Method and apparatus for processing software function call behavior data

Abstract

This application discloses a method and apparatus for processing software function call behavior data. The method includes: acquiring software function call behavior data represented by serialized data; converting the software function call behavior data from serialized data into hierarchical structured data; performing a tree layout on a two-dimensional plane based on the hierarchical structured data to obtain drawing attribute data; and drawing a tree-like call graph based on the drawing attribute data. The function nodes are placed at different levels of the tree-like call graph according to the order in which functions are called, and the corresponding function calls are uniquely represented by the connecting lines between function nodes. This effectively avoids intersecting function nodes and call edges, enhances readability, and clearly displays the complete call chain.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to a method and apparatus for processing software function call behavior data. Background Technology

[0002] With the rapid development of information technology, software with various functions is emerging in an endless stream, but at the same time, malicious software is also becoming increasingly rampant. To conduct software analysis, it is first necessary to obtain software function call behavior data. Software function call behavior data (Opcode) is a type of dynamic behavioral data. Security experts often construct instruction frequency features, text vector features, and binary images of sequences based on Opcode, and then input these features into models based on machine learning and deep learning, such as neural networks, support vector machines, and Naive Bayes, to identify malicious software in various software. However, while this method has achieved significant breakthroughs in accuracy and detection speed, it often relies heavily on the experience of security experts.

[0003] Currently, there are some human-computer collaborative methods that further improve the accuracy and efficiency of analysis and identification through guided visual interaction. For example, drawing a call graph of sample Opcode can be used to construct sample features for input into malicious file detectors, and can also serve as a chart to assist analysis, with good interpretability. However, the call graphs constructed based on existing methods still have some problems: (1) poor readability: there are a large number of nodes and intersecting call edges; (2) confusing layout of non-critical nodes: the equivalent representation of all functions leads to unclear distinction between primary and secondary functions. In software analysis, security experts often pay more attention to the calls of sensitive functions; (3) the information contained is of a single dimension: traditional call graphs emphasize function call behavior, but do not show the parameter information of functions and the passing behavior of tainted parameters. In short, security personnel lack a call graph with strong readability and good interpretability to interpret and analyze the function call behavior in software and identify malware accordingly. Summary of the Invention

[0004] In view of this, the purpose of this disclosure is to provide a method and apparatus for processing software function call behavior data, so as to solve the above-mentioned problems existing in the call graph constructed by the existing methods.

[0005] According to a first aspect of this disclosure, a method for processing software function call behavior data is provided, comprising:

[0006] Obtain software function call behavior data represented as serialized data;

[0007] Convert the software function call behavior data from serialized data into hierarchical structured data;

[0008] A tree-like layout is performed on a two-dimensional plane based on the hierarchical structure data to obtain drawing attribute data; and

[0009] A tree-like call graph is drawn based on the drawing attribute data, wherein function nodes are placed at different levels of the tree-like call graph according to the order in which functions are called, and function calls are represented by connecting lines between function nodes.

[0010] Optionally, the drawing attribute data includes a node array and a connection object array. The node array records the attribute information of each function node, and the connection object array records the attribute information of the connecting edges between function nodes. Therefore, drawing the tree-like call graph based on the drawing attribute data includes:

[0011] Draw the function node based on the node array; and

[0012] Draw the connection edges between the function nodes based on the array of connection objects.

[0013] Optionally, the software function call behavior data comes from malware running in a sandbox.

[0014] Optionally, the method further includes: comparing the function name of each function node in the node array with the sensitive function library to determine whether the function is a sensitive function, and adding a corresponding boolean attribute to each function node accordingly; then, in the step of drawing function nodes based on the node array, different colors are used to distinguish between sensitive functions and non-sensitive functions.

[0015] Optionally, in the step of drawing function nodes according to the node array, the function nodes are drawn as rounded rectangles, and a ring diagram is drawn in the rounded rectangles to represent the number of parameters of the function and the taint status of the parameters. The number of rings represents the number of parameters, and the color of the rings represents the taint status of the parameters.

