Software detection method and device, and electronic equipment

Abstract

The present application discloses a software detection method and device, and an electronic device. The method includes: obtaining the current permission set, the current operation code sequence set, and the current function pair set of the target software; determining the permission feature vector of the target software according to the current permission set and the reference permission set; determining the operation code sequence feature vector of the target software according to the current operation code sequence set and the reference operation code sequence set; determining the function call feature vector of the target software according to the current function pair set and the reference function pair set; determining whether the type of the target software is a malware type according to the permission feature vector, the operation code sequence feature vector, and the function call feature vector. The present application solves the technical problem of low accuracy of software detection in the related art.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular, to a software detection method and device, and an electronic device. Background Art

[0002] Due to the open source nature of the Android system, there are more and more Android malware, which seriously infringes upon the legitimate rights and interests of the majority of users and also brings unpredictable obstacles to the further development of the mobile smart terminal industry.

[0003] There are two existing methods for detecting various types of malware in the current Android system: dynamic detection and static detection. Dynamic detection mainly collects and analyzes various types of information when the application software is running, but this technology can bypass the protection technology of Android application software (such as code obfuscation and reinforcement), the experimental cost is huge, and it cannot fully cover the code. Static detection mainly extracts various static features through static analysis of Android application software, and then trains and tests classification models through various classification algorithms to achieve the ability to distinguish malware; this type of mainstream static method has a low experimental cost and can obtain static features more comprehensively, such as permissions, signatures, image resources, etc., but it uses a single feature to determine whether the software is malware, and the detection accuracy is low.

[0004] That is to say, the existing detection methods have low accuracy in detecting whether software is malware. Summary of the invention

[0005] The embodiments of the present application provide a software detection method and device, and an electronic device to at least solve the technical problem of low accuracy of software detection in the related art.

[0006] According to one aspect of an embodiment of the present application, a software detection method is provided, comprising: obtaining a current permission set, a current operation code sequence set, and a current function pair set of a target software, wherein the current operation code sequence set includes operation code sequences corresponding to functions in the target software, and the current function pair set includes function pairs having a calling relationship in the target software; determining a permission feature vector of the target software according to the current permission set and a reference permission set, wherein the reference permission set includes a group of permissions corresponding to a malware type; determining an operation code sequence feature vector of the target software according to the current operation code sequence set and the reference operation code sequence set, wherein the reference operation code sequence set includes a group of operation code sequences corresponding to the malware type; determining a function call feature vector of the target software according to the current function pair set and the reference function pair set, wherein the reference function pair set includes a group of function pairs corresponding to the malware type; determining whether the type of the target software is the malware type according to the permission feature vector, the operation code sequence feature vector, and the function call feature vector.

[0007] Optionally, determining the permission feature vector of the target software based on the current permission set and the reference permission set includes: obtaining the intersection of the current permission set and the reference permission set to obtain a permission intersection set; generating the permission feature vector based on the permission intersection set, wherein the number of features in the permission feature vector is the number of permissions in the reference permission set, each feature in the permission feature vector corresponds to a permission in the reference permission set, and the value of each feature in the permission feature vector indicates whether the corresponding permission is a permission in the permission intersection set.

[0008] Optionally, determining the opcode sequence feature vector of the target software based on the current opcode sequence set and the reference opcode sequence set includes: obtaining the intersection of the current opcode sequence set and the reference opcode sequence set to obtain an opcode sequence intersection set; generating the opcode sequence feature vector based on the opcode sequence intersection set, wherein the number of features in the opcode sequence feature vector is the number of opcode sequences in the reference opcode sequence set, each feature in the opcode sequence feature vector corresponds to an opcode sequence in the reference opcode sequence set, and the value of each feature in the opcode sequence feature vector indicates whether the corresponding opcode sequence is an opcode sequence in the opcode sequence intersection set.

[0009] Optionally, determining the function call feature vector of the target software based on the current function pair set and the reference function pair set includes: obtaining the intersection of the current function pair set and the reference function pair set to obtain a function pair intersection set; generating the function call feature vector based on the function pair intersection set, wherein the number of features in the function call feature vector is the number of function pairs in the reference function pair set, each feature in the function call feature vector corresponds to a function pair in the reference function pair set, and the value of each feature in the function call feature vector indicates whether the corresponding function pair is a function pair in the function pair intersection set.

[0010] Optionally, before determining the permission feature vector of the target software based on the current permission set and the reference permission set, the method further includes: obtaining a value of a first association parameter corresponding to each permission in a preset target permission set, wherein the value of the first association parameter corresponding to each permission is used to represent a first association between each permission and the malware type, and the first association is positively correlated with the value of the first association parameter; and determining the permissions corresponding to the top N values ​​of the first association parameter in the target permission set as permissions in the reference permission set in order of the values ​​of the first association parameter from high to low, wherein N is a positive integer greater than or equal to 1, and N is less than the number of permissions in the target permission set.

[0011] Optionally, obtaining the value of the first association parameter corresponding to each permission in the preset target permission set includes: performing the following operations for each permission in the target permission set, wherein when performing the following operations, each permission is a current permission: determining a first number of software with the current permission and of the malware type in a preset first sample software set, determining a second number of software with the current permission and of the normal software type, determining a third number of software without the current permission and of the malware type, and determining a fourth number of software without the current permission and of the normal software type; determining the value of the first association parameter corresponding to the current permission based on the first number, the second number, the third number, and the fourth number.

[0012] Optionally, before determining the opcode sequence feature vector of the target software based on the current opcode sequence set and the reference opcode sequence set, the method further includes: obtaining a value of a second association parameter corresponding to each opcode sequence in a preset target opcode sequence set, wherein the value of the second association parameter corresponding to each opcode sequence is used to represent a second association between each opcode sequence and the malware type, and the second association is positively correlated with the value of the second association parameter; and determining the opcode sequences corresponding to the top M values ​​of the second association parameter in the target opcode sequence set as the opcode sequences in the reference opcode sequence set in order of the values ​​of the second association parameter from high to low, wherein M is a positive integer greater than or equal to 1, and M is less than the number of opcode sequences in the target opcode sequence set.

[0013] Optionally, obtaining the value of the second correlation parameter corresponding to each opcode sequence in the preset target opcode sequence set includes: performing the following operations on each opcode sequence in the target opcode sequence set, wherein when performing the following operations, each opcode sequence is a current opcode sequence: determining, based on a preset second sample software set, a first information entropy of the malware type, and a second information entropy of the malware type under the premise that the current opcode sequence is given; determining, based on the first information entropy and the second information entropy, an information gain IG(Y|X) corresponding to the current opcode sequence, wherein the value of the second correlation parameter corresponding to the current opcode sequence is the information gain IG(Y|X) corresponding to the current opcode sequence, where Y represents the malware type and X represents the current opcode sequence.

[0014] Optionally, before determining the function call feature vector of the target software based on the current function pair set and the reference function pair set, the method further includes: obtaining the value of a third correlation parameter corresponding to each function pair in a preset target function pair set, wherein the value of the third correlation parameter corresponding to each function pair is used to represent the third correlation between each function pair and the malware type, and the third correlation is positively correlated with the value of the third correlation parameter; and determining the function pairs corresponding to the top P values ​​of the third correlation parameter in the target function pair set as the function pairs in the reference function pair set in the order of the values ​​of the third correlation parameter from high to low, wherein P is a positive integer greater than or equal to 1, and P is less than the number of function pairs in the target function pair set.

[0015] Optionally, obtaining the value of the third correlation parameter corresponding to each function pair in the preset target function pair set includes: performing the following operations on each function pair sequence in the target function pair sequence set, wherein when the following operations are performed, each function pair is a current function pair: when the current function pair represents a first function and a second function having a calling relationship, determining the number of occurrences of the current function pair in a preset third sample software set and the number of occurrences of each candidate function pair in a candidate function pair set, wherein each candidate function pair represents a function and the second function having a calling relationship, and the type of software in the third sample software set is the malware type; determining the transition probability of the current function pair based on the number of occurrences of the current function pair and the number of occurrences of each candidate function pair in the candidate function pair set, wherein the value of the third correlation parameter corresponding to the current function pair is the transition probability of the current function pair.

[0016] Optionally, the functions in the function pairs in the target function pair set include at least one of the following: native functions in an operating system, developer-defined functions, and obfuscated functions.

[0017] Optionally, determining whether the type of the target software is the malware type based on the permission feature vector, the operation code sequence feature vector and the function call feature vector includes: inputting the permission feature vector into a first detection model to obtain a first detection result, wherein the first detection result is used to indicate whether the type of the target software is the malware type; inputting the operation code sequence feature vector into a second detection model to obtain a second detection result, wherein the second detection result is used to indicate whether the type of the target software is the malware type; inputting the function call feature vector into a third detection model to obtain a third detection result, wherein the third detection result is used to indicate whether the type of the target software is the malware type; inputting the first detection result, the second detection result, and the third detection result into a fusion detection model to obtain a target detection result, wherein the target detection result is used to indicate whether the type of the target software is the malware type.

[0018] Optionally, at least two of the first detection model, the second detection model, the third detection model, and the fusion detection model are models constructed using a random forest algorithm.

[0019] According to another aspect of an embodiment of the present application, a software detection device is further provided, comprising: an acquisition module, configured to acquire a current permission set, a current operation code sequence set, and a current function pair set of a target software, wherein the current operation code sequence set includes operation code sequences corresponding to functions in the target software, and the current function pair set includes function pairs having a call relationship in the target software; a first determination module, configured to determine a permission feature vector of the target software according to the current permission set and a reference permission set, wherein the reference permission set includes a group of permissions corresponding to a malware type; a second determination module, configured to determine an operation code sequence feature vector of the target software according to the current operation code sequence set and a reference operation code sequence set, wherein the reference operation code sequence set includes a group of operation code sequences corresponding to the malware type; a third determination module, configured to determine a function call feature vector of the target software according to the current function pair set and a reference function pair set, wherein the reference function pair set includes a group of function pairs corresponding to the malware type; and a fourth determination module, configured to determine whether the type of the target software is the malware type according to the permission feature vector, the operation code sequence feature vector, and the function call feature vector.

[0020] Optionally, the first determining module includes:

[0021] A first acquisition unit, configured to acquire an intersection of the current permission set and the reference permission set to obtain a permission intersection set;

[0022] A first generating unit is used to generate the permission feature vector according to the permission intersection set, wherein the number of features in the permission feature vector is the number of permissions in the reference permission set, each feature in the permission feature vector corresponds to a permission in the reference permission set, and the value of each feature in the permission feature vector indicates whether the corresponding permission is a permission in the permission intersection set.

[0023] Optionally, the second determining module includes:

[0024] A second acquisition unit is used to acquire an intersection of the current operation code sequence set and the reference operation code sequence set to obtain an operation code sequence intersection set;

[0025] A second generating unit is configured to generate the opcode sequence feature vector according to the opcode sequence intersection set, wherein the number of features in the opcode sequence feature vector is the number of opcode sequences in the reference opcode sequence set, each feature in the opcode sequence feature vector corresponds to an opcode sequence in the reference opcode sequence set, and the value of each feature in the opcode sequence feature vector indicates whether the corresponding opcode sequence is an opcode sequence in the opcode sequence intersection set.

