Code detection method and device, computer device and storage medium

Abstract

The application relates to a code detection method and device, computer equipment and a storage medium. The method comprises the following steps: obtaining a target code to be detected; performing string division on the target code to obtain a target substring sequence; obtaining a substring vector corresponding to each target substring in the target substring sequence to form a vector sequence; performing linear feature extraction on the vector sequence to obtain first extracted features, and performing nonlinear feature extraction on the vector sequence to obtain second extracted features; performing fusion processing on the first extracted features and the second extracted features to obtain fusion features; and performing code detection based on the fusion features to obtain a code detection result corresponding to the target code. A cloud server can use an artificial intelligence-based malicious code detection model to implement the code detection method of the application, thereby achieving the purpose of reducing network attacks. The method can improve the accuracy of malicious code detection.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a code detection method, apparatus, computer device, and storage medium. Background Technology

[0002] With the development of computer technology, various forms of malicious code have emerged, posing a significant challenge to the field of cybersecurity and seriously harming users' production and lifestyles. Malicious code detection has become a hot topic. Malicious code refers to code that poses a danger; for example, malicious code on a webpage can exploit a webpage to damage a website.

[0003] Currently, there are many methods for detecting malicious code, such as those based on artificial intelligence or cloud technology. However, due to the wide variety and complexity of malicious code, current malicious code detection methods often fail to detect malicious code, resulting in low accuracy. Summary of the Invention

[0004] Therefore, it is necessary to provide a code detection method, apparatus, computer equipment, and storage medium that can improve the accuracy of malicious code detection in response to the above-mentioned technical problems.

[0005] A code detection method includes: acquiring target code to be detected; dividing the target code into strings to obtain a sequence of target substrings; acquiring substring vectors corresponding to each target substring in the sequence of target substrings, forming a vector sequence; performing linear feature extraction on the vector sequence to obtain a first extracted feature, and performing nonlinear feature extraction on the vector sequence to obtain a second extracted feature; fusing the first extracted feature and the second extracted feature to obtain a fused feature; and performing code detection based on the fused feature to obtain a code detection result corresponding to the target code.

[0006] A code detection device, comprising: a target code acquisition module for acquiring target code to be detected; a target substring sequence acquisition module for dividing the target code into substrings; a vector sequence composition module for acquiring substring vectors corresponding to each target substring in the target substring sequence and composing a vector sequence; a feature extraction module for performing linear feature extraction on the vector sequence to obtain a first extracted feature, and performing nonlinear feature extraction on the vector sequence to obtain a second extracted feature; a feature fusion module for fusing the first extracted feature and the second extracted feature to obtain a fused feature; and a code detection result acquisition module for performing code detection based on the fused feature to obtain a code detection result corresponding to the target code.

[0007] In some embodiments, the target substring sequence obtaining module is further configured to obtain the current substring from the target code, compare the current substring with the code substrings in the code substring set, and when the comparison is consistent, use the current substring as the target substring corresponding to the target code; the code substring is obtained by dividing the malicious code file into strings; and the target substrings corresponding to the target code are arranged into the target substring sequence according to their positions in the target code.

[0008] In some embodiments, the target substring sequence obtaining module is further configured to obtain the current substring from the target code, compare the current substring with the code substrings in the code substring set; when the comparison is consistent, obtain the backward character corresponding to the current substring from the target code, add the backward character to the current substring, and obtain the updated current substring; when the updated current substring is inconsistent with the code substrings in the code substring set, use the current substring before the update as the target substring corresponding to the target code.

[0009] In some embodiments, the feature extraction module includes: a first feature extraction unit, configured to convolve the vector sequence using a first convolution model to obtain the first extracted feature; a convolution feature extraction unit, configured to convolve the vector sequence using a second convolution model to obtain the convolution feature corresponding to the vector sequence, wherein the first convolution model and the second convolution model are jointly trained; and a second feature extraction unit, configured to perform nonlinear processing on the convolution feature to obtain the second extracted feature.

[0010] In some embodiments, the second feature extraction unit is further configured to perform exponential operations on each initial feature value of the convolutional feature to obtain the exponentially operated feature value corresponding to the initial feature value; and obtain the feature value of the second extracted feature based on the exponentially operated feature value to form the second extracted feature.

[0011] In some embodiments, the code detection result obtaining module includes: a comparison unit, used to compare the feature values ​​in the fused features with a feature threshold; a masked fused feature obtaining unit, used to mask feature values ​​in the fused features that are less than the feature threshold, to obtain masked fused features; and a code detection result obtaining unit, used to perform code detection based on the masked fused features, to obtain the code detection result corresponding to the target code.

[0012] In some embodiments, the code detection result obtaining unit is further configured to obtain a feature extraction window of a preset size; obtain key feature values ​​of each feature region corresponding to the feature extraction window in the masked fusion features, and form key features; perform code detection based on the key features to obtain the code detection result corresponding to the target code.

[0013] In some embodiments, the code detection result obtaining module includes: a fully connected feature obtaining unit, used to perform fully connected processing based on the fused features to obtain fully connected features; a code localization feature obtaining unit, used to perform scale transformation processing on the fully connected features to obtain code localization features when the code detection result of the target code is determined to contain malicious code based on the fully connected features; and a malicious substring determining unit, used to determine malicious substrings in the target code according to the feature values ​​of the code localization features.

[0014] In some embodiments, the feature value of the code location feature is used to represent the probability that each vector in the vector sequence is a vector corresponding to malicious code. The malicious substring determination unit is further used to obtain the feature value of the code location feature that is greater than a first probability threshold as a malicious feature value; obtain the vector corresponding to the malicious feature value in the vector sequence as a malicious vector; and obtain the string corresponding to the malicious vector as a malicious substring in the target code.

[0015] In some embodiments, the fusion feature obtaining module includes: a fusion feature value obtaining unit, used to perform weighted calculation on the feature values ​​in the first extracted features and the feature values ​​at corresponding positions in the second extracted features to obtain fusion feature values; and a fusion feature obtaining unit, used to combine the fusion feature values ​​according to their positions in the extracted features to obtain fusion features.

[0016] In some embodiments, the target code acquisition module is further configured to acquire code of a preset length from the target program as target code to be detected; the device further includes: a return module, configured to return the step of acquiring code of a preset length from the target program as target code to be detected when the code in the target program has not been completely detected, until the code in the target program has been completely detected; and a program detection result obtaining module, configured to obtain the program detection result corresponding to the target program based on the code detection result corresponding to each of the target codes.