[0016] Optionally, the step of drawing function nodes based on the node array further includes at least one of the following steps:

[0017] The percentage of tainted calls in the total number of calls is represented by the angle occupied by the color filling in the annulus;

[0018] The periodicity of function calls is characterized by the ambiguity of the ring.

[0019] Optionally, it further includes: determining whether each connection edge in the connection object array has a taint propagation path; if so, adding a corresponding boolean attribute to the connection edge; then in the step of drawing connection edges between function nodes according to the connection object array, if a taint propagation path exists for a given connection edge, drawing a line segment between the centers of the two annexes corresponding to the two parameters of the calling function and the called function, the color of the line segment being the same as the color of the annexes.

[0020] Optionally, the thickness of the connecting lines between the function nodes represents the number of times the call occurs.

[0021] Optionally, it also includes: simplifying the tree-like call graph to obtain a simplified tree-like call graph.

[0022] According to a second aspect of this disclosure, a processing apparatus for software function call behavior data is provided, comprising:

[0023] The data acquisition unit is used to acquire software function call behavior data represented by serialized data;

[0024] The format conversion unit is used to convert the software function call behavior data from serialized data into hierarchical structured data;

[0025] The simulated layout unit is used to perform a tree-like layout on a two-dimensional plane based on the hierarchical structure data to obtain drawing attribute data;

[0026] The graphics drawing unit is used to draw a tree-like call graph based on the drawing attribute data, wherein function nodes are placed at different levels of the tree-like call graph according to the order in which functions are called, and function calls are represented by connecting lines between function nodes.

[0027] According to a third aspect of this disclosure, a computing device is provided, including a memory and a processor, the memory further storing computer instructions executable by the processor, wherein the computer instructions, when executed, implement the processing method described in any of the preceding claims.

[0028] According to a fourth aspect of this disclosure, a computer-readable medium is provided that stores computer instructions executable by an electronic device, wherein when executed, the computer instructions implement the processing method described in any of the preceding claims.

[0029] This disclosure presents a method for processing software function call behavior data based on a hierarchical tree design. Function nodes are placed at different levels of the tree-like call graph according to the order in which functions are called, and the corresponding function call is uniquely represented by the connecting lines between function nodes. The tree-like hierarchical structure effectively avoids intersecting call nodes and edges, enhancing readability and clearly displaying the complete call chain. Simultaneously, the parameter information of the function is displayed in each node, illustrating the transmission of tainted parameters during the function call process, and highlighting sensitive functions to attract the attention of analysts and improve analysis efficiency. Therefore, the tree-like call graph constructed according to this disclosure has the following advantages: (1) It clearly displays the function call behavior in the software, helping security personnel trace the complete function call chain from the root node to the leaf node; (2) It displays the relevant parameter information of each function, showing the transmission path of tainted parameters; (3) It simplifies the hierarchical tree in global mode, emphasizing the call path of sensitive functions and weakening the transmission path of non-tainted parameters, increasing readability; (4) Combined with visualization interaction technology, it helps security personnel discover frequent calls, periodic calls, etc., in the software. Attached Figure Description

[0030] The above and other objects, features, and advantages of this disclosure will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0031] Figure 1 This is a flowchart of a method for processing software function call behavior data provided in an embodiment of this disclosure;

[0032] Figure 2 It shows Figure 1 A flowchart of a specific embodiment of step S12 in the process;

[0033] Figure 3 This is a schematic diagram of the structure of a software function call behavior data processing device provided in an embodiment of this disclosure;

[0034] Figure 4 This is a schematic diagram of the structure of a computing device used to implement embodiments of the present disclosure. Detailed Implementation

[0035] The present disclosure is described below based on embodiments, but it is not limited to these embodiments. In the detailed description of the present disclosure below, certain specific details are described in detail. Those skilled in the art will fully understand the present disclosure even without these details. To avoid obscuring the substance of the present disclosure, well-known methods, processes, and procedures are not described in detail. Furthermore, the accompanying drawings are not necessarily drawn to scale.