[0026] Optionally, the third determining module includes:

[0027] A third acquisition unit is used to acquire the intersection of the current function pair set and the reference function pair set to obtain a function pair intersection set;

[0028] A third generating unit is used to generate the function call feature vector according to the function pair intersection set, wherein the number of features in the function call feature vector is the number of function pairs in the reference function pair set, each feature in the function call feature vector corresponds to a function pair in the reference function pair set, and the value of each feature in the function call feature vector indicates whether the corresponding function pair is a function pair in the function pair intersection set.

[0029] Optionally, the above device further includes: a fifth determining module; the fifth determining module includes:

[0030] a fourth acquisition unit, configured to acquire a value of a first correlation parameter corresponding to each permission in a preset target permission set before determining the permission feature vector of the target software according to the current permission set and the reference permission set, wherein the value of the first correlation parameter corresponding to each permission is used to represent a first correlation between each permission and the malware type, and the first correlation is positively correlated with the value of the first correlation parameter;

[0031] A first determination unit is used to determine the permissions corresponding to the top N values ​​of the first association parameter in the target permission set as permissions in the reference permission set in order of the values ​​of the first association parameter from high to low, where N is a positive integer greater than or equal to 1, and N is less than the number of permissions in the target permission set.

[0032] Optionally, a fourth acquisition unit is used to obtain the value of the first association parameter corresponding to each permission in a preset target permission set in the following manner: perform the following operations for each permission in the target permission set, wherein when the following operations are performed, each permission is a current permission: determine a first number of software with the current permission and of the malware type in a preset first sample software set, determine a second number of software with the current permission and of the normal software type, determine a third number of software without the current permission and of the malware type, and determine a fourth number of software without the current permission and of the normal software type; determine the value of the first association parameter corresponding to the current permission based on the first number, the second number, the third number and the fourth number.

[0033] Optionally, the above device further includes: a sixth determining module; the sixth determining module includes:

[0034] a fifth acquisition unit, configured to acquire a value of a second correlation parameter corresponding to each opcode sequence in a preset target opcode sequence set before determining the opcode sequence feature vector of the target software according to the current opcode sequence set and the reference opcode sequence set, wherein the value of the second correlation parameter corresponding to each opcode sequence is used to represent a second correlation between each opcode sequence and the malware type, and the second correlation is positively correlated with the value of the second correlation parameter;

[0035] A second determination unit is used to determine, in descending order of the values ​​of the second association parameter, the opcode sequences corresponding to the top M bits of the values ​​of the second association parameter in the target opcode sequence set as the opcode sequences in the reference opcode sequence set, wherein M is a positive integer greater than or equal to 1, and M is less than the number of opcode sequences in the target opcode sequence set.

[0036] Optionally, a fifth acquisition unit is used to obtain the value of the second correlation parameter corresponding to each operation code sequence in a preset target operation code sequence set in the following manner: perform the following operations on each operation code sequence in the target operation code sequence set, wherein when the following operations are performed, each operation code sequence is a current operation code sequence: determine, based on a preset second sample software set, a first information entropy of the malware type, and a second information entropy of the malware type under the premise that the current operation code sequence is given; determine, based on the first information entropy and the second information entropy, an information gain IG(Y|X) corresponding to the current operation code sequence, wherein the value of the second correlation parameter corresponding to the current operation code sequence is the information gain IG(Y|X) corresponding to the current operation code sequence, where Y represents the malware type and X represents the current operation code sequence.

[0037] Optionally, the above device further includes: a seventh determining module; the seventh determining module includes:

[0038] a sixth acquisition unit, configured to acquire a value of a third correlation parameter corresponding to each function pair in a preset target function pair set before determining the function call feature vector of the target software according to the current function pair set and the reference function pair set, wherein the value of the third correlation parameter corresponding to each function pair is used to represent a third correlation between each function pair and the malware type, and the third correlation is positively correlated with the value of the third correlation parameter;

[0039] A third determination unit is used to determine the function pairs corresponding to the top P values ​​of the third correlation parameter in the target function pair set as the function pairs in the reference function pair set in the order of the values ​​of the third correlation parameter from high to low, wherein P is a positive integer greater than or equal to 1, and P is less than the number of function pairs in the target function pair set.

[0040] Optionally, a sixth acquisition unit is used to obtain the value of a third association parameter corresponding to each function pair in a preset target function pair set in the following manner: performing the following operations on each function pair sequence in the target function pair sequence set, wherein when the following operations are performed, each function pair is a current function pair: when the current function pair represents a first function and a second function having a calling relationship, determining the number of occurrences of the current function pair in a preset third sample software set and the number of occurrences of each candidate function pair in a candidate function pair set, wherein each candidate function pair represents a function and the second function having a calling relationship, and the type of software in the third sample software set is the malware type; determining the transition probability of the current function pair based on the number of occurrences of the current function pair and the number of occurrences of each candidate function pair in the candidate function pair set, wherein the value of the third association parameter corresponding to the current function pair is the transition probability of the current function pair.

[0041] Optionally, the functions in the function pairs in the target function pair set include at least one of the following: native functions in the operating system, developer-defined functions, and obfuscated functions.

[0042] Optionally, the fourth determining module includes:

[0043] A first detection unit, configured to input the permission feature vector into a first detection model to obtain a first detection result, wherein the first detection result is used to indicate whether the type of the target software is the malware type;

[0044] A second detection unit, configured to input the operation code sequence feature vector into a second detection model to obtain a second detection result, wherein the second detection result is used to indicate whether the type of the target software is the malware type;

[0045] A third detection unit, used for inputting the function call feature vector into a third detection model to obtain a third detection result, wherein the third detection result is used to indicate whether the type of the target software is the malware type;

[0046] The fourth detection unit is used to input the first detection result, the second detection result, and the third detection result into a fusion detection model to obtain a target detection result, wherein the target detection result is used to indicate whether the type of the target software is the malware type.

[0047] Optionally, at least two of the first detection model, the second detection model, the third detection model, and the fusion detection model are models constructed using a random forest algorithm.

[0048] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned software detection method when running.

[0049] According to another aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the above software detection method.

[0050] According to another aspect of the embodiments of the present application, there is further provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the software detection method through the computer program.

[0051] In the embodiment of the present application, feature vectors of multiple dimensions of the target software are obtained, including the permission feature vector, the opcode sequence feature vector, and the function call feature vector of the target software. The feature vectors of the above multiple dimensions can characterize the behavior relationship of the target software (for example, the function call relationship), and characterize different types of functions (for example, obfuscated functions). In this way, according to the feature vectors of the above multiple dimensions, it is possible to accurately detect whether the type of the target software is malware, which solves the technical problem of low accuracy of software detection in the related art and achieves the technical effect of improving the accuracy of software detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0053] Figure 1 is a schematic diagram of an application environment of an optional software testing method according to an embodiment of the present application;

[0054] Figure 2 is a flowchart of an optional software testing method according to an embodiment of the present application;

[0055] Figure 3 is a schematic diagram of an optional software testing method according to an embodiment of the present application;

[0056] Figure 4 is a schematic diagram of an optional process of determining a feature vector according to an embodiment of the present application;

[0057] Figure 5is a schematic diagram of an optional process of determining a reference permission set according to an embodiment of the present application;

[0058] Figure 6 is a schematic diagram of an optional process of determining a reference operation code sequence set according to an embodiment of the present application;

[0059] Figure 7 is a schematic diagram of an optional process of determining a reference function pair set according to an embodiment of the present application;

[0060] Figure 8 is a schematic diagram of an optional process of determining a detection model according to an embodiment of the present application;

[0061] Fig. 9 is a schematic diagram of an optional process of determining a fusion detection model according to an embodiment of the present application;

[0062] Fig.10 is a schematic structural diagram of an optional software testing device according to an embodiment of the present application;

[0063] Fig.11 is a block diagram of a computer system structure of an optional electronic device according to an embodiment of the present application;

[0064] Fig.12 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0065] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0066] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0067] The present application is described below in conjunction with embodiments:

[0068] According to one aspect of an embodiment of the present application, a software detection method is provided. Optionally, in this embodiment, the software detection method can be applied to Figure 1 The hardware environment shown in FIG. 1 is composed of a terminal device 102, a network 104, a server 106, and a database 108. Figure 1 As shown, the terminal device 102 may, but is not limited to, communicate with the server 106 via the network 104. The terminal device 102 may, but is not limited to, include a human-computer interaction screen, a processor, and a memory. The server 106 may, but is not limited to, provide services for the terminal device or the application installed on the terminal device. The application may, but is not limited to, be a video application, an instant messaging application, a browser application, an educational application, a game application, etc. A database 108 may be set up on the server or independently of the server to provide data storage services for the server 106, for example, a game data storage server. The above-mentioned network may include, but is not limited to, a wired network and a wireless network, wherein the wired network includes, a local area network, a metropolitan area network and a wide area network; the wireless network includes, Bluetooth, WIFI and other networks that implement wireless communication; the terminal device 102 may be a terminal configured with an application, and may include, but is not limited to, at least one of the following: a mobile phone (such as an Android phone, an iOS phone, etc.), a laptop computer, a tablet computer, a PDA, a MID (Mobile Internet Devices), a PAD, a desktop computer, a smart TV and other computer devices; the above-mentioned server may be a single server, or a server cluster consisting of multiple servers, or a cloud server; the above-mentioned database 108 may be a relational database, which is only an example and is not limited to any aspect of the present invention.

[0069] Combination Figure 1 As shown, the above software detection method can be executed in the terminal device 102, including the following steps:

[0070] S102: Acquire the current permission set, current operation code sequence set, and current function pair set of the target software;

[0071] S104: determining the permission feature vector of the target software according to the current permission set and the reference permission set; determining the operation code sequence feature vector of the target software according to the current operation code sequence set and the reference operation code sequence set; determining the function call feature vector of the target software according to the current function pair set and the reference function pair set;

[0072] S106: Determine whether the type of the target software is a malware type according to the permission feature vector, the operation code sequence feature vector, and the function call feature vector.

[0073] Optionally, the above software detection method can also be executed on the server, for example, by Figure 1 The server 106 shown executes the above steps S102-S106.

[0074] Optionally, the above software detection method can also be implemented by the terminal and the server together, for example, by Figure 1 The terminal device 102 shown executes the above step S102, and then sends the current permission set, current operation code sequence set and current function pair set of the target software to the server 106 through the network 104, and then the server 106 executes the above steps S104-S106.

[0075] In this embodiment, feature vectors of multiple dimensions of the target software are obtained, including the permission feature vector, the opcode sequence feature vector, and the function call feature vector of the target software. The feature vectors of the above multiple dimensions can characterize the behavior relationship of the target software (for example, the function call relationship), and characterize different types of functions (for example, obfuscated functions). In this way, according to the feature vectors of the above multiple dimensions, it is possible to accurately detect whether the type of the target software is malware, which solves the technical problem of low accuracy of software detection in the related art and achieves the technical effect of improving the accuracy of software detection.