[0017] In some embodiments, the code detection result obtaining module further includes: a malicious code detection probability determining unit, configured to determine the malicious code detection probability corresponding to the target code based on the fusion features; and a malicious code determining unit, configured to determine that malicious code exists in the target code when the malicious code detection probability is greater than a second probability threshold.

[0018] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the above-described code detection method.

[0019] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described code detection method.

[0020] In some embodiments, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the steps in the above-described method embodiments.

[0021] The aforementioned code detection method, apparatus, computer equipment, and storage medium acquire the target code to be detected, perform string segmentation on the target code to obtain a sequence of target substrings, obtain the substring vectors corresponding to each target substring in the sequence of target substrings, form a vector sequence, perform linear feature extraction on the vector sequence to obtain a first extracted feature, and perform nonlinear feature extraction on the vector sequence to obtain a second extracted feature, fuse the first extracted feature and the second extracted feature to obtain a fused feature, and perform code detection based on the fused feature to obtain the code detection result corresponding to the target code. By segmenting the string, the target code can be divided into multiple semantically meaningful substrings, thereby enabling the determination of the code detection result based on the semantics of the target code, improving the accuracy of the code detection result. In addition, by performing linear and nonlinear feature extraction on the vector sequence, linear and nonlinear features of the vector sequence can be obtained, so that the fused feature includes both linear and nonlinear features, which can uncover features that better reflect the characteristics of the code, thereby improving the accuracy of the code detection result obtained based on the fused feature. Attached Figure Description

[0022] Figure 1A This is a diagram illustrating the application environment of the code detection method in some embodiments;

[0023] Figure 1B These are screenshots showing the code detection results in some embodiments;

[0024] Figure 2 This is a flowchart illustrating the code detection method in some embodiments;

[0025] Figure 3 This is a flowchart illustrating the steps for obtaining the substring corresponding to the target code in some embodiments;

[0026] Figure 4 This is a flowchart illustrating the steps for obtaining the second extracted feature in some embodiments;

[0027] Figure 5 This is a flowchart illustrating the code detection method in some embodiments;

[0028] Figure 6 Here are some structural diagrams of the malicious code detection model in some embodiments;

[0029] Figure 7 This is a schematic diagram illustrating the principle of locating malicious substrings in some embodiments;

[0030] Figure 8 Here are some block diagrams of the code detection device in some embodiments;

[0031] Figure 9 These are internal structural diagrams of the computer device in some embodiments;

[0032] Figure 10 This is a diagram showing the internal structure of a computer device in some embodiments. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0034] The code detection method provided in this application can be applied to, for example... Figure 1AThe application environment shown includes a first terminal 102A, a second terminal 102B, an application publishing server 104A, an application sharing server 104B, a malicious code detection server 106, and a database 108. The devices communicate with each other via a network. For example, the first terminal 102A communicates with the application publishing server 104A via the network. The first terminal 102A can run a software publishing tool, which can display an application publishing interface. It can obtain and display applications to be published through this interface. When an application publishing instruction is received, such as a click on the "Publish" button in the application publishing interface, the application to be published can be sent to the application publishing server 104A. The application publishing server 104A can then send the received application to be published to the malicious code detection server 106. The malicious code detection server 106 can perform code detection on the application to be published and return the detection results to the application publishing server 104A. The application publishing server 104A can then feed back the detection results to the first terminal 102A. The second terminal 102B can run a software sharing tool. Similarly, the malicious code detection server 106 can perform code detection on the application to be shared through the software sharing tool. The code detection result can include at least one of the following: the location information of the malicious code, the length of the malicious code, or the content of the malicious code. The location information of the malicious code can include at least one of the start or end position of the malicious code. For example, the malicious code detection result could be... Figure 1B The message states that "malicious code exists in the program, and the location of the malicious code is bb bytes starting from byte aa, specifically '\x90\x00\x03\x00', where 'byte aa' indicates the starting position of the malicious code, 'bb bytes' indicates the length of the malicious code, and '\x90\x00\x03\x00' represents the content of the malicious code."

[0035] Specifically, server 106 can obtain the target program, which may be, for example, a... Figure 1AFor applications to be published or shared, server 106 can obtain the target code to be detected from the target program. It can perform string segmentation on the target code to obtain a sequence of target substrings, obtain the substring vectors corresponding to each target substring in the sequence, form a vector sequence, perform linear feature extraction on the vector sequence to obtain a first extracted feature, and perform nonlinear feature extraction on the vector sequence to obtain a second extracted feature. The first and second extracted features are then fused to obtain a fused feature. Code detection is performed based on the fused feature to obtain the code detection result corresponding to the target code. Software application stores or email software can also run on the first terminal 102A and the second terminal 102B. The malicious code detection server 106 can perform code detection on program files transmitted through software application stores or email software. The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, in-vehicle terminals, and portable wearable devices. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. It can also be a platform server providing services such as vehicle networking, road network collaboration, vehicle-road collaboration, intelligent transportation, autonomous driving, industrial internet services, and data communication (e.g., 4G, 5G). The terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or in-vehicle terminal, but is not limited to these. The terminal and server can be directly or indirectly connected via wired or wireless communication, which is not limited herein.

[0036] Cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software, and networks within a wide area network or local area network to achieve data computing, storage, processing, and sharing.

[0037] Cloud technology is a collective term for network technology, information technology, integration technology, management platform technology, and application technology applied to the cloud computing business model. It can form resource pools, providing flexible and convenient on-demand access. Cloud computing technology will become a crucial support. Backend services of technical network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, requiring transmission to backend systems for logical processing. Data at different levels will be processed separately, and various industry data will all require robust system support, which can only be achieved through cloud computing.

[0038] Cloud security refers to the collective term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and the identification of unknown virus behavior. Through a large network of clients, it monitors abnormal software behavior on the network, obtains the latest information on Trojans and malware on the internet, sends it to the server for automatic analysis and processing, and then distributes solutions for viruses and Trojans to each client.

[0039] The main research directions in cloud security include: 1. Cloud computing security, which focuses on how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, and compliance auditing; 2. Cloudification of security infrastructure, which focuses on how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event and information collection and processing platform through cloud computing technology to achieve the collection and correlation analysis of massive amounts of information and improve the ability to control network-wide security events and risks; 3. Cloud security services, which focuses on various security services provided to users based on cloud computing platforms, such as antivirus services. The code detection method proposed in this application can be applied to network attack protection in cloud security to improve the security level of cloud security.