[0036] The following terms are used in this disclosure:

[0037] Malware (also known as malicious files) is a collective term for any malicious software designed to damage or exploit any programmable device, service, or network, including webshell files, binary files, and malicious scripts. Network attackers typically use malware to steal data or damage computer systems. For example, a webshell is a code execution environment that exists as a web page file such as ASP, PHP, JSP, or CGI, primarily used for website management, server management, and access control. However, webshells can also be used by network attackers as backdoor programs to remotely control servers and perform malicious operations (such as unauthorized privilege escalation, data theft, and virus propagation).

[0038] Sensitive functions: Functions that can easily lead to data integrity or confidentiality breaches, such as the `exec` function which executes external commands, the `leak` function which dumps memory, and the `proc_nice` function which changes process priority. In security audits, quickly locating sensitive functions helps security personnel discover vulnerabilities more quickly.

[0039] Taints: Taint analysis, as a practical technique of information flow analysis, marks certain external input data or sensitive data in a program as tainted (indicating contamination), then tracks the propagation of tainted marks in the program along with data dependencies, and checks whether tainted data has been passed to certain sensitive functions, in order to detect software security issues.

[0040] Sandbox: A sandbox is a virtual system program that allows users to run browsers or other programs in an isolated operating environment. In cybersecurity, a sandbox refers to a tool used in an isolated environment to test the behavior of untrusted files or applications. The sandbox described in this specification is used to run malware and obtain function call sequence data and taint propagation data of the software.

[0041] Figure 1 This is a flowchart of a method for visualizing the function call behavior of malware provided in this disclosure. The flowchart includes the following steps.

[0042] Step S11 is used to obtain software function call behavior data represented by serialized data, wherein the serialized data consists of multiple data items, and each data item represents a function call.

[0043] For step S11, the serialized data is represented as S = {s1, s2, ..., s}. n}, then each data item s i(1≤i≤n) uses 6 single-valued attributes and 2 multi-valued attributes to represent the corresponding function calls. Single-valued attributes include: a file digest (file_md5) calculated using a digest algorithm, the call index (index), the called function (callee) and its caller (caller), the number of arguments (argc), and the return value (return). The file digest and call index can uniquely identify a function call behavior. Multi-valued attributes include the parameters of the called function (argv), and when the software function call behavior data comes from malware, multi-valued attributes also include the parameter taint status (taint). Multi-valued attributes can be stored in an array of length k, where k is consistent with the number of arguments. For example, each element in the parameter array records the parameter information in the form of [parameter index, formal parameter, actual parameter], and each element in the taint array records the parameter taint status as an integer index, where the integer index indicates the taint type at the corresponding position, and a zero value indicates that the parameter at the corresponding position is not tainted.

[0044] Table 1 is an example table of serialized data used as samples. The three data samples in Table 1 are three function call records from the sample with the file MD5 value "8d23f3d3f678d3e620b91c2115e1f714". The `preg_match` function called by `main` has two parameters. The first parameter has the formal parameter "pattern" and the actual parameter "~^(unsafe_raw)?$~". The second parameter has the formal parameter "subject" and the actual parameter "unsafe_raw". Neither parameter has any taint. The `redirect` function called by `main` has a parameter with a taint of type 130. The `header` function called by `redirect` has a parameter with the same type of taint as `redirect`, indicating that there is a taint propagation path from `redirect` to `header`.

[0045] Table 1 Example of Sandbox Sample Data

[0046]

[0047]

[0048] Step S12 is to convert the serialized data into hierarchical structured data.