[0076] Optionally, as an optional implementation, Figure 2 is a flowchart of an optional software testing method according to an embodiment of the present application, the process includes the following steps S202-S210:

[0077] Step S202: obtaining a current permission set, a current operation code sequence set, and a current function pair set of the target software, wherein the current operation code sequence set includes operation code sequences corresponding to functions in the target software, and the current function pair set includes function pairs having a calling relationship in the target software;

[0078] As an optional example, during the process of installing the target software on the terminal device, or after the target software is installed on the terminal device, the user selects to detect the target software through the security software on the terminal device, or after the terminal device receives the target software package sent by other users, the terminal device executes the above step S202, or the terminal device sends the installation package of the target software to the server, and the service executes the above step S202. The target software includes but is not limited to Android application software, IOS application software, etc.

[0079] As an alternative example, Figure 3 As shown, step S1 can be executed by the decompilation module and the function pair extraction module: obtaining the installation package of the target software; then the decompilation module decompiles the installation package of the target software to determine the current permission set and the current operation code sequence set of the target software, and the function pair extraction module processes the installation package of the target software to determine the current function pair set of the target software.

[0080] As an optional example, the installation package of the target software includes but is not limited to the Android application software package APK. The decompilation module includes but is not limited to using the decompilation tool APKTOOL of the Android application software to decompile the APK file of the target software to generate an assembly file set (for example, a smali assembly file set) and a configuration file set. Among them, the assembly file set records the assembly source code of the target software.

[0081] It should be noted that in the configuration file corresponding to the generated assembly file set, the permissions required for installation and operation of the target software are recorded, and then the current permission set of the target software is determined through all the recorded permissions. Optionally, it is assumed that permission 1, permission 2, permission 3, permission 4, permission 5 are recorded, and then the current permission set is {permission 1, permission 2, permission 3, permission 4, permission 5}.

[0082] It should be noted that each file in the generated assembly file set corresponds to a Java class of the source program of the target software, and each function method in the file consists of a series of opcodes. Optionally, the opcodes include but are not limited to Dalvik opcodes. Then, by scanning the assembly file set generated by the decompilation module, the opcodes of the target software are extracted, and the extracted opcodes are simplified. In an optional example, taking the opcode as Dalvik opcode as an example, the simplified instruction comparison table is shown in Table 1:

[0083] Table 1

[0084]

[0085]

[0086] After simplifying each extracted opcode, a simplified Dalvik opcode set is obtained, and then the N-gram method is used to generate a simplified Dalvik opcode sequence. In an optional example, the opcode sequences obtained by the N-gram method for the above 9 types of Dalvik opcodes are arranged and combined into an opcode sequence set. It should be noted that the feature dimension will be different depending on the different values ​​of N in the N-gram method.

[0087] For better understanding, in an optional example, assume that the target software has two functions. After extracting Dalvik opcodes for the two functions, the opcodes of the target software are DMDIRPMGDIT. The 3-gram method is used to generate the opcode sequence to obtain the opcode sequence DMD, MDI, DIR, IRP, RPM, PMG, MGD, GDI, DIT. Then, the opcode sequence set {DMD, MDI, DIR, IRP, RPM, PMG, MGD, GDI, DIT} can be obtained.

[0088] In this embodiment, by simplifying the operation code, it is easier to obtain the operation code sequence through the N-gram method, thereby reducing the complexity of obtaining the operation code sequence set.

[0089] As an optional example, the function pair extraction module includes but is not limited to using the Android static analysis framework Soot to process the APK file of the target software, generate a function relationship graph file corresponding to the APK file, and then determine the current function pair set based on the function relationship graph file. Optionally, the function relationship graph file includes but is not limited to a dot file. The function relationship graph file contains the function name of each node in the function call relationship and a set of all neighbor nodes of its node. Then, multiple function pairs are determined through the calling relationship between functions in the function call relationship to obtain the current function pair set. Optionally, assuming that the function call relationship indicates that function A calls function B, function B calls function C, and function A calls function D, the current function pair set {AB, BC, AD} can be obtained.

[0090] As an optional example, the functions in the target software include but are not limited to: native functions, developer-defined functions, and obfuscated functions. Since the number of functions in the target software is too large and cannot be exhaustive, abstract processing is required. The specific abstract processing process is as follows:

[0091] (1) Native functions

[0092] The native function is abstracted by the package name of the package where the function is located; optionally, taking the target software as Android software as an example, the Android 8.1 version in the Android official website has a total of 243 types of package names, such as: android.accounts, android.app, android.app.job, etc.

[0093] (2) Developer-defined functions

[0094] Developer-defined functions are also abstracted through the package in which the functions are located; optionally, developer-defined functions are generally defined using the "reverse domain name naming convention", for example: com.***.***; the first-level package name is generally the top-level domain name (com / cn / org), the second-level package name is generally the company / institution name, followed by the software name, module name or function name, etc.; the developer-defined function is identified by this naming method.

[0095] (3) Confusion function

[0096] In order to prevent decompilation, existing application software usually uses obfuscation technology to obfuscate the function names of the application software; generally, irregular characters or strings are used to replace the original function names; and then functions that do not meet the package name characteristics in (1) and (2) above are uniformly identified as obfuscated functions. For example, when a function name 1 is identified as being represented by irregular characters or strings, this function is determined to be obfuscated function 1.

[0097] In this embodiment, the obfuscation function is identified in the above manner, thereby improving the accuracy of distinguishing whether the target software of the obfuscation function is malware.

[0098] In this embodiment, since the target software has many functions, the complexity of the obtained current function pair set is reduced by abstracting the functions.

[0099] Step S204: determining a permission feature vector of the target software according to the current permission set and the reference permission set, wherein the reference permission set includes a set of permissions corresponding to the malware type;

[0100] As an optional example, the above step S204 can be implemented by the following steps S21-S22:

[0101] Step S21: Obtain the intersection of the current permission set and the reference permission set to obtain a permission intersection set;

[0102] As an alternative example, Figure 3 As shown, after the decompilation module decompiles the installation package of the target software to obtain the current permission set, the decompilation module executes step S2: sending the current permission set to the permission feature vector determination module; at the same time, the permission feature vector determination module executes step S3: obtaining the reference permission set; and then Figure 4As shown in (a) in FIG. 1 , the permission feature vector determination module performs an intersection operation on the current permission set and the reference permission set to obtain a permission intersection set. Optionally, assume that the current permission set is {permission 1, permission 2, permission 3, permission 4, permission 5}. The reference permission set is {permission 1, permission 3, permission 5, permission 7, permission 8}, and the obtained permission intersection set is {permission 1, permission 3, permission 5}.

[0103] Step S22: Generate a permission feature vector according to the permission intersection set, wherein the number of features in the permission feature vector is the number of permissions in the reference permission set, each feature in the permission feature vector corresponds to a permission in the reference permission set, and the value of each feature in the permission feature vector indicates whether the corresponding permission is a permission in the permission intersection set;

[0104] As an alternative example, Figure 4 As shown in (a) in FIG. 1 , the permission feature vector determination module determines the permission feature vector according to the permission intersection set. It should be noted that the number of features in the permission feature vector is equal to the number of permissions in the reference permission set, that is, the dimension of the permission feature vector is equal to the number of permissions in the reference permission set. Figure 4 As shown in (a), it is assumed that there are N permissions in the reference permission set, and the permission feature vector is an N-dimensional vector. For a better understanding, as an optional example, assume that the current permission set is {permission 1, permission 2, permission 3, permission 4, permission 5}, and the reference permission set is {permission 1, permission 3, permission 5, permission 6, permission 7}. After the intersection operation, the obtained permission intersection set is {permission 1, permission 3, permission 5}. Since permission 1 in the reference permission set exists in the permission intersection set, the value corresponding to permission 1 in the permission feature vector is 1. Since permission 7 in the reference permission set does not exist in the permission intersection set, the value corresponding to permission 7 in the permission feature vector is. Similarly, the value of each feature in the permission feature vector is determined, and the permission feature vector is (1, 1, 1, 0, 0).

[0105] In this embodiment, the permission feature vector is determined in the above manner, which can more simply express whether the current permission set has the corresponding permission in the reference permission set. In addition, since only whether the current permission set has the corresponding permission in the reference permission set is considered, that is, only representative permissions are selected from the current permission set to determine whether the target software is malware, the interference of invalid permissions is avoided, making it easier to subsequently build the first detection model.

[0106] As an optional example, before executing the above step S206, it is also necessary to determine a reference permission set, which can be specifically implemented by the following steps S41-S42:

[0107] Step S41: Obtain the value of the first association parameter corresponding to each permission in the preset target permission set, wherein the value of the first association parameter corresponding to each permission is used to represent the first association between each permission and the malware type, and the first association is positively correlated with the value of the first association parameter.

[0108] As an optional example, a larger value of the first correlation parameter indicates that the first correlation between the permission and the malware type is higher, indicating that the permission is more capable of distinguishing malware.

[0109] As an optional example, the target permission set includes all permissions provided by the operating system, or includes the union of the permission sets corresponding to each first sample software in the first sample software set. The embodiment of the present application is not limited here. Assuming that the target software is: Android software, the target permission set can include 138 permissions provided by the Android native system.

[0110] After determining the target permission set, it is necessary to determine the value of the first correlation parameter corresponding to each permission in the target permission set. As an optional example, the following steps S411-S412 can be performed for each permission in the target permission set, wherein each permission is the current permission when the following steps are performed:

[0111] Step S411: determining a first number of software with current permissions and of a malware type in the preset first sample software set, determining a second number of software with current permissions and of a normal software type, determining a third number of software without current permissions and of a malware type, and determining a fourth number of software without current permissions and of a normal software type;

[0112] As an optional example, it is necessary to first determine the permission set corresponding to each sample software in the first sample software set, and then determine whether the first sample software has the current permission by whether the first sample software has the current permission in the permission set. Optionally, the method of determining the permission set corresponding to each sample software in the first sample software set is the same as the method of determining the current permission set corresponding to the target software. The software types in the first sample software set include malware types and normal software types.

[0113] As an alternative example, Figure 5 As shown, assuming that the target permission set has n1 permissions, it is necessary to determine the value of the first correlation parameter of each permission from permission 1 to permission n1 according to the first sample software set. Assuming that the current permission is Figure 5The permission 1 shown in , then it is necessary to determine the first number a1 of software with permission 1 and of the type of malware in the first sample software set, determine the second number b1 of software with permission 1 and of the type of normal software, determine the third number c1 of software without permission 1 and of the type of malware, and determine the fourth number d1 of software without permission 1 and of the type of normal software. Similarly, determine the first number, second number, third number, and fourth number corresponding to permissions 2 to n1 in turn. For a better understanding, taking permission 1 as an example, the corresponding first number, second number, third number, and fourth number are shown in Table 2 as an example:

[0114] Table 2

[0115] Number of malware Number of normal software Permission 1 exists a1 b 1 Permission 1 does not exist c1 d1

[0116] Step S412: Determine a value of the first association parameter corresponding to the current authority according to the first number, the second number, the third number, and the fourth number.