[0040] It is understood that the above application scenario is only an example and does not constitute a limitation on the code detection method provided in the embodiments of this application. The method provided in the embodiments of this application can also be applied in other application scenarios. For example, the terminal 102 can perform the code detection steps to obtain the code detection result, and the terminal 102 can upload the code detection result to the server 104.

[0041] In some embodiments, such as Figure 2 As shown, a code detection method is provided, which is applied to... Figure 1A Taking server 106 as an example, the explanation includes the following steps:

[0042] S202, Obtain the target code to be detected.

[0043] In this context, "target code" refers to the code to be detected. Detecting the target code determines whether it contains malicious code. The target code can be all or part of the code file corresponding to the software. For example, the entire code file can be used as the target code, or code from a predetermined location within the code file can be used as the target code. The predetermined location can be set as needed, for example, it can be the file header. The file header refers to the content at the beginning of a file, which may include file attribute information, such as filename, creation time, modification time, or file size. There can be multiple target code files. For example, the code file corresponding to the software can be divided into multiple sub-code files, each of which can be used as a target code. When dividing the code file, it can be divided according to a predetermined data size, resulting in multiple sub-code files of the predetermined data size, which can be used as individual target codes. The predetermined data size can be set as needed, for example, it can be 2MB. The server can perform code detection on the target code serially or in parallel to determine the code detection result corresponding to the target code.

[0044] The code file corresponding to software can be any of the following: source code, binary code, or executable code. Source code refers to code written in assembly language or a high-level language. Binary code refers to code obtained by processing source code and that can be directly recognized by the CPU (Central Processing Unit). Executable code is a binary file, also known as an executable file. An executable file is a file that can be loaded and executed by the operating system. The presentation of executable files varies depending on the operating system environment; for example, in Windows, executable files can be of type .exe, .sys, or .com.

[0045] Specifically, the server can determine the code file to be detected and obtain the target code based on it. The server can convert the code file to a target file format to obtain a code file in the target format, and then use this target file as the target code, or it can divide the target file to obtain the target code. The file format refers to the format of the data in the file, which can be any of binary, hexadecimal, or decimal. The target file format can be pre-defined or set as needed; for example, it could be decimal. For instance, if the code file to be detected is in binary format and the target file is in decimal format, the server can convert the code file from binary to decimal, or from binary to hexadecimal, to obtain a hexadecimal code file, and then convert the hexadecimal code file back to decimal, obtaining a decimal code file. This decimal code file can then be used as the target code, or the decimal code file can be divided to obtain the target code. For example, a hexadecimal code file could be "\x90\x00\x03\x00", and the corresponding decimal code file would be "145,1,4,1". Here, x90 corresponds to the decimal number 144, and 145 is x90 in decimal plus 1.

[0046] In some embodiments, the server may store at least one of a file source blacklist or a file source whitelist. The server can compare the file source corresponding to the obtained code file with the file sources in the file source blacklist. If it is determined that the file source of the code file belongs to the file source blacklist, the code file is used as the code file to be detected. Alternatively, the server can compare the file source corresponding to the obtained code file with the file sources in the file source whitelist. If it is determined that the file source of the code file does not belong to the file source whitelist, the code file is used as the code file to be detected.

[0047] In some embodiments, the target code to be detected may be obtained by server 104 from the terminal, obtained by server 104 from its local machine, or obtained by server 104 from another server, such as a database server independent of server 104. For example, the terminal may send a code detection request to the server, which may carry either a code file or a file identifier, where the file identifier refers to the identifier corresponding to the code file. The server can extract the code file from the code detection request and obtain the target code based on the code file. Alternatively, the server can extract the file identifier from the code detection request, obtain the code file corresponding to the file identifier, and obtain the target code to be detected based on the code file.

[0048] S204, perform string partitioning on the target code to obtain the target substring sequence.

[0049] The string can include one or more characters, where a character refers to the smallest unit of data in the target code. For example, when the data in the target code is in decimal format, the smallest unit of data in the target code refers to a single decimal digit; that is, one character in the target code refers to one decimal digit. The separation between characters in the target code can be done using a preset delimiter, which can be any delimiter, such as a comma. For example, the target code could be "78,9,3,145,1,4,1,1,1,5,1", where the characters are separated by commas, and 78 is one character.

[0050] A substring sequence contains multiple substrings. A target substring sequence can include multiple target substrings. Target substrings are obtained by partitioning the target code into substrings. The target substrings in the target substring sequence are sorted according to their order in the target code. For example, if "78,91,3,145,1,4,1,1,1,5" is partitioned into 3 target substrings, namely "78,91,3", "145,1,4,1", and "1,1,5", then the first target substring in the target substring sequence is "78,91,3", and the last target substring is "1,1,5".

[0051] Specifically, the server can segment the target code based on a set of code substrings to obtain a sequence of target substrings. The set of code substrings includes multiple code substrings. These substrings can be obtained by segmenting code files within a set of code files. The set of code files can include at least one type of malicious or benign code files; that is, the set of code substrings can be obtained by segmenting malicious code files. The ratio between the number of malicious and benign code files in the code file set can be arbitrary or preset. The preset ratio can be set as needed, for example, 1:1. Malicious code files refer to code files that cause harm, such as virus files. Benign code files refer to code files with normal functionality. The server can segment each code file in the code file set to obtain a set of code substrings corresponding to the code file set.

[0052] In some embodiments, the server can establish sets of code substrings corresponding to different malicious types, and can also generate malicious code detection models used to detect code of different malicious types. Using the same set of code substrings corresponding to the same malicious type and the malicious code detection model, the target code is divided into strings and detected.

[0053] In some embodiments, the server can select a string from the target code to obtain a selected string. This selected string is then compared with code substrings in a code substring set. If a code substring matching the selected string exists, the selected string is determined to belong to the code substring set and is used as the target substring corresponding to the target code. When selecting a string from the target code, the initial string can be selected according to the character order in the target code. A first initial string of length one character is selected. If the first initial string does not belong to the code substring set, the last character is removed to obtain a first updated string. If the first updated string belongs to the code substring set, it is used as the first substring corresponding to the target code. Then, starting from the characters following the first substring in the target code, a string of length one character is selected to obtain the next round of first initial strings. Following the same method as obtaining the first substring, the second substring corresponding to the target code is determined from the next round of first initial strings. This process yields various target substrings corresponding to the target code, forming a target substring sequence. The length of the first character can be set as needed, for example, it can be 10.

