is used to input the synthetic behavior graph and the common behavior graph of malware into the malware detection model, calculate the similarity between the synthetic behavior graph and the common behavior graph, and if the similarity is greater than a preset similarity, determine that the software to be detected is malware. The malware detection model is determined by the malware detection model training method of any one of the above embodiments. For details, please refer to the description of step S8 in the above embodiment, which will not be repeated here.

[0112] The specific limitations and beneficial effects of a malware detection device can be found in the limitations of the malware detection method above and will not be further elaborated here. Each module in the malware detection device described above may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in an electronic device in hardware form, or may be stored in a memory in the electronic device in software form, so that the processor can call and execute the corresponding operations of each module.

[0113] An embodiment of the present invention further provides a non-transitory computer storage medium storing computer-executable instructions that can execute the malware detection model training or malware detection method in any of the above method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD); the storage medium can also include a combination of the above types of memory.

[0114] The embodiment of the present invention also provides a computer device, such as Figure 6As shown, the computer device may include at least one processor 61, at least one communication interface 62, at least one communication bus 63 and at least one memory 64, wherein the communication interface 62 may include a display screen (Display), a keyboard (Keyboard), and the optional communication interface 62 may also include a standard wired interface and a wireless interface. The memory 64 may be a high-speed RAM memory (Random Access Memory, volatile random access memory) or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 64 may optionally be at least one storage device located away from the aforementioned processor 61. The memory 64 stores application programs, and the processor 61 calls the program code stored in the memory 64 to execute the steps of any of the above-mentioned embodiments of the invention.

[0115] The communication bus 63 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The communication bus 63 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0116] Among them, the memory 64 may include volatile memory (English: volatile memory), such as random-access memory (English: random-access memory, abbreviated: RAM); the memory may also include non-volatile memory (English: non-volatile memory), such as flash memory (English: flash memory), hard disk drive (English: hard disk drive, abbreviated: HDD) or solid-state drive (English: solid-state drive, abbreviated: SSD); the memory 64 may also include a combination of the above types of memory.

[0117] The processor 61 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and a NP.

[0118] The processor 61 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0119] Optionally, the memory 64 is also used to store program instructions. The processor 61 can call the program instructions to implement the present invention. Figure 1 The malware detection model training shown in the embodiment or the present invention Figure 3 The malware detection method shown in the embodiment.

Claims

1. A malware detection model training method, characterized in that: include: Obtaining a software sample library, wherein the software sample library includes a plurality of malware; Analyze the malware in the software sample library to obtain a training synthetic behavior graph corresponding to each malware; adding a first label to the training synthetic behavior graph; Obtain one or more training public behavior graphs according to the training synthetic behavior graph, each of the training public behavior graphs corresponding to a malware family, and adding a second label to the training public behavior graph; Inputting the training synthetic behavior graph and the training common behavior graph into a graph matching model to obtain a first similarity coefficient between the training synthetic behavior graph and the training common behavior graph; determining a second similarity coefficient between the first label and the second label, subtracting the first similarity coefficient from the second similarity coefficient, and determining the current graph matching model as a malware detection model if the difference between the first similarity coefficient and the second similarity coefficient is less than a preset similarity coefficient; Analyze the malware in the software sample library to obtain a training synthetic behavior graph corresponding to each malware, including: Decompiling the malware in the software sample library to obtain decompiled code and a manifest configuration file; Generate a training basic behavior diagram according to the decompiled code; generating a test script according to the decompiled code and the manifest configuration file, and dynamically testing the malware using the test script to obtain dynamic operation information; Generate the training synthetic behavior diagram through the dynamic operation information and the training basic behavior diagram; The training synthetic behavior graph includes one or more maximal connected subgraphs, and the maximal connected subgraphs include one or more edges. Acquiring one or more training common behavior graphs according to the training synthetic behavior graph includes: Classify and combine the training synthetic behavior graphs according to the first labels to obtain one or more training synthetic behavior graph sets; Determine the edge weights of each maximal connected subgraph in each set of training synthetic behavior graphs; Based on the weights of the edges of each maximal connected subgraph in each training synthetic behavior graph set, respectively determining the training public behavior graphs corresponding to each training synthetic behavior graph set; Based on the weights of the edges of each maximal connected subgraph in the training synthetic behavior graph set, a training public behavior graph corresponding to the training synthetic behavior graph set is determined, including: Determining, based on the edge weights of each maximal connected subgraph in the training synthetic behavior graph set, an average edge weight of each maximal connected subgraph and an average weight value between subgraphs in the training synthetic behavior graph set, wherein the average weight value between subgraphs is the mean of the average edge weights of the maximal connected subgraphs in the training synthetic behavior graph set; In the maximal connected subgraph whose average edge weight is greater than the average weight between the subgraphs, the edges whose weight is less than a preset value are deleted to form an intermediate graph; The intermediate graph with the largest sum of edge weights is determined as the training common behavior graph corresponding to the training synthetic behavior graph set.