[0117] As an alternative example, Figure 5 As shown, after determining the first quantity a1, the second quantity b1, the third quantity c1, and the fourth quantity d1 corresponding to authority 1, it is necessary to determine the value of the first correlation parameter corresponding to authority 1 according to a1, b1, c1, and d1. Optionally, the chi-square value can be calculated to determine the chi-square value as the value of the first correlation parameter. Specifically, the chi-square value is calculated by the following formula 1:

[0118]

[0119] Among them, x 2 represents the chi-square value, a represents the first quantity, b represents the second quantity, c represents the third quantity, and d represents the fourth quantity. Then, the value P1 of the first correlation parameter corresponding to permission 1 can be calculated according to the first quantity a1, the second quantity b1, the third quantity c1, and the fourth quantity d1 corresponding to permission 1. Similarly, the values ​​P2-Pn1 of the first correlation parameters corresponding to permissions 2 to n1 can be calculated respectively.

[0120] Step S41: According to the order of the values ​​of the first association parameter from high to low, the permissions corresponding to the top N values ​​of the first association parameter in the target permission set are determined as the permissions in the reference permission set, where N is a positive integer greater than or equal to 1, and N is less than the number of permissions in the target permission set.

[0121] As an alternative example, Figure 5As shown, assuming that the first N permissions in the target permission set corresponding to the values ​​of the first correlation parameter in descending order are permission 1, permission 2, permission 3... permission N, the reference permission set is {permission 1, permission 2, permission 3... permission N}.

[0122] In this embodiment, the reference permission set is determined in the above manner, so that the permissions in the determined reference permission set are more representative and have a better ability to distinguish malicious software.

[0123] Step S206: determining an opcode sequence feature vector of the target software according to the current opcode sequence set and a reference opcode sequence set, wherein the reference opcode sequence set includes a group of opcode sequences corresponding to the malware type;

[0124] As an optional example, the above step S206 can be implemented by the following steps S51-S52:

[0125] Step S51: obtaining the intersection of the current operation code sequence set and the reference operation code sequence set to obtain an operation code sequence intersection set;

[0126] As an alternative example, Figure 3 As shown, after the decompilation module decompiles the installation package of the target software to obtain the current opcode sequence set, the decompilation module will execute step S6: send the current opcode sequence set to the opcode sequence feature vector determination module; at the same time, the opcode sequence feature vector determination module will execute step S7: obtain the reference opcode sequence set; and then as shown in FIG. Figure 4 As shown in (b), the operation code sequence feature vector determination module performs an intersection operation on the current operation code sequence set and the reference operation code sequence set to obtain the permission operation code sequence set.

[0127] Step S52: generating the opcode sequence feature vector according to the opcode sequence intersection set, wherein the number of features in the opcode sequence feature vector is the number of opcode sequences in the reference opcode sequence set, each feature in the opcode sequence feature vector corresponds to an opcode sequence in the reference opcode sequence set, and the value of each feature in the opcode sequence feature vector indicates whether the corresponding opcode sequence is an opcode sequence in the opcode sequence intersection set;

[0128] For better understanding, as an optional example, Figure 4As shown in (b), it is assumed that there are M opcode sequences in the reference opcode sequence permission set, and the opcode sequence feature vector is an M-dimensional vector. Assuming that the current opcode sequence set is {DMD, MDI, DIR, IRP, RPM, PMG, MGD, GDI, DIT}, and the reference opcode sequence set is {DMD, DDD, PDI, TTI, MDI, DIR}, after the intersection operation, the obtained opcode sequence intersection set is {DMD, MDI, DIR}. Since the opcode sequence DMD in the reference opcode sequence set exists in the opcode sequence intersection set, the value corresponding to the opcode sequence DMD in the opcode sequence feature vector is 1. Since the opcode sequence PDI in the reference opcode sequence set does not exist in the opcode sequence intersection set, the value corresponding to the opcode sequence PDI in the opcode sequence feature vector is 0. Similarly, the value of each feature in the opcode sequence feature vector can be determined, and the opcode sequence feature vector is (1, 0, 0, 0, 1, 1).

[0129] In this embodiment, the above-mentioned method is used to determine the opcode sequence feature vector, which can more simply express whether the current opcode sequence set has the corresponding opcode sequence in the reference opcode sequence set. In addition, since only considering whether the current opcode sequence set has the corresponding opcode sequence in the reference opcode sequence set, that is, only selecting representative opcode sequences from the current opcode sequence set to determine whether the target software is malware, the interference of invalid opcode sequences is avoided, making it easier to subsequently construct the second detection model.

[0130] As an optional example, before executing the above step S206, it is necessary to determine a reference operation code sequence set, which is specifically implemented by the following steps S61-S62:

[0131] Step S61: Obtain the value of the second association parameter corresponding to each opcode sequence in a preset target opcode sequence set, wherein the value of the second association parameter corresponding to each opcode sequence is used to represent the second association between each opcode sequence and the malware type, and the second association is positively correlated with the value of the second association parameter.

[0132] As an optional example, a larger value of the second correlation parameter indicates that the second correlation between the operation code sequence and the malware type is higher, indicating that the operation code sequence is more capable of distinguishing malware.

[0133] As an optional example, the target opcode sequence set includes but is not limited to the union of the opcode sequence sets corresponding to each second sample software in the second sample software set. Optionally, take the target opcode sequence set as the union of the opcode sequence sets corresponding to each second sample software in the second sample software set as an example.

[0134] As an optional example, the method for determining the operation code sequence set of each second sample software in the second sample software set is the same as the method for determining the current operation code sequence set of the target software. Optionally, assuming that there are 4 second sample software in the second sample software set, wherein the types of the second sample software 1 and the second sample software 2 are malware types, and the types of the second sample software 3 and the second sample software 4 are normal software types, the second sample software 1 is processed to obtain an operation code sequence set of {operation code sequence 1, operation sequence 2, operation code sequence 3}, the second sample software 2 is processed to obtain an operation code sequence set of {operation code sequence 1, operation sequence 3, operation code sequence 4}, the second sample software 3 is processed to obtain an operation code sequence set of {operation code sequence 4, operation sequence 5, operation code sequence 6}, and the second sample software 4 is processed to obtain an operation code sequence set of {operation code sequence 2, operation sequence 5, operation code sequence 7}. Then, a union operation is performed, and the target operation code sequence set obtained is {operation code sequence 1, operation code sequence 2, operation code sequence 3, operation code sequence 4, operation sequence 5, operation code sequence 6, operation code sequence 7}.

[0135] As an optional example, the value of the second correlation parameter corresponding to each operation code sequence in the target operation code sequence set is determined by performing the following steps S612-S614 on each operation code sequence in the target operation code sequence set, wherein when performing the following operations, each operation code sequence is a current operation code sequence:

[0136] Step S612: determining, according to a preset second sample software set, a first information entropy of the malware type and a second information entropy of the malware type under the premise that the current operation code sequence is given;

[0137] As an alternative example, Figure 6 As shown, it is necessary to calculate the first information entropy e and the second information entropy h of each operation code sequence in the target operation code sequence set according to the second sample software set, wherein the calculation formula of the first information entropy e is shown in Formula 2:

[0138] H(Y)=-∑P(y i )log2(P(y i )) (Formula 2);

[0139] Among them, H(Y) represents the information entropy of attribute Y, P(yi) represents the prior probability of all values ​​of Y. In this embodiment, Y is the type of malware, and the value of H(Y) corresponds to the first information entropy.

[0140] The calculation formula of the second information entropy is shown in Formula 3:

[0141] H(Y|X)=-∑P(x i )∑P(y i |x j )log2(P(y i |x j )) (Formula 3);

[0142] Wherein, H(Y|X) represents the information entropy of attribute Y given feature X, and P(yi|xj) is the posterior probability of Y given the value of X. In this embodiment, X is the current operation code sequence, and the value of H(Y|X) corresponds to the second information entropy.

[0143] Step S614: Determine the information gain IG(Y|X) corresponding to the current operation code sequence based on the first information entropy and the second information entropy, wherein the value of the second correlation parameter corresponding to the current operation code sequence is the information gain IG(Y|X) corresponding to the current operation code sequence, Y represents the malware type, and X represents the current operation code sequence.

[0144] As an alternative example, Figure 6 As shown, after determining the first information entropy e and the second information entropy h of each opcode sequence, it is necessary to determine the value F of the second correlation parameter of each opcode sequence according to the first information entropy e and the second information entropy h, where F is equal to the information gain IG(Y|X), and the information gain IG(Y|X) is a measure of the ability of a feature X to distinguish category Y, that is, in this embodiment, the information gain IG(Y|X) represents the ability of the current opcode sequence to measure the type of malware. Optionally, the calculation formula of IG(Y|X) is shown in Formula 4:

[0145] IG(Y|X)=H(Y)-H(Y|X) (Formula 4);

[0146] Then, the value of the second relevance parameter of each opcode sequence can be calculated. It should be noted that if IG(Y|X)>IG(Y|Z), feature X is considered to be more relevant to class Y. In other words, assuming IG(malware type|opcode sequence 1)>IG(malware type|opcode sequence 2), the value of the second relevance parameter of opcode sequence 1 is greater than the value of the second relevance parameter of opcode sequence 1.

[0147] Step S62: in the order of the values ​​of the second correlation parameter from high to low, the opcode sequences corresponding to the top M bits of the values ​​of the second correlation parameter in the target opcode sequence set are determined as the opcode sequences in the reference opcode sequence set, where M is a positive integer greater than or equal to 1, and M is less than the number of opcode sequences in the target opcode sequence set.

[0148] As an alternative example, Figure 6 As shown, assuming that the first M opcode sequences in the target opcode sequence set corresponding to the values ​​of the second correlation parameter in descending order are opcode sequence 1, opcode sequence 2, opcode sequence 3…opcode sequence M, then the reference opcode sequence set is {opcode sequence 1, opcode sequence 2, opcode sequence 3…opcode sequence M}.

[0149] In this embodiment, the reference opcode sequence set is determined in the above manner, so that the opcode sequences in the determined reference opcode sequence set are more representative and have a better ability to distinguish malware.

[0150] Step S208: determining a function call feature vector of the target software according to the current function pair set and a reference function pair set, wherein the reference function pair set includes a group of function pairs corresponding to the malware type;

[0151] As an optional example, the above step S208 can be implemented by the following steps S71-S72:

[0152] Step S71: obtaining the intersection of the current function pair set and the reference function pair set to obtain a function pair intersection set;

[0153] As an alternative example, Figure 3 As shown, after the function pair extraction module processes the installation package of the target software to obtain the current function pair set, the function pair extraction module will execute step S10: send the current function pair set to the function call feature vector determination module; at the same time, the function call feature vector determination module will execute step S11: obtain the reference function pair set; and then as shown in FIG. Figure 4 As shown in (c) in FIG. 8 , the function call feature vector determination module performs an intersection operation on the current function pair set and the reference function pair set to obtain the permission function pair set.