[0054] In some embodiments, the server can select a string of a second character length from the target code to obtain a second initial string. When it is determined that the second initial string belongs to the code substring set, the server obtains the next character of the second initial string from the target code and adds it to the second initial string to obtain a second updated string. When it is determined that the second updated string does not belong to the code substring set, the string before the update is used as the target substring corresponding to the target code. The second character length is less than the first character length. The second character length can be set as needed, for example, it can be 2.

[0055] In some embodiments, the server can count the number of identical code substrings in the code substring set, obtain the number of substrings corresponding to each code substring in the code substring set, and calculate the ratio of the number of substrings to the total number of substrings in the code substring set to obtain the frequency of each substring. The frequency of substring occurrence is positively correlated with the number of substrings. The malicious code files in the code file set can be of the same malicious type or different malicious types. Malicious types can be classified according to the propagation method of the malicious code files, such as computer viruses, Trojan horses, computer worms, mobile code, or complex viruses.

[0056] A positive correlation refers to a relationship where, all other things being equal, two variables change in the same direction; when one variable decreases, the other also decreases. It's important to understand that a positive correlation means the direction of change is consistent, but it doesn't require that a slight change in one variable necessarily means a change in the other. For example, we can set variable b to 100 when variable a is between 10 and 20, and to 120 when variable a is between 20 and 30. In this case, the direction of change for both a and b is that as a increases, b also increases. However, when a is between 10 and 20, b may remain unchanged.

[0057] In some embodiments, the server can employ multiple code partitioning methods to divide the target code, obtaining candidate string sequences corresponding to the target code. The candidate string sequences obtained by different code partitioning methods can be the same or different. The server can calculate the probability corresponding to different candidate string sequences based on the frequency of occurrence of each code substring in the code substring set, and select the candidate string sequence with the highest probability as the target substring sequence corresponding to the target code. Each string in the candidate string sequence can correspond to a string probability, which is obtained through statistical calculation, for example, by statistically calculating the occurrence of strings in multiple code files. The probability corresponding to the candidate string sequence can be calculated based on the probability corresponding to each string in the candidate string sequence, for example, by multiplying the probabilities corresponding to each string in the candidate string sequence.

[0058] In some embodiments, the server can calculate the logarithmic probability of each string in the candidate string sequence, and then obtain the probability of the candidate string sequence based on these logarithmic probabilities. For example, the logarithmic probabilities can be added together to obtain the probability of the candidate string sequence. Of course, the probability of the candidate string sequence can also be calculated using joint probability; there are no further restrictions here.

[0059] S206, obtain the substring vectors corresponding to each target substring in the target substring sequence, and form a vector sequence.

[0060] Here, a substring vector refers to the vector representation of a target substring. This substring vector represents the semantics of the target substring; for example, a string can be considered a word, and the substring vector is considered a word vector. In this embodiment, by dividing the code into substrings with semantic meaning, substring vectors representing its semantics can be obtained, thus enabling code detection based on semantics. Different target substrings correspond to different substring vectors. The server can pre-store the vector representations corresponding to each code substring in the code substring set.

[0061] A vector sequence is a sequence of substring vectors. The substring vectors in a vector sequence can be arranged according to the order in which the target substring appears in the sequence. A vector sequence can be represented as a matrix; when represented as a matrix, it becomes a vector matrix. The size of a vector matrix can be set as needed. Each row in a vector matrix represents a substring vector, the number of columns represents the dimension of a substring vector, and the number of rows represents the number of substring vectors. For example, if the size of a vector matrix is ​​m*n, then m represents the number of substring vectors, and n represents the dimension of a substring vector, i.e., the number of elements included in the substring vector.

[0062] Specifically, the server can sort the substring vectors corresponding to the target substring according to their order in the target substring sequence to obtain a vector sequence.

[0063] In some embodiments, the server can process the target code using a trained vector generation model to obtain vectors for each substring corresponding to the target code. The trained vector generation model can be trained using code files from a code file collection. Specifically, the server can input the target code into the trained vector generation model, which can determine the target substrings included in the target code, obtain the vector representation of each target substring, and obtain the substring vectors corresponding to each target substring. The vector generation model can be a language model, such as a word vector model, which could be an n-gram model. The trained vector generation model can be the vector generation module within a malicious code detection model.

[0064] S208, perform linear feature extraction on the vector sequence to obtain the first extracted feature, and perform nonlinear feature extraction on the vector sequence to obtain the second extracted feature.

[0065] The first extracted feature is obtained by performing linear feature extraction on the vector sequence. The second extracted feature can also be obtained by performing nonlinear feature extraction on the vector sequence. Linear feature extraction can be obtained by performing linear operations on the vector sequence, such as convolution. Nonlinear feature extraction can be obtained by performing nonlinear operations on the vector sequence, such as exponential operations. The first extracted feature can include multiple feature values. The second extracted feature can also include multiple feature values. The number of feature values ​​included in the first extracted feature and the number of feature values ​​included in the second extracted feature can be the same or different.

[0066] Specifically, the server can sequentially perform linear feature extraction and nonlinear feature extraction on the vector sequence to obtain the second extracted features. The linear feature extraction method used to obtain the second extracted features can be the same as or different from the linear feature extraction method used to obtain the first extracted features.

[0067] In some embodiments, the server can input a vector sequence into a malware detection model, and extract features from the vector sequence using a feature extraction layer in the malware detection model to obtain a first extracted feature and a second extracted feature. There can be one or more feature extraction layers. Each feature extraction layer can include a linear feature extraction module and a non-linear feature extraction module. The server can perform linear feature extraction on the vector sequence using the linear feature extraction module in the feature extraction layer to obtain the first extracted feature, and perform non-linear feature extraction on the vector sequence using the non-linear feature extraction module in the feature extraction layer to obtain the second extracted feature. The linear and non-linear feature extraction modules can be trained through joint training. The linear and non-linear feature extraction modules can be located in the same layer of the malware detection model.

[0068] In some embodiments, the nonlinear feature extraction module may include a linear feature extraction unit and a nonlinear feature extraction unit. The nonlinear feature extraction unit can be implemented using an activation function. The server can perform linear feature extraction on the vector sequence using the linear feature extraction unit to obtain intermediate extracted features, and then perform nonlinear feature extraction on the vector sequence using the nonlinear feature extraction unit to obtain second extracted features.

[0069] S210, the first extracted feature and the second extracted feature are fused to obtain the fused feature.

[0070] Here, the fused feature refers to the feature obtained by fusing the first extracted feature and the second extracted feature. The fusion process can include at least one of linear or nonlinear operations. Linear operations include at least one of addition or multiplication. Nonlinear operations can include at least one of logarithmic operations, square root operations, exponential operations, or trigonometric function operations.