[0049] Referring to Table 1, the "order" of the serialized data obtained in step S11 is reflected in the `index` field, indicating the sequence of function calls; the "direction" is reflected in the function call behavior, where the `caller` field is the name of the calling function and the `callee` field is the name of the function being called. However, serialized data cannot effectively display the sequence and direction of function calls. Therefore, the serialized data needs to be converted into hierarchical structured data. Hierarchical structured data has a hierarchical characteristic, which can intuitively show the calling and called relationships between functions. For any hierarchical structured data representing function call behavior, if there are N levels, then the first level only has the `main` function, which is the program's entry point. This function will not be called; there will only be cases where other functions are called. That is, the `main` function becomes the root node of the hierarchical structured data. From the second level to the Nth level, for example, if the `main` function calls function `a`, `a` calls function `b`, and `b` calls function `c`, then `c` is a node of the fourth level, `b` is a node of the third level, and `a` is a node of the second level.

[0050] To better understand hierarchical data, the following section is an example of hierarchical data.

[0051]

[0052]

[0053] From the above, users can intuitively see that the main function calls the functions zend_compile_file and s, and the record of function s calls the function zend_fetch_func_arg_session.

[0054] For step S12, Figure 2 A flowchart of a specific embodiment is shown. It specifically includes the following sub-steps.

[0055] In sub-step S121, the serialized data is traversed to obtain each periodic call sequence contained in the serialized data, and the length and number of periods of each periodic call sequence are recorded, thereby obtaining new serialized data. This new serialized data not only contains the original serialized data, but also contains the information of the periodic call sequence implicit in the serialized data.

[0056] Continuing with the serialized data S from the previous example, first sort the serialized data S in ascending order by index, and add two new attributes to each record: periodic sequence length and period count. Initialize the periodic sequence length and period count of each record to 0. This results in a new serialized data S' = {s'1, s'2, ..., s' nThen, iterate through S', recording each call record s' i The calling function and the called function in the code are denoted as a call edge (link1). i and link1 i (1≤i≤n) form an array array. Based on the sliding window concept, traverse each calling edge link1 in array. i (1≤i≤n), when the [link1] is found i+1 ,link1 i+1+x ] and [link1 i-x ,link1 i When they are completely equal, it is considered that a periodic call sequence of length x has appeared. Based on the found periodic call sequence, update the periodic sequence length and number of periods of the corresponding record in S'.

[0057] In sub-step S121, hierarchical structure data is constructed based on the new serialized data.

[0058] Specifically, first, an initial set `Edge_set` is constructed to record all call edge objects. Then, the `S'` obtained in the previous sub-step is traversed, and different call edge objects are added to `Edge_set`, recording the total number of calls for each call edge, the corresponding call index, the number of parameters of the called function, and the parameter taint status (number of taints, call index, taint type), etc. Next, using the program's entry point `main` function as the root node, a breadth-first traversal of `Edge_set` is performed to generate hierarchical structure data `Hierarchy_data`. For example, `main` is first placed at the outermost level, and functions directly called by `main` become child nodes of `main`, and so on, completing the recursion.

[0059] Step S13 involves performing a tree layout based on hierarchical structure data on a two-dimensional plane to obtain drawing attribute data. The drawing attribute data is used to determine the method for drawing each function node and the connecting edges between each function node on the two-dimensional plane.

[0060] Specifically, first, a node array `Tree_node` is generated to record information such as the size, spacing, and position of each function node. In the tree layout, the size, spacing, and position of nodes are calculated based on the number of parameters and the function's level: parent and child nodes are placed vertically adjacent, and sibling nodes are placed horizontally adjacent. The horizontal spacing (`tree.separation`) between function nodes is controlled based on the number of parameters in the function. A linear scale is used to set larger spacing for nodes with more parameters to avoid node overlap during drawing. Simultaneously, information such as the parent and child node arrays of each function node, the node depth, the name of the function corresponding to the function node, the number of parameters, and the parameter taint status are recorded. The `main` function corresponding to the root node does not have information on parent nodes, the number of parameters, or parameter taint status, while leaf nodes do not have information on child nodes.

[0061] In some embodiments, the method further includes: comparing the function name of each function node in the node array Tree_node with a sensitive function library to determine whether the function is a sensitive function, and adding a corresponding boolean attribute to each function node accordingly.