[0154] Step S72: Generate the function call feature vector according to the function pair intersection set, wherein the number of features in the function call feature vector is the number of function pairs in the reference function pair set, each feature in the function call feature vector corresponds to a function pair in the reference function pair set, and the value of each feature in the function call feature vector indicates whether the corresponding function pair is a function pair in the function pair intersection set.

[0155] For better understanding, as an optional example, Figure 4 As shown in (c), it is assumed that there are P function pairs in the reference function pair set, and the function pair feature vector is a P-dimensional vector. Assuming that the current function pair set is {AB, BC, CD, DE, EF}, and the reference function pair set is {AB, MN, CD, XY, EF}, after the intersection operation, the function pair intersection set obtained is {AB, CD, EF}. Since the function pair AB in the reference function pair set exists in the function pair intersection set, the value corresponding to the function pair AB in the function pair feature vector is 1. Since the function pair MN in the reference function pair set does not exist in the function pair intersection set, the value corresponding to the function pair MN in the function pair feature vector is 0. Similarly, the value of each feature in the function pair feature vector can be determined, and the function pair feature vector is (1, 0, 1, 0, 1).

[0156] In this embodiment, the above method is used to determine the function pair feature vector, which can more simply express whether the current function pair set has the corresponding function pair in the reference function pair set. In addition, since only considering whether the current function pair set has the corresponding function pair in the reference function pair set, that is, only selecting representative function pairs from the current function pair set to determine whether the target software is malware, the interference of invalid function pairs is avoided, making it easier to subsequently construct the third detection model.

[0157] As an optional example, before executing step S208, it is also necessary to determine a reference function pair set, which can be optionally implemented by the following steps S81-S82:

[0158] Step S81: Obtain the value of the third correlation parameter corresponding to each function pair in the preset target function pair set, wherein the value of the third correlation parameter corresponding to each function pair is used to represent the third correlation between each function pair and the malware type, and the third correlation is positively correlated with the value of the third correlation parameter.

[0159] As an optional example, a larger value of the third correlation parameter indicates that the third correlation between the function pair and the malware type is higher, indicating that the function pair is more capable of distinguishing malware.

[0160] As an optional example, the target function pair set includes but is not limited to the union of the function pair sets corresponding to each third sample software in the third sample software set. Optionally, the target function pair set is taken as the union of the function pair sets corresponding to each third sample software in the third sample software set.

[0161] As an optional example, the functions in the function pairs in the target function pair set include at least one of the following: native functions in the operating system, developer-defined functions, and obfuscated functions.

[0162] As an optional example, the method for determining the function pair set of each third sample software in the third sample software set is the same as the method for determining the current function pair set of the target software. Figure 7 The third sample software set shown has 4 third sample software, namely: third sample software 1, second sample software 2, second sample software 3, second sample software 4. The third sample software 1 is processed to obtain a function pair set of {AB, BC, AD, CB, DB}, the second sample software 2 is processed to obtain a function pair set of {AB, AE, MB, DE}, the third sample software 3 is processed to obtain a function pair set of {AB, CB, DC, CD}, and the third sample software 4 is processed to obtain a function pair set of {CB, EC, AE}. Then, a union operation is performed to obtain a target function pair set of {AB, BC, AD, CB, DB, AE, MB, DE, DC, CD, EC}. It should be noted that the function pair AB represents function A calling function B. Among them, Figure 7 The function pair 1 in is the function pair AB, the function pair 2 is the function pair BC…the function pair n3 is the function pair EC.

[0163] As an optional example, the value of the third correlation parameter corresponding to each function pair sequence in the target function pair set is determined by performing the following steps S812-S814 on each function pair in the target function pair set, wherein when performing the following operations, each function pair is a current function pair:

[0164] Step S812: in the case where the current function pair represents a first function and a second function having a calling relationship, determining the number of occurrences of the current function pair in a preset third sample software set, and the number of occurrences of each candidate function pair in a candidate function pair set, wherein each candidate function pair represents a function and the second function having a calling relationship, and the type of software in the third sample software set is the malware type;

[0165] As an alternative example, Figure 7As shown, it is necessary to calculate the number of times C that each function pair in the target function pair set appears in the third sample software set ij , and the number of occurrences C of each candidate function pair in the candidate function pair set kj . Among them, ij represents a function pair, which is used to indicate that function i calls function j, and k belongs to the function type set corresponding to the target function pair set. Figure 7 The function pair 1 (S12) shown is used to indicate that function 1 calls function 2, and C12 is used to indicate the number of times the function pair 1 (S12) appears in the third sample software set.

[0166] As an optional example, assuming that the target function pair set is the above {AB, BC, AD, CB, DB, AE, MB, DE, DC, CD, EC}, then the target function pair set has 6 types of functions, including: A, B, C, D, E, M (for example, the above k belongs to one of them). Assume that the third sample software set includes: third sample software 1, second sample software 2, second sample software 3, and second sample software 4. Then the function pair set corresponding to the third sample software set is {AB, BC, AD, CB, DB, AB, AE, MB, DE, AB, CB, DC, CD, CB, EC, AE}. Then it can be determined that the number of times the function pair AB in the target function pair set appears in the third sample software set is 3. Since B in the function pair AB is the second function, the function pairs in the candidate function pair set corresponding to the function pair AB are function pairs in which any function has a calling relationship with the second function B. Specifically, the candidate function pair set corresponding to the function pair AB includes {AB, CB, DB, MB}, and the number of times each candidate function pair in the candidate function pair set appears can be obtained (AB: 3 times; CB: 3 times; DB: 1 time; MB: 1 time). Similarly, the number of times other function pairs in the target function pair set appear in the third sample software set and the number of times each candidate function pair in the corresponding candidate function pair set appear can be calculated.

[0167] Step S814: Determine the transition probability of the current function pair based on the number of times the current function pair appears and the number of times each candidate function pair in the candidate function pair set appears, wherein the value of the third association parameter corresponding to the current function pair is the transition probability of the current function pair.

[0168] As an optional example, the number of occurrences of the current function pair may be divided by the sum of the number of occurrences of each candidate function pair in the candidate function pair set to determine the transition probability of the current function pair. Specifically, the transition probability is calculated using the following formula 5:

[0169]

[0170] Among them, Pij represents the transition probability of the function to ij, C ij Represents the number of times the function pair ij appears, and A belongs to the set of function types corresponding to the target function set.

[0171] As an alternative example, Figure 7 As shown, in determining the number of occurrences of each function pair C ij And the number of occurrences C of each candidate function pair in the corresponding candidate function pair set kj Afterwards, the value J of the third correlation parameter of each function pair can be calculated according to the calculation method of the above-mentioned current function pair transition probability. Specifically, taking the above-mentioned function pair AB as an example, the number of times the function pair AB appears is 3 times, and the sum of the number of times each candidate function pair in the candidate function pair set corresponding to the function pair AB appears is 8. Then, the transition probability of the function pair AB can be calculated to be 3 / 8, that is, the value of the third correlation parameter of the function pair AB is 3 / 8. Similarly, the value of the third correlation parameter of each function pair in the target function pair set can be determined.

[0172] Step S82: In the order of the values ​​of the third correlation parameter from high to low, the function pairs corresponding to the top P values ​​of the third correlation parameter in the target function pair set are determined as the function pairs in the reference function pair set, where P is a positive integer greater than or equal to 1, and P is less than the number of function pairs in the target function pair set.

[0173] As an alternative example, Figure 7 As shown, assuming that the first P function pairs in the target function pair set in descending order of the values ​​of the third correlation parameter are function pair 1...function pair P, then the reference function pair set is {function pair 1...function pair P}.

[0174] In this embodiment, the reference function pair set is determined in the above manner, so that the function pairs in the determined reference function pair set are more representative and have a better ability to distinguish malware.

[0175] As an optional example, the above steps S204-S208 are performed asynchronously. Figure 3 The steps S2-S5, S6-S9, S10-S13 shown are also performed asynchronously.

[0176] Step S210: Determine whether the type of the target software is the malware type based on the permission feature vector, the operation code sequence feature vector, and the function call feature vector.

[0177] As an optional example, the above step S210 can be implemented through steps S92-S98:

[0178] Step S92: inputting the permission feature vector into a first detection model to obtain a first detection result, wherein the first detection result is used to indicate whether the type of the target software is the malware type;

[0179] As an alternative example, Figure 3 As shown, after determining the permission feature vector, the permission feature vector determination module will execute Figure 3 Step S4 shown: sending the authority feature vector to the first detection model, and then the first detection model obtains the first detection result.

[0180] Step S94: inputting the operation code sequence feature vector into a second detection model to obtain a second detection result, wherein the second detection result is used to indicate whether the type of the target software is the malware type;

[0181] As an alternative example, Figure 3 As shown, after determining the opcode sequence feature vector, the opcode sequence feature vector determination module will execute Figure 3 Step S8 shown: sending the operation code sequence feature vector to the second detection model, and then the second detection model obtains the second detection result.

[0182] Step S96: inputting the function call feature vector into a third detection model to obtain a third detection result, wherein the third detection result is used to indicate whether the type of the target software is the malware type;

[0183] As an alternative example, Figure 3 As shown, after determining the function call feature vector, the function call feature vector determination module will execute Figure 3 Step S12 shown: sending the function call feature vector to the third detection model, and then the third detection model obtains the third detection result.

[0184] As an optional example, the above steps S92-S96 are executed asynchronously.

[0185] Step S98: Input the first detection result, the second detection result, and the third detection result into a fusion detection model to obtain a target detection result, wherein the target detection result is used to indicate whether the type of the target software is the malware type.

[0186] As an alternative example, Figure 3As shown, after obtaining the first detection result, the first detection model executes step S5: sending the first detection result to the fusion detection model; after obtaining the second detection result, the second detection model executes step S9: sending the second detection result to the fusion detection model; after obtaining the third detection result, the third detection model executes step S13: sending the third detection result to the fusion detection model; then, after the fusion detection model obtains the first detection result, the second detection result and the third detection result, the target detection result is obtained according to the first detection result, the second detection result and the third detection result, and step S14 is executed: outputting the target detection result.

[0187] As an optional example, at least two of the first detection model, the second detection model, the third detection model, and the fusion detection model are models constructed using a random forest algorithm. The random forest has multiple decision trees, and the categories output by the random forest are determined by the mode of the categories output by the individual decision trees.

[0188] As an alternative example, Figure 8 As shown, the detection model can be constructed in the following manner, specifically including a detection model training process and a detection model testing process, wherein the detection model constructed in the following manner can be a first detection model, a second detection model, or a third detection model:

[0189] Among them, the training process of the detection model is Figure 8 Steps S1-S5 shown in (a) of FIG. 1 are implemented as follows:

[0190] Step S1.1: extracting sample software from the sample malware set and the sample normal software set respectively to obtain n training sample software;

[0191] As an optional example, n / 2 training sample software may be extracted from the sample malware set and the sample normal software set respectively by random sampling.