[0071] Specifically, the server can perform linear operations on the first extracted feature and the second extracted feature to obtain the fused feature. For example, linear operations can be performed on the feature values ​​in the first extracted feature and the feature values ​​at corresponding positions in the second extracted feature, such as addition or multiplication. The result of the linear operation is used as the feature value in the fused feature to obtain the fused feature.

[0072] S212, code detection is performed based on fusion features to obtain the code detection results corresponding to the target code.

[0073] Code detection is used to determine whether the target code is malicious or benign. The code detection result can be either malicious or benign. When the code detection result indicates malicious code, it may also include at least one of the following: the location of the malicious code, the content of the malicious code, the length of the malicious code, the type of malicious code, or the intent of the malicious code. For web pages, the intent of malicious code may include modifying the homepage, locking the homepage, changing the default search engine, or adding illegal website advertising links to the right-click menu. For operating systems, the intent of malicious code may include automatically opening locked websites after booting up, formatting the hard drive, illegally reading or stealing user files, or locking or disabling the registry.

[0074] Specifically, the server can determine the probability that the target code is malicious code based on the fusion features, determine to perform code detection based on the probability that the target code is malicious code, and determine the code detection result corresponding to the target code. For example, when the probability that the target code is malicious code is greater than a first preset probability, the target code is determined to be malicious code; otherwise, the target code is determined to be benign code.

[0075] In some embodiments, the server can perform nonlinear processing on the fused features to obtain nonlinearly processed fused features, and obtain the code detection result corresponding to the target code based on the nonlinearly processed fused features. The server can select each feature value that meets the feature value selection criteria from the nonlinearly processed fused features to obtain a feature value combination, and perform code detection based on the feature value combination to determine the code detection result corresponding to the target code. The server can divide the nonlinearly processed fused features to obtain multiple sub-fused features, and select each feature value that meets the feature value selection criteria from each sub-fused feature to obtain a feature value combination. The number of feature values ​​included in each sub-fused feature can be the same or different. The feature value selection criteria can be either the maximum feature value or the average feature value. The server can select the largest feature value from each sub-fused feature to obtain the maximum feature value corresponding to each sub-fused feature and form a feature value combination, or calculate the average value of each feature value in each sub-fused feature to obtain the average feature value corresponding to each sub-fused feature and form a feature value combination.

[0076] In some embodiments, the server can perform a weighted summation of the feature values ​​in the feature value combination to obtain a weighted result, and perform code detection based on the weighted result to determine the code detection result corresponding to the target code.

[0077] In some embodiments, the server can obtain the code detection results corresponding to each code source, perform statistics on the malicious code in the code detection results, obtain the malicious code statistical value corresponding to the code source, and determine the danger level corresponding to the code source based on the malicious code statistical value.

[0078] In the code detection method described above, the target code to be detected is obtained, and the target code is segmented into strings to obtain a sequence of target substrings. The substring vectors corresponding to each target substring in the sequence are then obtained to form a vector sequence. Linear feature extraction is performed on the vector sequence to obtain the first extracted feature, and non-linear feature extraction is performed on the vector sequence to obtain the second extracted feature. The first and second extracted features are then fused to obtain a fused feature. Code detection is performed based on the fused feature to obtain the code detection result corresponding to the target code. Through string segmentation, the target code can be divided into multiple semantically meaningful substrings, thus enabling the determination of the code detection result based on the semantics of the target code, improving the accuracy of the code detection result. Furthermore, by performing linear and non-linear feature extraction on the vector sequence, linear and non-linear features of the vector sequence can be obtained, ensuring that the fused feature includes both linear and non-linear features. This allows for the extraction of features that better reflect the characteristics of the code, thereby improving the accuracy of the code detection result obtained based on the fused feature.

[0079] The code detection method proposed in this application can be applied to network security. It can be used to detect suspicious software on the network, thereby obtaining a high-quality malicious code defense system. It can also be used to deploy the same system on different operating systems and hardware to detect malware.

[0080] Feature-based methods can be used for antivirus and malware detection. For example, rules can be manually set to determine whether software belongs to a known set of malware types. However, these rules are usually targeted, and because the corresponding binary files of software are unique, even if new malware uses the same functionality as the original malware, malware detection methods may fail to detect it. The code detection method provided in this application extracts features from a vector sequence composed of vectors of substrings corresponding to substrings in the code. It then obtains fused features based on these extracted features and determines the code detection result based on the fused features. This method can adapt to the ever-changing malware ecosystem and can detect binary files based on features extracted from them, thus improving the accuracy of malware detection.

[0081] In some embodiments, splitting the target code into strings to obtain a target substring sequence includes: obtaining the current substring from the target code; comparing the current substring with the code substrings in the code substring set; when the comparison is consistent, using the current substring as the target substring corresponding to the target code; the code substring is obtained by splitting the malicious code file into strings; and assembling the target substrings corresponding to the target code into a target substring sequence according to their positions in the target code.

[0082] The current substring is the string selected from the target code according to string selection rules. These rules can be either forward or reverse selection. Forward selection starts from the first character of the target code, while reverse selection starts from the last character. The length of the current substring can be set as needed or pre-set, for example, 10 characters. "Comparison consistency" means that the set of code substrings includes substrings identical to the current substring.

[0083] Specifically, the server can compare the current substring with the code substrings in the code substring set. If the comparison is consistent, and the string selection rule is a forward selection method, the server can start selecting from the characters following the current substring to obtain the next round of the current substring. The server returns the step of comparing the current substring with the code substrings in the code substring set, thereby obtaining each target substring corresponding to the target code. The server can arrange each target substring of the target code according to its order in the target code to obtain the target substring sequence.

[0084] In some embodiments, the server can compare the current substring with the code substrings in the code substring set. If the comparison is inconsistent, and the string selection rule is a forward selection method, the server can sequentially delete the last character of the current substring to obtain the tail-deleted string until the tail-deleted string matches the code substrings in the code substring set. The matching tail-deleted string is taken as the target substring corresponding to the target code. Starting from the characters following the tail-deleted string in the target code, the server selects the current substring for the next round and returns to the step of comparing the current substring with the code substrings in the code substring set.