2. The malware detection model training method according to claim 1, characterized in that: Also includes: If the difference between the first similarity coefficient and the second similarity coefficient is greater than or equal to the preset similarity coefficient, the graph matching model is optimized and trained using the back propagation algorithm, and the step of inputting the training synthetic behavior graph and the training common behavior graph into the graph matching model to obtain the first similarity coefficient between the training synthetic behavior graph and the training common behavior graph is returned, until the difference between the first similarity coefficient and the second similarity coefficient is less than the preset similarity coefficient.

3. A malware detection method, characterized in that: include: Obtain a synthetic behavior graph of the software to be tested; The synthetic behavior graph and the common behavior graph of malware are input into a malware detection model, and the similarity between the synthetic behavior graph and the common behavior graph is calculated. If the similarity is greater than a preset similarity, the software to be detected is determined to be malware. The malware detection model is determined by the malware detection model training method according to claim 1 or 2.

4. The malware detection method according to claim 3, wherein: Obtain a synthetic behavior graph of the software to be tested, including: Decompile the software to be detected to obtain the decompiled code of the software to be detected; Generate a control flow graph according to the decompiled code of the software to be detected; Obtaining a basic behavior diagram of the software to be detected according to the control flow graph; Dynamic analysis is performed on the software to be detected to collect dynamic operation information of the software to be detected, and the dynamic operation information of the software to be detected is added to the basic behavior graph to obtain the synthetic behavior graph.

5. A malware detection model training device, characterized in that: include: A data acquisition module, configured to acquire a software sample library, wherein the software sample library includes a plurality of malware; A data analysis module, configured to analyze malware in the software sample library to obtain a training synthetic behavior graph corresponding to each malware; a label adding module, configured to add a first label to the training synthetic behavior graph; an extraction module, configured to obtain one or more training common behavior graphs based on the training synthetic behavior graph, each of the training common behavior graphs corresponding to a malware family, and add a second label to the training common behavior graphs; An input module, configured to input the training synthetic behavior graph and the training common behavior graph into a graph matching model to obtain a first similarity coefficient between the training synthetic behavior graph and the training common behavior graph; a model determination module, configured to determine a second similarity coefficient between the first label and the second label, perform a subtraction between the first similarity coefficient and the second similarity coefficient, and determine the current graph matching model as a malware detection model if the difference between the first similarity coefficient and the second similarity coefficient is less than a preset similarity coefficient; Analyze the malware in the software sample library to obtain a training synthetic behavior graph corresponding to each malware, including: Decompiling the malware in the software sample library to obtain decompiled code and a manifest configuration file; Generate a training basic behavior diagram according to the decompiled code; generating a test script according to the decompiled code and the manifest configuration file, and dynamically testing the malware using the test script to obtain dynamic operation information; Generate the training synthetic behavior diagram through the dynamic operation information and the training basic behavior diagram; The training synthetic behavior graph includes one or more maximal connected subgraphs, and the maximal connected subgraphs include one or more edges. Acquiring one or more training common behavior graphs according to the training synthetic behavior graph includes: Classify and combine the training synthetic behavior graphs according to the first labels to obtain one or more training synthetic behavior graph sets; Determine the edge weights of each maximal connected subgraph in each set of training synthetic behavior graphs; Based on the weights of the edges of each maximal connected subgraph in each training synthetic behavior graph set, respectively determining the training public behavior graphs corresponding to each training synthetic behavior graph set; Based on the weights of the edges of each maximal connected subgraph in the training synthetic behavior graph set, a training public behavior graph corresponding to the training synthetic behavior graph set is determined, including: Determining, based on the edge weights of each maximal connected subgraph in the training synthetic behavior graph set, an average edge weight of each maximal connected subgraph and an average weight value between subgraphs in the training synthetic behavior graph set, wherein the average weight value between subgraphs is the mean of the average edge weights of the maximal connected subgraphs in the training synthetic behavior graph set; In the maximal connected subgraph whose average edge weight is greater than the average weight between the subgraphs, the edges whose weight is less than a preset value are deleted to form an intermediate graph; The intermediate graph with the largest sum of edge weights is determined as the training common behavior graph corresponding to the training synthetic behavior graph set.

6. A malware detection device, characterized in that: include: A graph acquisition module, used to obtain a synthetic behavior graph of the software to be tested; A graph processing module is used to input the synthetic behavior graph and the common behavior graph of malware into a malware detection model, calculate the similarity between the synthetic behavior graph and the common behavior graph, and if the similarity is greater than a preset similarity, determine that the software to be detected is malware, and the malware detection model is determined by the malware detection model training method according to claim 1 or 2.

7. A computer device, characterized in that: include: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, thereby executing a malware detection model training method according to claim 1 or 2, or a malware detection method according to claim 3 or claim 4.

Images