[0192] Step S1.2: determining a training feature vector corresponding to each training sample software in the n training sample software;

[0193] As an optional example, the method of determining the training feature vector corresponding to each training sample software is the same as the method of determining the feature vector corresponding to the target software.

[0194] Step S1.3: sending the training feature vector and software type corresponding to each training sample software in the n training sample software to the original detection model;

[0195] Step S1.4: the original detection model is trained using n training feature vectors and corresponding software types;

[0196] As an optional example, during the training of the original detection model, if the accuracy of the software type predicted based on the n training feature vectors is less than the first preset accuracy, the parameters of the original detection model will be adjusted and the training will continue.

[0197] Step S1.5: When it is determined that the original detection model meets the training end condition, the original detection model is determined as the test detection model.

[0198] As an optional example, the training termination condition of the original detection model is that the accuracy of the software type predicted by the original detection model based on n training feature vectors is greater than or equal to the first preset accuracy. Optionally, assuming that there are 100 training feature vectors and the first preset accuracy is 90%, if the original detection model predicts that the software type corresponding to 95 training feature vectors is correct, that is, the prediction accuracy of the original detection model is greater than 90%, and then the original detection model meets the training termination condition.

[0199] The testing process of the detection model is carried out through Figure 8 Steps S1-S4 shown in (b) in FIG. 1 are implemented as follows:

[0200] Step S2.1: extracting sample software from the sample malware set and the sample normal software set respectively to obtain x test sample software;

[0201] As an optional example, n / 2 test sample software may be extracted from the sample malware set and the sample normal software set respectively by random sampling.

[0202] Step S2.2: Determine the feature vector corresponding to each of the x test sample software;

[0203] As an optional example, the method of determining the test feature vector corresponding to each test sample software is the same as the method of determining the feature vector corresponding to the target software.

[0204] Step S2.3: sending the training feature vector and software type corresponding to each of the x test sample software to the test detection model for testing;

[0205] Step S2.4: When it is determined that the test accuracy of the test detection model for the x test sample software meets the corresponding conditions, the test detection model is determined as the detection model.

[0206] As an optional example, when the test accuracy of the test detection model is greater than or equal to the second preset accuracy, it is determined that the corresponding condition is met. Optionally, the first preset accuracy and the second preset accuracy may be equal or unequal. Optionally, assuming that there are 100 test feature vectors and the second preset accuracy is 90%, if the test detection model predicts that the software type corresponding to 95 training feature vectors is correct, that is, the test accuracy of the test detection model is greater than 90%, and then the test detection model meets the corresponding condition.

[0207] As an optional example, when it is determined that the test accuracy of the test detection model for the x test sample software does not meet the corresponding conditions, the above-mentioned training process of the detection model and the testing process of the detection model can be re-executed.

[0208] In the embodiment of the present application, the detection model obtained by the above method improves the detection accuracy of the detection model.

[0209] As an alternative example, Fig. 9 As shown, the fusion detection model can be constructed in the following ways, including the training process and the testing process of the fusion detection model:

[0210] Among them, the training process of the fusion detection model is Fig. 9 Steps S1-S6 shown in (a) in the embodiment are implemented as follows:

[0211] Step S1.1: input each sample software in the sample software set into the first detection model, the second detection model and the third detection model for detection;

[0212] Step S1.2: The first detection model, the second detection model, and the third detection model respectively output the detection results of each sample software to obtain a first detection result set, a second detection result set, and a third detection result set;

[0213] Step S1.3: extracting the test results of some sample software from the first test result set, the second test result set and the third test result set as a training result set, wherein the training result set includes the first test results, the second test results and the third test results corresponding to the plurality of training sample software;

[0214] Step S1.4: Send the training result set to the original fusion detection model;

[0215] Step S1.5: the original fusion detection model is trained using the training result set;

[0216] As an optional example, during the training of the original fusion detection model, if the accuracy of the software type predicted by the training result set is less than the third preset accuracy, the parameters of the original fusion detection model will be adjusted to continue training. Optionally, assuming that the training result set has 100 sample software corresponding to the first detection result, the second detection result, and the third detection result; the third preset accuracy is 90%, if the original fusion detection model predicts that the software type corresponding to 95 sample software is correct, that is, the prediction accuracy of the original fusion detection model is greater than 90%, and the original fusion detection model meets the training end condition.

[0217] Step S1.6: When it is determined that the original fusion detection model meets the training end condition, the original fusion detection model is determined as the test fusion detection model.

[0218] As an optional example, the training termination condition of the original fusion detection model is that the accuracy of the software type predicted according to the training result set is greater than or equal to a third preset accuracy.

[0219] Among them, the testing process of the fusion detection model is Fig. 9 Steps S1-S5 shown in (b) in FIG. 1 are implemented as follows:

[0220] Step S2.1: input each sample software in the sample software set into the first detection model, the second detection model and the third detection model for detection;

[0221] Step S2.2: The first detection model, the second detection model, and the third detection model respectively output the detection results of each sample software to obtain a first detection result set, a second detection result set, and a third detection result set;

[0222] Step S2.3: extracting test results of some sample software from the first test result set, the second test result set and the third test result set as a test result set, wherein the test result set includes first test results, second test results and third test results corresponding to a plurality of test sample software;

[0223] Step S2.4: Send the test result set to the test fusion detection model for testing;

[0224] Step S2.5: When it is determined that the test fusion detection model satisfies the corresponding conditions for the test accuracy of the test sample software detection according to the test result set, the test fusion detection model is determined as the fusion detection model.

[0225] As an optional example, when the test accuracy of the test fusion detection model is greater than or equal to the fourth preset accuracy, it is determined that the corresponding condition is met. Optionally, the third preset accuracy and the fourth preset accuracy may be equal or unequal. Optionally, assuming that the test result set contains 100 sample software corresponding to the first test result, the second test result and the third test result; the fourth preset accuracy is 90%, if the test fusion detection model predicts that the software type corresponding to 95 sample software is correct, that is, the test accuracy of the test fusion detection model is greater than 90%, that is, the test fusion detection model meets the corresponding condition.

[0226] As an optional example, when it is determined that the test accuracy of the test fusion detection model for detecting the test sample software according to the test result set does not meet the corresponding conditions, the training process of the fusion detection model and the testing process of the fusion detection model are re-executed.

[0227] In the embodiment of the present application, the fusion detection model is determined in the above manner, thereby improving the detection accuracy of the fusion detection model.

[0228] In the embodiment of the present application, feature vectors of multiple dimensions of the target software are obtained, including the permission feature vector, the opcode sequence feature vector, and the function call feature vector of the target software. The feature vectors of the above multiple dimensions can characterize the behavior relationship of the target software (for example, the function call relationship), and characterize different types of functions (for example, obfuscated functions). In this way, according to the feature vectors of the above multiple dimensions, it is possible to accurately detect whether the type of the target software is malware, which solves the technical problem of low accuracy of software detection in the related art and achieves the technical effect of improving the accuracy of software detection.

[0229] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0230] According to another aspect of the embodiment of the present application, a software testing device for implementing the above software testing method is also provided. Fig.10 As shown, the device comprises:

[0231] An acquisition module 1002 is used to acquire a current permission set, a current operation code sequence set, and a current function pair set of the target software, wherein the current operation code sequence set includes operation code sequences corresponding to functions in the target software, and the current function pair set includes function pairs having a calling relationship in the target software;

[0232] A first determination module 1004, configured to determine a permission feature vector of the target software according to the current permission set and a reference permission set, wherein the reference permission set includes a set of permissions corresponding to a malware type;

[0233] A second determination module 1006 is configured to determine an operation code sequence feature vector of the target software according to the current operation code sequence set and a reference operation code sequence set, wherein the reference operation code sequence set includes a group of operation code sequences corresponding to the malware type;

[0234] A third determination module 1008, configured to determine a function call feature vector of the target software according to the current function pair set and a reference function pair set, wherein the reference function pair set includes a group of function pairs corresponding to the malware type;

[0235] The fourth determination module 1010 is used to determine whether the type of the target software is the malware type according to the permission feature vector, the operation code sequence feature vector and the function call feature vector.

[0236] In the embodiment of the present application, feature vectors of multiple dimensions of the target software are obtained, including the permission feature vector, the opcode sequence feature vector, and the function call feature vector of the target software. The feature vectors of the above multiple dimensions can characterize the behavior relationship of the target software (for example, the function call relationship), and characterize different types of functions (for example, obfuscated functions). In this way, according to the feature vectors of the above multiple dimensions, it is possible to accurately detect whether the type of the target software is malware, which solves the technical problem of low accuracy of software detection in the related art and achieves the technical effect of improving the accuracy of software detection.

[0237] Optionally, the first determining module 1004 includes:

[0238] A first acquisition unit, configured to acquire an intersection of the current permission set and the reference permission set to obtain a permission intersection set;

[0239] A first generating unit is used to generate the permission feature vector according to the permission intersection set, wherein the number of features in the permission feature vector is the number of permissions in the reference permission set, each feature in the permission feature vector corresponds to a permission in the reference permission set, and the value of each feature in the permission feature vector indicates whether the corresponding permission is a permission in the permission intersection set.

[0240] Optionally, the second determining module 1006 includes:

[0241] A second acquisition unit is used to acquire an intersection of the current operation code sequence set and the reference operation code sequence set to obtain an operation code sequence intersection set;

[0242] A second generating unit is configured to generate the opcode sequence feature vector according to the opcode sequence intersection set, wherein the number of features in the opcode sequence feature vector is the number of opcode sequences in the reference opcode sequence set, each feature in the opcode sequence feature vector corresponds to an opcode sequence in the reference opcode sequence set, and the value of each feature in the opcode sequence feature vector indicates whether the corresponding opcode sequence is an opcode sequence in the opcode sequence intersection set.

[0243] Optionally, the third determining module 1008 includes:

[0244] A third acquisition unit is used to acquire the intersection of the current function pair set and the reference function pair set to obtain a function pair intersection set;

[0245] A third generating unit is used to generate the function call feature vector according to the function pair intersection set, wherein the number of features in the function call feature vector is the number of function pairs in the reference function pair set, each feature in the function call feature vector corresponds to a function pair in the reference function pair set, and the value of each feature in the function call feature vector indicates whether the corresponding function pair is a function pair in the function pair intersection set.

[0246] Optionally, the above device further includes: a fifth determining module; the fifth determining module includes:

[0247] a fourth acquisition unit, configured to acquire a value of a first correlation parameter corresponding to each permission in a preset target permission set before determining the permission feature vector of the target software according to the current permission set and the reference permission set, wherein the value of the first correlation parameter corresponding to each permission is used to represent a first correlation between each permission and the malware type, and the first correlation is positively correlated with the value of the first correlation parameter;

[0248] A first determination unit is used to determine the permissions corresponding to the top N values ​​of the first association parameter in the target permission set as permissions in the reference permission set in order of the values ​​of the first association parameter from high to low, where N is a positive integer greater than or equal to 1, and N is less than the number of permissions in the target permission set.