[0085] In this embodiment, the current substring is obtained from the target code, and then compared with the code substrings in the code substring set. When they match, the current substring is taken as the target substring corresponding to the target code. The target substrings corresponding to the target code are then arranged into a target substring sequence according to their positions in the target code. Since the code substring set is obtained by dividing the malicious code file into strings, the obtained substrings corresponding to the target code conform to the string division rules in the malicious code, making the substring sequence more reflective of the maliciousness of the code and improving the semantic expression of the substrings.

[0086] In some embodiments, such as Figure 3 As shown, the process of obtaining the current substring from the target code and comparing it with the code substrings in the code substring set, and using the current substring as the target substring corresponding to the target code when they match, includes: S302, obtaining the current substring from the target code and comparing it with the code substrings in the code substring set; S304, when they match, obtaining the backward character corresponding to the current substring from the target code and adding the backward character to the current substring to obtain the updated current substring; S306, when the updated current substring does not match the code substrings in the code substring set, using the current substring before the update as the target substring corresponding to the target code.

[0087] Adding the backward character to the current substring means adding the backward character to the end of the current substring.

[0088] Specifically, the server can obtain one or more backward characters corresponding to the current substring from the target code, add one or more backward characters to the current substring, and obtain the updated current substring. "Multiple" means at least two.

[0089] In some embodiments, the server can compare the updated current substring with the code substrings in the code substring set. When it is determined that each code substring in the code substring set is inconsistent with the updated current substring, the current substring before the update is used as the target substring corresponding to the target code. For example, if the current substring is "78,91,3" and the updated current substring is "78,91,3,145", if "78,91,3" belongs to the code substring set and "78,91,3,145" does not belong to the code substring set, then "78,91,3" can be used as the target substring corresponding to the target code.

[0090] In this embodiment, the current substring is obtained from the target code, and then compared with the code substrings in the code substring set. When they match, the backward character corresponding to the current substring is obtained from the target code and added to the current substring to obtain the updated current substring. When the updated current substring does not match the code substrings in the code substring set, the current substring before the update is used as the target substring corresponding to the target code, thereby quickly obtaining each target substring corresponding to the target code.

[0091] In some embodiments, such as Figure 4 As shown, linear feature extraction is performed on the vector sequence to obtain the first extracted feature, and nonlinear feature extraction is performed on the vector sequence to obtain the second extracted feature. This includes: S402, convolving the vector sequence using the first convolution model to obtain the first extracted feature; S404, convolving the vector sequence using the second convolution model to obtain the convolutional feature corresponding to the vector sequence; and S406, nonlinear processing is applied to the convolutional feature to obtain the second extracted feature. The first and second convolution models are jointly trained.

[0092] In this model, the first convolutional model can be a linear feature extraction module in the malware detection model. The second convolutional model can be a non-linear feature extraction module in the malware detection model. The dimensions of the first and second convolutional models can be the same or different. The model parameters of the first and second convolutional models can be the same or different. The first and second convolutional models can be trained during the training of the malware detection model.

[0093] Specifically, convolutional features are features obtained by performing convolution processing on a vector sequence using a second convolution module. Nonlinear processing of convolutional features refers to performing nonlinear operations on the feature values ​​within the convolutional features. For example, the server can use the hyperbolic tangent function (tanh function) to operate on the feature values ​​in the convolutional features, obtaining the second extracted features corresponding to each feature value.

[0094] In this embodiment, a first convolution model is used to convolve the vector sequence to obtain a first extracted feature. A second convolution model is used to convolve the vector sequence to obtain the convolution features corresponding to the vector sequence. The convolution features are then subjected to nonlinear processing to obtain a second extracted feature. Thus, both the linear and nonlinear features of the vector sequence are obtained, improving the richness of the features corresponding to the vector sequence.

[0095] In some embodiments, performing nonlinear processing on the convolutional features to obtain the second extracted features includes: performing exponential operations on each initial feature value of the convolutional features to obtain the exponentially operated feature values ​​corresponding to the initial feature values; obtaining the feature values ​​of the second extracted features based on the exponentially operated feature values, and forming the second extracted features.

[0096] Specifically, the initial feature values ​​refer to the feature values ​​in the convolutional features. The exponential operation feature values ​​are the results obtained by performing exponential operations on the initial feature values. The server can perform exponential operations on the initial feature values, for example, by performing exponential operations on the opposite numbers corresponding to the initial feature values ​​to obtain the exponential operation feature values ​​corresponding to each initial feature value. The exponential operation feature values ​​are then added to a first preset value to obtain the summation result. The second extracted feature is obtained based on the summation result; for example, the reciprocal of the summation result can be used as the second extracted feature.

[0097] In this embodiment, exponential operations are performed on each initial feature value of the convolutional feature to obtain the exponentially operated feature value corresponding to the initial feature value. The feature value of the second extracted feature is obtained based on the exponentially operated feature value, and the second extracted feature is formed. Thus, nonlinear features are quickly obtained through exponential operations.

[0098] In some embodiments, code detection based on fused features to obtain the code detection result corresponding to the target code includes: comparing the feature values ​​in the fused features with a feature threshold; masking feature values ​​in the fused features that are less than the feature threshold to obtain masked fused features; and performing code detection based on the masked fused features to obtain the code detection result corresponding to the target code.

[0099] Specifically, the feature threshold can be preset or set as needed, for example, it can be 0. Masking feature values ​​in the fused features that are less than the feature threshold can be achieved by updating these feature values ​​to a second preset threshold. The second preset threshold can be set as needed, for example, it can be 0.

[0100] In some embodiments, the server can compare the feature value in the fused feature with the feature threshold. When the feature value in the fused feature is less than the feature threshold, the feature value in the fused feature is updated to a second preset value. When the feature value in the fused feature is greater than the feature threshold, the feature value in the fused feature remains unchanged, thus obtaining the masked fused feature.

[0101] In some embodiments, the server can determine the probability that the target code is malicious code based on the fused features after masking, and determine the code detection result corresponding to the target code based on the probability that the target code is malicious code.

[0102] In some embodiments, the malware detection model may further include a shielding module, which can be implemented using an activation function. The activation function corresponding to the shielding module is different from the activation function corresponding to the nonlinear feature extraction unit. The server can linearly process the vector sequence using the linear feature extraction unit in the nonlinear feature extraction module to obtain convolutional features. Then, it can nonlinearly process the convolutional features using the nonlinear feature extraction unit in the nonlinear feature extraction module to obtain second extracted features. Finally, it can fuse the second extracted features with the first extracted features using the feature fusion module in the malware detection model to obtain fused features. The shielding module in the malware detection model then processes the fused features. The nonlinear feature extraction unit has a better ability to filter redundant information than the shielding module, while the shielding module has a more divergent search space. The nonlinear feature extraction unit can filter information allowed by the shielding module, enabling the model's feature representation to gain additional capacity in an effective way. This additional capacity refers to the additional feature variables resulting from the divergence of the shielding module.