[0062] Then, based on the node array Tree_node, an array of connection objects Tree_link is generated, representing the connections from the parent node to each child node. Each connection object records the parent node (i.e., the calling function) and the child node (i.e., the called function).

[0063] In some embodiments, the method further includes: determining whether there is a taint propagation path in each connection edge of the Tree_link. If both the parameter of the called function and the parameter of the calling function in a connection edge contain taints of the same type, then a taint propagation path is considered to exist, and a corresponding boolean attribute is added to the connection edge.

[0064] Step S14: Draw a tree-like call graph based on the drawing attribute data. Function nodes are placed at different levels of the tree-like call graph according to the order in which functions are called, and calls to the same function node are merged into the same connecting line, so that the connecting lines between function nodes uniquely represent the corresponding function calls.

[0065] Specifically, firstly, based on the Tree_node data obtained in the previous step, function nodes are drawn. Each function node is represented by a rounded rectangle, and the rectangles corresponding to sensitive functions are filled in blue to draw the attention of security personnel. Then, a donut plot is drawn within the rounded rectangles to represent the number of parameters and the taint status of the parameters. The number of donuts represents the number of parameters, and the color of the donuts represents the taint status of the parameters. For example, a white-filled donut indicates that the parameter is not tainted, while a colored-filled donut indicates that the parameter is tainted. Exemplary examples of different colors mapping different types of taints are shown below:

[0066] d3.scale.ordinal()

[0067] .domain(["130","132","129","134","135","131","133","136","137"])

[0068] .range(["#FFA500","#4682B4","#B22222","#8B008B","#FF00FF","#FFFF00","#9966FF","#996600","#CCFFFF"]).

[0069] Furthermore, since a function won't have a tainted mark in all identical calls, a pie chart approach can be used. The angle of the filled color in the rings represents the percentage of tainted calls out of the total number of calls. For example, the `main` function calls the `explode` function twice, with indices 60 and 61, and tainted fields [0,134] and [0,0] respectively. This means that only in the call with index 60 does the second parameter of the `explode` function hit taint number 134. Therefore, the ring representing the second parameter is filled with the color "#8B008B" at a 180-degree angle to indicate that the percentage of tainted calls in the total number of calls is 50%. Interactive functionality can be added to allow users to view details. Additionally, the fuzziness of the rings can be used to represent the periodicity of function calls; higher fuzziness indicates a larger number of periods.

[0070] Then, based on the Tree_link data obtained in the previous step, draw the connecting edges between the rounded rectangles to represent the calling relationship. The upper function of the connecting edge is the calling function, the lower function of the connecting edge is the called function, and the thickness of the connecting edge represents the number of times the corresponding call occurs.

[0071] Finally, based on the corresponding taint chain attributes in the Tree_link data, the taint propagation path is drawn. If a taint propagation path exists in the called function and its parameters, a line segment is drawn at the center of the two corresponding parameter annexes, with the same color as the taint.

[0072] In some embodiments, when a sample has a large number of call relationships and involves multiple functions, the tree-like call graph may become very wide and difficult to read. Therefore, the tree-like call graph can be further simplified. Specifically, a simplified tree-like call graph can be drawn based on the drawing attribute data, or a simplified tree-like call graph can be obtained by hiding layers or other means based on step S14. Before obtaining the simplified call graph, simplification rules can be formulated. For example, since a faster way to detect malware is to search for some sensitive functions and check their parameters, a hierarchical tree simplification method based on sensitive functions and taints can be used, weakening non-tainted call paths and emphasizing sensitive functions during the design phase.

[0073] In some embodiments, two tree diagram modes may be provided to the user: a "panoramic" mode and a "simplified" mode. The "panoramic" mode displays the call relationships between all functions, while the "simplified" mode only displays sensitive function nodes and their ancestor nodes, tainted function nodes and their ancestor nodes, and the connecting edges between these nodes. For example, if there is a sensitive function node or a node with tainted parameters in a complete call chain from the root node to the leaf node, the connecting edge is preserved.