[0249] Optionally, a fourth acquisition unit is used to obtain the value of the first association parameter corresponding to each permission in a preset target permission set in the following manner: perform the following operations for each permission in the target permission set, wherein when the following operations are performed, each permission is a current permission: determine a first number of software with the current permission and of the malware type in a preset first sample software set, determine a second number of software with the current permission and of the normal software type, determine a third number of software without the current permission and of the malware type, and determine a fourth number of software without the current permission and of the normal software type; determine the value of the first association parameter corresponding to the current permission based on the first number, the second number, the third number and the fourth number.

[0250] Optionally, the above device further includes: a sixth determining module; the sixth determining module includes:

[0251] a fifth acquisition unit, configured to acquire a value of a second correlation parameter corresponding to each opcode sequence in a preset target opcode sequence set before determining the opcode sequence feature vector of the target software according to the current opcode sequence set and the reference opcode sequence set, wherein the value of the second correlation parameter corresponding to each opcode sequence is used to represent a second correlation between each opcode sequence and the malware type, and the second correlation is positively correlated with the value of the second correlation parameter;

[0252] A second determination unit is used to determine, in descending order of the values ​​of the second association parameter, the opcode sequences corresponding to the top M bits of the values ​​of the second association parameter in the target opcode sequence set as the opcode sequences in the reference opcode sequence set, wherein M is a positive integer greater than or equal to 1, and M is less than the number of opcode sequences in the target opcode sequence set.

[0253] Optionally, a fifth acquisition unit is used to obtain the value of the second correlation parameter corresponding to each operation code sequence in a preset target operation code sequence set in the following manner: perform the following operations on each operation code sequence in the target operation code sequence set, wherein when the following operations are performed, each operation code sequence is a current operation code sequence: determine, based on a preset second sample software set, a first information entropy of the malware type, and a second information entropy of the malware type under the premise that the current operation code sequence is given; determine, based on the first information entropy and the second information entropy, an information gain IG(Y|X) corresponding to the current operation code sequence, wherein the value of the second correlation parameter corresponding to the current operation code sequence is the information gain IG(Y|X) corresponding to the current operation code sequence, where Y represents the malware type and X represents the current operation code sequence.

[0254] Optionally, the above device further includes: a seventh determining module; the seventh determining module includes:

[0255] a sixth acquisition unit, configured to acquire a value of a third correlation parameter corresponding to each function pair in a preset target function pair set before determining the function call feature vector of the target software according to the current function pair set and the reference function pair set, wherein the value of the third correlation parameter corresponding to each function pair is used to represent a third correlation between each function pair and the malware type, and the third correlation is positively correlated with the value of the third correlation parameter;

[0256] A third determination unit is used to determine the function pairs corresponding to the top P values ​​of the third correlation parameter in the target function pair set as the function pairs in the reference function pair set in the order of the values ​​of the third correlation parameter from high to low, wherein P is a positive integer greater than or equal to 1, and P is less than the number of function pairs in the target function pair set.

[0257] Optionally, a sixth acquisition unit is used to obtain the value of a third association parameter corresponding to each function pair in a preset target function pair set in the following manner: performing the following operations on each function pair sequence in the target function pair sequence set, wherein when the following operations are performed, each function pair is a current function pair: when the current function pair represents a first function and a second function having a calling relationship, determining the number of occurrences of the current function pair in a preset third sample software set and the number of occurrences of each candidate function pair in a candidate function pair set, wherein each candidate function pair represents a function and the second function having a calling relationship, and the type of software in the third sample software set is the malware type; determining the transition probability of the current function pair based on the number of occurrences of the current function pair and the number of occurrences of each candidate function pair in the candidate function pair set, wherein the value of the third association parameter corresponding to the current function pair is the transition probability of the current function pair.

[0258] Optionally, the functions in the function pairs in the target function pair set include at least one of the following: native functions in the operating system, developer-defined functions, and obfuscated functions.

[0259] Optionally, the fourth determining module 1010 includes:

[0260] A first detection unit, configured to input the permission feature vector into a first detection model to obtain a first detection result, wherein the first detection result is used to indicate whether the type of the target software is the malware type;

[0261] A second detection unit, configured to input the operation code sequence feature vector into a second detection model to obtain a second detection result, wherein the second detection result is used to indicate whether the type of the target software is the malware type;

[0262] A third detection unit, used for inputting the function call feature vector into a third detection model to obtain a third detection result, wherein the third detection result is used to indicate whether the type of the target software is the malware type;

[0263] The fourth detection unit is used to input the first detection result, the second detection result, and the third detection result into a fusion detection model to obtain a target detection result, wherein the target detection result is used to indicate whether the type of the target software is the malware type.

[0264] Optionally, at least two of the first detection model, the second detection model, the third detection model, and the fusion detection model are models constructed using a random forest algorithm.

[0265] According to one aspect of the present application, a computer program product is provided, the computer program product comprising a computer program / instruction, the computer program / instruction comprising a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 1109, and / or installed from a removable medium 1111. When the computer program is executed by the central processor 1101, various functions provided in the embodiments of the present application are executed.

[0266] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0267] Fig.11 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown.

[0268] It should be noted that Fig.11 The computer system 1100 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0269] like Fig.11 As shown, the computer system 1100 includes a central processing unit 1101 (CPU), which can perform various appropriate actions and processes according to the program stored in the read-only memory 1102 (ROM) or the program loaded from the storage part 1108 to the random access memory 1103 (RAM). Various programs and data required for system operation are also stored in the random access memory 1103. The central processing unit 1101, the read-only memory 1102 and the random access memory 1103 are connected to each other through a bus 1104. An input / output interface 1105 (Input / Output interface, i.e., I / O interface) is also connected to the bus 1104.

[0270] The following components are connected to the input / output interface 1105: an input section 1106 including a keyboard, a mouse, etc.; an output section 1107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN card, a modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the input / output interface 1105 as needed. A removable medium 1111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1110 as needed so that a computer program read therefrom is installed into the storage section 1108 as needed.

[0271] In particular, according to an embodiment of the present application, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1109, and / or installed from the removable medium 1111. When the computer program is executed by the central processor 1101, various functions defined in the system of the present application are executed.

[0272] According to another aspect of the embodiment of the present application, an electronic device for implementing the above software testing method is also provided. The electronic device may be Figure 1 The terminal device or server shown in the figure. This embodiment is described by taking the electronic device as a terminal device as an example. Fig.12 As shown, the electronic device includes a memory 1202 and a processor 1204. The memory 1202 stores a computer program, and the processor 1204 is configured to execute the steps in any of the above method embodiments through the computer program.

[0273] Optionally, in this embodiment, the electronic device may be located in at least one network device among a plurality of network devices of a computer network.

[0274] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0275] S1, obtaining a current permission set, a current operation code sequence set, and a current function pair set of the target software, wherein the current operation code sequence set includes operation code sequences corresponding to functions in the target software, and the current function pair set includes function pairs having a calling relationship in the target software;

[0276] S2, determining a permission feature vector of the target software according to the current permission set and a reference permission set, wherein the reference permission set includes a group of permissions corresponding to the malware type;

[0277] S3, determining an operation code sequence feature vector of the target software according to the current operation code sequence set and a reference operation code sequence set, wherein the reference operation code sequence set includes a group of operation code sequences corresponding to the malware type;

[0278] S4, determining a function call feature vector of the target software according to the current function pair set and a reference function pair set, wherein the reference function pair set includes a group of function pairs corresponding to the malware type;

[0279] S5: Determine whether the type of the target software is the malware type according to the permission feature vector, the operation code sequence feature vector, and the function call feature vector.

[0280] Alternatively, a person skilled in the art may understand that: Fig.12 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (MID), a PAD, and other terminal devices. Fig.12 The electronic device and the electronic equipment described above are not limited in structure. Fig.12 More or fewer components (such as network interfaces, etc.) as shown in, or with Fig.12 Different configurations shown.

[0281] Among them, the memory 1202 can be used to store software programs and modules, such as the program instructions / modules corresponding to the software testing method and device in the embodiment of the present application. The processor 1204 executes various functional applications and data processing by running the software programs and modules stored in the memory 1202, that is, realizing the above-mentioned software testing method. The memory 1202 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1202 may further include a memory remotely arranged relative to the processor 1204, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Among them, the memory 1202 can be specifically, but not limited to, used for information such as reference permission sets, reference operation code sequence sets, and reference function pair sets. As an example, such as Fig.12 As shown, the memory 1202 may include, but is not limited to, the acquisition module 1002, the first determination module 1004, the second determination module 1006, the third determination module 1008, and the fourth determination module 1010 in the software testing device. In addition, other module units in the software testing device may also be included but are not limited to, which will not be repeated in this example.

[0282] Optionally, the transmission device 1206 is used to receive or send data via a network. Specific examples of the network may include a wired network and a wireless network. In one example, the transmission device 1206 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 1206 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0283] In addition, the electronic device further includes: a display 1208 for displaying whether the target software is a malware type; and a connection bus 1310 for connecting various module components in the electronic device.

[0284] In other embodiments, the terminal device or server may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes through network communication. Among them, the nodes may form a peer-to-peer (P2P, Peer To Peer) network, and any form of computing device, such as a server, terminal and other electronic devices, may become a node in the blockchain system by joining the peer-to-peer network.

[0285] According to one aspect of the present application, a computer-readable storage medium is provided, and a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the software testing method provided in the above-mentioned various optional implementations.

[0286] Optionally, in this embodiment, the computer-readable storage medium may be configured to store a computer program for performing the following steps:

[0287] S1, obtaining a current permission set, a current operation code sequence set, and a current function pair set of the target software, wherein the current operation code sequence set includes operation code sequences corresponding to functions in the target software, and the current function pair set includes function pairs having a calling relationship in the target software;

[0288] S2, determining a permission feature vector of the target software according to the current permission set and a reference permission set, wherein the reference permission set includes a group of permissions corresponding to the malware type;

[0289] S3, determining an operation code sequence feature vector of the target software according to the current operation code sequence set and a reference operation code sequence set, wherein the reference operation code sequence set includes a group of operation code sequences corresponding to the malware type;

[0290] S4, determining a function call feature vector of the target software according to the current function pair set and a reference function pair set, wherein the reference function pair set includes a group of function pairs corresponding to the malware type;

[0291] S5: Determine whether the type of the target software is the malware type according to the permission feature vector, the operation code sequence feature vector, and the function call feature vector.

[0292] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0293] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0294] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.