[0103] In this embodiment, exponential operations are performed on each initial feature value of the convolutional features to obtain the exponentially operated feature values ​​corresponding to the initial feature values. Based on the exponentially operated feature values, the feature values ​​of the second extracted features are obtained, forming the second extracted features. Feature fusion is performed based on the first and second extracted features to obtain fused features. The feature values ​​in the fused features are compared with a feature threshold, and feature values ​​smaller than the threshold are masked, resulting in masked fused features. Code detection is performed based on the masked fused features to obtain the code detection results corresponding to the target code. By sequentially performing exponential operations and masking, since exponential operations have a better ability to filter redundant information than masking, information filtering using exponential operations before masking can filter out information allowed by masking. Since masking has a more divergent search space than exponential operations, performing masking after exponential operations can search for more effective features. Furthermore, masking reduces the amount of data, thereby improving the efficiency of code detection.

[0104] In some embodiments, code detection based on the masked fused features to obtain the code detection result corresponding to the target code includes: obtaining a feature extraction window of a preset size; obtaining the key feature values ​​of each feature region corresponding to the feature extraction window in the masked fused features to form key features; and performing code detection based on the key features to obtain the code detection result corresponding to the target code.

[0105] The preset size can be set as needed, for example, it can be 500. The feature extraction window is used for feature extraction. The feature region corresponding to the feature extraction window refers to the area covered by the feature extraction window in the masked fused features. Key features include multiple key feature values. The feature extraction window can slide within the fused features, and when sliding, it can slide according to a preset step size, which can be set as needed, for example, it can be 500. The preset size can be the same as the preset step size, or it can be different from the preset step size.

[0106] Specifically, the server can control the feature extraction window to slide across the masked fused features, acquiring various feature values ​​in the feature region corresponding to the feature extraction window to obtain the window features. Based on these feature values, the server can then derive the key feature value. For example, the server can select the largest feature value from the window features as the key feature value, or it can use the average value of all the window features as the key feature value.

[0107] In some embodiments, the server can determine the probability that malicious code exists in the target code based on key features, and determine the code detection result corresponding to the target code based on the probability that malicious code exists in the target code. Alternatively, the server can perform weighted calculations on the feature values ​​in the key features to determine the probability that malicious code exists in the target code.

[0108] In this embodiment, since the key features are calculated based on the key feature values ​​of each feature region corresponding to the feature extraction window, the key features can reflect the characteristics of each feature region, that is, the key features can reflect the characteristics of the code. Therefore, code detection based on key features can improve the accuracy of code detection.

[0109] In some embodiments, code detection based on fusion features to obtain the code detection result corresponding to the target code includes: performing fully connected processing based on the fusion features to obtain fully connected features; when the code detection result of the target code is determined to contain malicious code based on the fully connected features, performing scaling transformation processing on the fully connected features to obtain code location features; and determining the malicious substring in the target code based on the feature value of the code location features.

[0110] The fully connected features are obtained by performing fully connected processing on the feature values ​​in the fused features. The fused features can be the input to a fully connected layer (FC) in a malware detection model, and the fully connected processing can be the process of processing the fused features through the fully connected layer in the malware detection model.

[0111] Scale transformation is used to scale the data dimension of fully connected features so that the data dimension of the fully connected features is consistent with the data dimension of the vector sequence. Code location features are features obtained after scaling the fully connected features. The data dimension of the code location features is consistent with the data dimension of the vector sequence. The data dimension of the vector sequence refers to the number of vectors included in the vector sequence.

[0112] Specifically, the server can determine the code detection result corresponding to the target code based on code location features. For example, the server can determine the probability that malicious code exists in the target code based on code location features, and determine the code detection result of the target code based on the probability that malicious code exists in the target code.

[0113] In some embodiments, the server can obtain key features based on fusion features, and perform full-connection processing based on the key features to obtain full-connection features.

[0114] In this embodiment, fully connected processing is performed based on fused features to obtain fully connected features. When the code detection result of the target code is determined to contain malicious code based on the fully connected features, the fully connected features are scaled to obtain code location features. Malicious substrings in the target code are determined based on the feature values ​​of the code location features, thereby realizing the location of malicious substrings in the target code and improving the visualization of malicious substrings.

[0115] In some embodiments, the feature values ​​of the code location features are used to represent the probability that each vector in the vector sequence is a vector corresponding to malicious code. Determining the malicious substring in the target code based on the feature values ​​of the code location features includes: obtaining feature values ​​in the code location features that are greater than a first probability threshold as malicious feature values; obtaining the vectors corresponding to the malicious feature values ​​in the vector sequence as malicious vectors; and obtaining the strings corresponding to the malicious vectors as malicious substrings in the target code.

[0116] The first probability threshold can be set as needed, for example, it can be 0.9. A malicious feature value is a feature value in the code location features that is greater than the first probability threshold. A malicious vector refers to the vector corresponding to a malicious feature value in a vector sequence. The vector corresponding to a malicious feature value in a vector sequence refers to the vector in the vector sequence whose order matches the order of the malicious feature value in the code location features. For example, if the malicious feature value 'a' has an order of 10 in the code location features, and vector A also has an order of 10 in the vector sequence, then vector A is the malicious vector corresponding to malicious feature value 'a'. A malicious substring refers to the string corresponding to a malicious vector in the target code.

[0117] Specifically, the server can determine the string corresponding to the malicious vector from the target code, thus obtaining the malicious substring in the target code. The target code can contain one or more malicious substrings. "Multiple" refers to at least two.

[0118] In some embodiments, the server can obtain multiple target codes from the target program, perform code detection on each target code, and obtain the code detection result corresponding to each target code. The server can obtain the malicious substrings corresponding to each target code whose code detection result indicates the presence of malicious code, thereby obtaining the malicious substrings corresponding to the target program. The target program can be any program file, or it can be a program obtained from a specific source, where the probability of a program file obtained from a specific source being detected as malicious is greater than a second preset probability.

[0119] In this embodiment, feature values ​​greater than a first probability threshold in the code location features are obtained as malicious feature values. The vectors corresponding to the malicious feature values ​​in the vector sequence are obtained as malicious vectors. The strings corresponding to the malicious vectors are obtained as malicious substrings in the target code, thereby improving the accuracy of locating malicious substrings in the target code.