[0074] Figure 3 This is a schematic diagram of a software function call behavior data processing device provided in an embodiment of the present disclosure. The device includes a data acquisition unit 301, a format conversion unit 302, a simulation layout unit 303, and a graphics drawing unit 304.

[0075] The data acquisition unit 301 is used to acquire software function call behavior data represented by serialized data.

[0076] The format conversion unit 302 is used to convert software function call behavior data from serialized data into hierarchical structured data.

[0077] The simulation layout unit 303 is used to perform tree layout based on hierarchical structure data on a two-dimensional plane to obtain drawing attribute data.

[0078] The graphics drawing unit 304 is used to draw a tree-like call graph based on the drawing attribute data. Furthermore, the graphics drawing unit 304 places function nodes on different levels of the tree-like call graph according to the order in which functions are called, and merges the connecting edges of the same function calls, so as to uniquely represent the corresponding function calls through the connecting lines between function nodes.

[0079] For detailed embodiments of the device, please refer to the above description of a method for processing software function call behavior data provided in the embodiments of this disclosure, which will not be repeated here.

[0080] In summary, the software function call behavior data processing method provided in this embodiment draws function nodes on different levels of a tree diagram according to the order in which functions are called, and draws periodic call sequences as the same connecting edges of the tree call diagram, and displays periodic calls through the shape, color, and other attributes of the connecting edges. At the same time, the parameter information of the corresponding function is drawn in each node of the tree call diagram, and the transmission of tainted parameters in the function call process is drawn in the tree call diagram. Therefore, the tree call diagram obtained based on the above embodiment has the following advantages: (1) It clearly shows the software call behavior, helping security personnel to trace the complete function call chain from the root node to the leaf node; (2) It displays the relevant parameter information of each function and shows the transmission path of tainted parameters; (3) It simplifies the hierarchical tree in the global mode, emphasizes the call path of sensitive functions, weakens the non-tainted transmission path, and increases readability; (4) With the help of visualization interaction technology, it helps security personnel discover frequent calls, periodic calls, etc. in the software.

[0081] Figure 4 This is a schematic diagram of the structure of a computing device used to implement embodiments of the present disclosure. Figure 4 As shown, the computing device 600 is presented in the form of a general-purpose computing device. The components of the computing device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, and a bus 630 connecting different system components (including storage unit 620 and processing unit 610).

[0082] The storage unit stores program code, for example... Figure 1 The program code implemented by the method shown can be executed by the processing unit 610, causing the processing unit 610 to perform corresponding functions. For example, the processing unit 601 obtains the serialized data of a certain malware by executing the program code and outputs the tree-like call graph of the malware after a series of processing steps.

[0083] Storage unit 620 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 6201 and / or cache memory 6202, and may further include a read-only memory (ROM) 6203.

[0084] Storage unit 620 may also include a program / utility 6204 having a set (at least one) program module 6205, such program module 6205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0085] Bus 630 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0086] The computing device 600 can also communicate with one or more external devices 700 (e.g., keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with the computing device 600, and / or any device that enables the computing device 600 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 650. Furthermore, the computing device 600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 660. As shown, network adapter 660 communicates with other modules of the computing device 600 via bus 630. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with the computing device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0087] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0088] In an exemplary embodiment of this disclosure, a computer program medium is also provided, having stored computer-readable instructions thereon, which, when executed by a computer's processor, cause the computer to perform the method described in the above method embodiments.