[0295] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0296] In the several embodiments provided in the present application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0297] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0298] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0299] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A software detection method, characterized in that: include: Acquire a current permission set, a current operation code sequence set, and a current function pair set of the target software, wherein the current operation code sequence set includes operation code sequences corresponding to functions in the target software, and the current function pair set includes function pairs having a calling relationship in the target software; Determining a permission feature vector of the target software according to the current permission set and a reference permission set, wherein the reference permission set includes a set of permissions corresponding to a malware type; Determining an opcode sequence feature vector of the target software according to the current opcode sequence set and a reference opcode sequence set, wherein the reference opcode sequence set includes a group of opcode sequences corresponding to the malware type; Determining a function call feature vector of the target software according to the current function pair set and a reference function pair set, wherein the reference function pair set includes a group of function pairs corresponding to the malware type; Determining whether the type of the target software is the malware type according to the permission feature vector, the operation code sequence feature vector, and the function call feature vector; The step of obtaining the current permission set, the current operation code sequence set, and the current function pair set of the target software includes: Decompiling the obtained installation package of the target software through a decompiling module to obtain an assembly file set and a configuration file corresponding to the assembly file set; determining the current permission set through all permissions recorded in the configuration file; extracting the operation code of the target software by scanning the assembly file set, and simplifying the extracted operation code to obtain a simplified operation code set; using the N-gram method to generate the current operation code sequence set for the simplified operation code set; and The installation package of the target software is processed by a function pair extraction module to obtain a function relationship graph file; multiple function pairs are determined by the calling relationship between functions in the function calling relationship in the function relationship graph file to obtain a current function pair set; Wherein, before determining the function call feature vector of the target software according to the current function pair set and the reference function pair set, the method further includes: obtaining the value of the third correlation parameter corresponding to each function pair in the preset target function pair set, wherein the value of the third correlation parameter corresponding to each function pair is used to represent the third correlation between each function pair and the malware type, and the third correlation is positively correlated with the value of the third correlation parameter; in descending order of the values ​​of the third correlation parameter, determining the function pairs corresponding to the top P values ​​of the third correlation parameter in the target function pair set as the function pairs in the reference function pair set, wherein P is a positive integer greater than or equal to 1, and P is less than the number of function pairs in the target function pair set; Wherein, obtaining the value of the third correlation parameter corresponding to each function pair in the preset target function pair set includes: performing the following operations on each function pair sequence in the target function pair sequence set, wherein when performing the following operations, each function pair is a current function pair: in the case where the current function pair represents a first function and a second function having a calling relationship, determining the number of occurrences of the current function pair in a preset third sample software set, and the number of occurrences of each candidate function pair in a candidate function pair set, wherein each candidate function pair represents a function and the second function having a calling relationship, and the type of software in the third sample software set is the malware type; determining the transition probability of the current function pair according to the number of occurrences of the current function pair and the number of occurrences of each candidate function pair in the candidate function pair set, wherein the value of the third correlation parameter corresponding to the current function pair is the transition probability of the current function pair.

2. The method according to claim 1, characterized in that The step of determining the permission feature vector of the target software according to the current permission set and the reference permission set includes: Obtaining the intersection of the current permission set and the reference permission set to obtain a permission intersection set; The permission feature vector is generated according to the permission intersection set, wherein the number of features in the permission feature vector is the number of permissions in the reference permission set, each feature in the permission feature vector corresponds to a permission in the reference permission set, and the value of each feature in the permission feature vector indicates whether the corresponding permission is a permission in the permission intersection set.

3. The method according to claim 1, characterized in that The step of determining the opcode sequence feature vector of the target software according to the current opcode sequence set and the reference opcode sequence set includes: Obtaining an intersection of the current operation code sequence set and the reference operation code sequence set to obtain an operation code sequence intersection set; The opcode sequence feature vector is generated according to the opcode sequence intersection set, wherein the number of features in the opcode sequence feature vector is the number of opcode sequences in the reference opcode sequence set, each feature in the opcode sequence feature vector corresponds to an opcode sequence in the reference opcode sequence set, and the value of each feature in the opcode sequence feature vector indicates whether the corresponding opcode sequence is an opcode sequence in the opcode sequence intersection set.

4. The method according to claim 1, characterized in that: The step of determining the function call feature vector of the target software according to the current function pair set and the reference function pair set includes: Obtaining the intersection of the current function pair set and the reference function pair set to obtain a function pair intersection set; The function call feature vector is generated according to the function pair intersection set, wherein the number of features in the function call feature vector is the number of function pairs in the reference function pair set, each feature in the function call feature vector corresponds to a function pair in the reference function pair set, and the value of each feature in the function call feature vector indicates whether the corresponding function pair is a function pair in the function pair intersection set.

5. The method according to claim 1, characterized in that Before determining the permission feature vector of the target software according to the current permission set and the reference permission set, the method further includes: Obtaining a value of a first correlation parameter corresponding to each permission in a preset target permission set, wherein the value of the first correlation parameter corresponding to each permission is used to represent a first correlation between each permission and the malware type, and the first correlation is positively correlated with the value of the first correlation parameter; In descending order of the values ​​of the first association parameter, the permissions corresponding to the top N values ​​of the first association parameter in the target permission set are determined as permissions in the reference permission set, where N is a positive integer greater than or equal to 1, and N is less than the number of permissions in the target permission set.

6. The method according to claim 5, characterized in that The obtaining of the value of the first correlation parameter corresponding to each permission in the preset target permission set includes: Perform the following operations on each permission in the target permission set, wherein each permission is a current permission when the following operations are performed: Determine, in a preset first sample software set, a first number of software having the current permission and being of the malware type, a second number of software having the current permission and being of the normal software type, a third number of software not having the current permission and being of the malware type, and a fourth number of software not having the current permission and being of the normal software type; A value of the first association parameter corresponding to the current authority is determined according to the first number, the second number, the third number, and the fourth number.

7. The method according to claim 1, characterized in that Before determining the operation code sequence feature vector of the target software according to the current operation code sequence set and the reference operation code sequence set, the method further includes: Obtaining a value of a second correlation parameter corresponding to each opcode sequence in a preset target opcode sequence set, wherein the value of the second correlation parameter corresponding to each opcode sequence is used to represent a second correlation between each opcode sequence and the malware type, and the second correlation is positively correlated with the value of the second correlation parameter; According to the order of the values ​​of the second association parameter from high to low, the opcode sequences corresponding to the top M bits of the values ​​of the second association parameter in the target opcode sequence set are determined as the opcode sequences in the reference opcode sequence set, where M is a positive integer greater than or equal to 1, and M is less than the number of opcode sequences in the target opcode sequence set.

8. The method according to claim 7, characterized in that The obtaining of the value of the second correlation parameter corresponding to each operation code sequence in the preset target operation code sequence set includes: Perform the following operations on each opcode sequence in the target opcode sequence set: Wherein, when performing the following operations, each of the operation code sequences is a current operation code sequence: Determine, according to a preset second sample software set, a first information entropy of the malware type, and a second information entropy of the malware type under the premise that the current operation code sequence is given; According to the first information entropy and the second information entropy, the information gain IG(Y|X) corresponding to the current operation code sequence is determined, wherein the value of the second correlation parameter corresponding to the current operation code sequence is the information gain IG(Y|X) corresponding to the current operation code sequence, Y represents the malware type, and X represents the current operation code sequence.

9. The method according to claim 1, characterized in that: The functions in the function pairs in the target function pair set include at least one of the following: native functions in the operating system, developer-defined functions, and obfuscated functions.

10. The method according to any one of claims 1 to 9, characterized in that The determining, according to the permission feature vector, the operation code sequence feature vector, and the function call feature vector, whether the type of the target software is the malware type comprises: Inputting the permission feature vector into a first detection model to obtain a first detection result, wherein the first detection result is used to indicate whether the type of the target software is the malware type; Inputting the operation code sequence feature vector into a second detection model to obtain a second detection result, wherein the second detection result is used to indicate whether the type of the target software is the malware type; Inputting the function call feature vector into a third detection model to obtain a third detection result, wherein the third detection result is used to indicate whether the type of the target software is the malware type; The first detection result, the second detection result, and the third detection result are input into a fusion detection model to obtain a target detection result, wherein the target detection result is used to indicate whether the type of the target software is the malware type.

11. The method according to claim 10, characterized in that At least two of the first detection model, the second detection model, the third detection model, and the fusion detection model are models constructed using a random forest algorithm.

12. A software detection device, characterized in that: include: An acquisition module, used to acquire a current permission set, a current operation code sequence set, and a current function pair set of the target software, wherein the current operation code sequence set includes operation code sequences corresponding to functions in the target software, and the current function pair set includes function pairs having a calling relationship in the target software; A first determination module, configured to determine a permission feature vector of the target software according to the current permission set and a reference permission set, wherein the reference permission set includes a set of permissions corresponding to a malware type; A second determination module is configured to determine an operation code sequence feature vector of the target software according to the current operation code sequence set and a reference operation code sequence set, wherein the reference operation code sequence set includes a group of operation code sequences corresponding to the malware type; a third determination module, configured to determine a function call feature vector of the target software according to the current function pair set and a reference function pair set, wherein the reference function pair set includes a group of function pairs corresponding to the malware type; a fourth determination module, configured to determine whether the type of the target software is the malware type according to the permission feature vector, the operation code sequence feature vector, and the function call feature vector; The device obtains the current permission set, the current operation code sequence set and the current function pair set of the target software in the following manner: Decompiling the obtained installation package of the target software through a decompiling module to obtain an assembly file set and a configuration file corresponding to the assembly file set; determining the current permission set through all permissions recorded in the configuration file; extracting the operation code of the target software by scanning the assembly file set, and simplifying the extracted operation code to obtain a simplified operation code set; using the N-gram method to generate the current operation code sequence set for the simplified operation code set; and The installation package of the target software is processed by a function pair extraction module to obtain a function relationship graph file; multiple function pairs are determined by the calling relationship between functions in the function calling relationship in the function relationship graph file to obtain a current function pair set; The device further includes: a seventh determining module; the seventh determining module includes: a sixth acquisition unit, configured to acquire a value of a third correlation parameter corresponding to each function pair in a preset target function pair set before determining the function call feature vector of the target software according to the current function pair set and the reference function pair set, wherein the value of the third correlation parameter corresponding to each function pair is used to represent a third correlation between each function pair and the malware type, and the third correlation is positively correlated with the value of the third correlation parameter; A third determining unit is used to determine, in descending order of the values ​​of the third correlation parameter, the function pairs corresponding to the top P values ​​of the third correlation parameter in the target function pair set as the function pairs in the reference function pair set, where P is a positive integer greater than or equal to 1, and P is less than the number of function pairs in the target function pair set; Wherein, the sixth acquisition unit is used to obtain the value of the third correlation parameter corresponding to each function pair in the preset target function pair set in the following manner: perform the following operations on each function pair sequence in the target function pair sequence set, wherein when performing the following operations, each function pair is a current function pair: when the current function pair represents a first function and a second function having a calling relationship, determine the number of occurrences of the current function pair in a preset third sample software set, and the number of occurrences of each candidate function pair in a candidate function pair set, wherein each candidate function pair represents a function and the second function having a calling relationship, and the type of software in the third sample software set is the malware type; determine the transition probability of the current function pair based on the number of occurrences of the current function pair and the number of occurrences of each candidate function pair in the candidate function pair set, wherein the value of the third correlation parameter corresponding to the current function pair is the transition probability of the current function pair.

13. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 11 through the computer program.

Images