[0089] According to one embodiment of this disclosure, a program product for implementing the methods in the above-described method embodiments is also provided. This program product may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, a readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0090] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0091] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0092] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0093] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0094] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0095] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0096] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A method for processing software function call behavior data, comprising: Acquire software function call behavior data represented by serialized data; wherein the serialized data includes single-valued attributes and multi-valued attributes; Based on the parameters of the called functions in the multi-valued attributes and the function call relationships in the single-valued attributes, the taint propagation path is determined. Convert the software function call behavior data from serialized data into hierarchical structured data; A tree-like layout is performed on a two-dimensional plane based on the hierarchical structure data to obtain drawing attribute data; and A tree-like call graph is drawn based on the node array and connection object array in the drawing attribute data. Function nodes are placed at different levels of the tree-like call graph according to the order in which functions are called, and the corresponding function call is uniquely represented by the connecting lines between function nodes. The method further includes: determining whether each connecting edge in the connection object array has a taint propagation path; if so, adding a corresponding boolean attribute to the connecting edge; in the step of drawing connecting edges between function nodes based on the connection object array, if a taint propagation path exists for a given connecting edge, a line segment is drawn between the centers of the two annexes corresponding to the two parameters of the calling function and the called function, and the color of the line segment is the same as the color of the annexes.

2. The processing method according to claim 1, wherein, The drawing attribute data includes a node array and a connection object array. The node array records the attribute information of each function node, and the connection object array records the attribute information of the connecting edges between function nodes. Therefore, drawing the tree-like call graph based on the node array and connection object array in the drawing attribute data includes: Draw the function node based on the node array; and Draw the connection edges between the function nodes based on the array of connection objects.

3. The processing method according to claim 2, wherein, The software function call behavior data comes from malware running in a sandbox.

4. The processing method according to claim 3 further includes: The function name of each function node in the node array is compared with the sensitive function library to determine whether the function is a sensitive function, and a corresponding boolean attribute is added to each function node accordingly; then, in the step of drawing function nodes based on the node array, different colors are used to distinguish between sensitive functions and non-sensitive functions.

5. The processing method according to claim 3, wherein, In the step of drawing function nodes according to the node array, the function nodes are drawn as rounded rectangles, and a ring diagram is drawn in the rounded rectangles to represent the number of parameters of the function and the taint status of the parameters. The number of rings represents the number of parameters, and the color of the rings represents the taint status of the parameters.

6. The processing method according to claim 5, wherein, The step of drawing function nodes based on the node array further includes at least one of the following steps: The percentage of tainted calls in the total number of calls is represented by the angle occupied by the color filling in the annulus; The periodicity of function calls is characterized by the ambiguity of the ring.

7. The processing method according to claim 2, wherein, The thickness of the connecting lines between function nodes represents the number of times the function is called.

8. The processing method according to claim 1, further comprising: The tree-like call graph is simplified to obtain a simplified tree-like call graph.

9. A processing apparatus for software function call behavior data, comprising: A data acquisition unit is used to acquire software function call behavior data represented by serialized data; wherein the serialized data includes single-valued attributes and multi-valued attributes; based on the parameter information of the called function in the multi-valued attributes and the function call relationship in the single-valued attributes, the taint propagation path is determined; The format conversion unit is used to convert the software function call behavior data from serialized data into hierarchical structured data; The simulated layout unit is used to perform a tree-like layout on a two-dimensional plane based on the hierarchical structure data to obtain drawing attribute data; The graphics drawing unit is used to draw a tree-like call graph based on the node array and connection object array in the drawing attribute data. Function nodes are placed at different levels of the tree-like call graph according to the order in which functions are called, and the corresponding function call is uniquely represented by the connecting lines between function nodes. The unit determines whether each connecting edge in the connection object array has a taint propagation path. If so, a corresponding boolean attribute is added to the connecting edge. In the step of drawing connecting edges between function nodes based on the connection object array, if a taint propagation path exists for a given connecting edge, a line segment is drawn between the centers of the two annexes corresponding to the two parameters of the calling function and the called function. The color of this line segment is the same as the color of the annexes.

10. A computing device comprising a memory and a processor, the memory further storing computer instructions executable by the processor, the computer instructions, when executed, implementing the processing method as described in any one of claims 1 to 8.

11. A computer-readable medium storing computer instructions executable by an electronic device, wherein the computer instructions, when executed, implement the processing method as described in any one of claims 1 to 8.

Images