[0120] In some embodiments, fusing the first extracted features and the second extracted features to obtain fused features includes: weighting the feature values ​​in the first extracted features with the feature values ​​at corresponding positions in the second extracted features to obtain fused feature values; and combining each fused feature value according to its position in the extracted features to obtain fused features.

[0121] The server can obtain first feature values ​​and second feature values ​​in the same order from the first extracted feature and the second extracted feature, and perform a weighted calculation on the first feature values ​​and the second feature values ​​to obtain a fused feature value. The first feature value is a feature value in the first extracted feature, and the second feature value is a feature value in the second extracted feature. The order of the first feature values ​​in the first extracted feature is consistent with the order of the second feature values ​​in the second extracted feature.

[0122] Specifically, the server can combine the various fusion feature values ​​according to the position of the corresponding first feature value in the first extracted feature to obtain the fusion feature, or combine them according to the position of the corresponding second feature value in the second extracted feature.

[0123] In this embodiment, the feature values ​​in the first extracted feature are weighted and calculated with the feature values ​​at the corresponding positions in the second extracted feature to obtain the fused feature value. The fused feature values ​​are then combined according to their positions in the extracted features to obtain the fused feature. This results in the fused feature including both linear and nonlinear features, thus improving the feature richness of the fused feature.

[0124] In some embodiments, obtaining the target code to be detected includes: obtaining code of a preset length from the target program as the target code to be detected; the method further includes: when the code in the target program has not been completely detected, returning to the step of obtaining code of a preset length from the target program as the target code to be detected, until the code in the target program has been completely detected; and obtaining the program detection result corresponding to the target program based on the code detection result corresponding to each target code.

[0125] The preset length can be set as needed, for example, it can be 100 bytes or 50 characters. The preset length can be determined based on the preset data volume. The preset data volume can be set as needed, for example, it can be 2MB. The data volume corresponding to the preset length of code in the target program is the preset data volume. The program detection result can include either malicious or benign programs. When it is a malicious program, the program detection result can also include at least one of the following: malicious type, harm level, or malicious intent.

[0126] Specifically, the server can count the number of code detection results that indicate the presence of malicious code in the target code, obtain the number of malicious results, and determine the program detection result corresponding to the target program based on the number of malicious results.

[0127] In some embodiments, when there is a code detection result indicating that there is malicious code in the target code among the code detection results corresponding to each target code, the server determines that the target program is a malicious program.

[0128] In some embodiments, the server can calculate the ratio of malicious results to the total number of results to obtain the percentage of malicious results. When the percentage of malicious results is greater than a preset percentage threshold, the target program is determined to be malicious. The total number of results refers to the total number of code detection results. The preset percentage can be set as needed, for example, it can be 30%.

[0129] In some embodiments, the server can determine the severity level of a target program based on the proportion of malicious results. The severity level may be positively correlated with the proportion of malicious results.

[0130] In this embodiment, code of a preset length is obtained from the target program as the target code to be detected. When the code in the target program has not been completely detected, the step of obtaining code of a preset length from the target program as the target code to be detected is returned until the code in the target program has been completely detected. Based on the code detection results corresponding to each target code, the program detection result corresponding to the target program is obtained. Thus, when the data volume of the target program is large, the detection of the entire program can be achieved by detecting each program block in the target program.

[0131] In some embodiments, code detection based on fusion features to obtain the code detection result corresponding to the target code includes: determining the probability of malicious code detection corresponding to the target code based on the fusion features; and determining that malicious code exists in the target code when the probability of malicious code detection is greater than a second probability threshold.

[0132] Specifically, the second probability threshold can be preset or set as needed, for example, it can be 0.9. The server can compare the feature values ​​in the fused features with the feature threshold, and filter out feature values ​​in the fused features that are less than the feature threshold to obtain the filtered fused features. Based on the filtered fused features, the probability of detecting malicious code corresponding to the target code is determined. When the probability of detecting malicious code is greater than the second probability threshold, it is determined that there is malicious code in the target code; when the probability of detecting malicious code is less than the second probability threshold, it is determined that the target code is benign code.

[0133] In some embodiments, the server can obtain a feature extraction window of a preset size, obtain the key feature values ​​of each feature region corresponding to the feature extraction window in the masked fused features, form key features, and perform code detection based on the key features to determine the probability of malicious code detection corresponding to the target code.

[0134] In some embodiments, the server can perform full-connection processing based on key feature values ​​to obtain full-connection features, and then perform code detection based on the full-connection features to determine the probability of malicious code detection corresponding to the target code.

[0135] In this embodiment, the probability of malicious code detection corresponding to the target code is determined based on the fusion features. When the probability of malicious code detection is greater than the second probability threshold, it is determined that there is malicious code in the target code, thereby improving the accuracy of target code detection.

[0136] In some embodiments, such as Figure 5 As shown, a code detection method is provided, including the following steps:

[0137] 502. Obtain code of a preset length from the target program as the target code to be detected.

[0138] Specifically, the server can convert the executable file of the target program into a byte stream. When the size of the byte stream exceeds the preset size, such as 2M, the byte stream is divided into 1-2M byte streams. Each segmented byte stream is converted into hexadecimal, and each hexadecimal is a word. The byte stream is segmented in this way. After segmentation, the hexadecimal content is converted into decimal, and the decimal content is used as the target code to be detected.

[0139] 504, the target code is split into strings to obtain a sequence of target substrings, and the substring vectors corresponding to each target substring in the sequence are obtained and combined into a vector sequence;

[0140] Specifically, the current substring is retrieved from the target code. This current substring is compared with the code substrings in the code substring set. If they match, the corresponding backward character is retrieved from the target code and added to the current substring to obtain the updated current substring. If the updated current substring does not match the code substrings in the code substring set, the original current substring is used as the target substring corresponding to the target code. The substring vectors corresponding to each target substring in the target substring sequence are obtained and combined into a vector sequence. Specifically, the target substrings corresponding to the target code are arranged according to their positions within the target code to form the target substring sequence.

[0141] For example, the target program or target code can be entered into Figure 6 In the malicious code detection model 600 shown, the malicious code detection model includes a trained vector generation model 602. The server can use the trained vector generation model in the malicious code detection model to perform vector processing on the target program or target code, obtaining vector sequences corresponding to each target code. The vector generation model can be implemented using a word embedding model, which can be, for example, an 8-dimensional word embedding model.

[0142] 506. The first convolution model is used to convolve the vector sequence to obtain the first extracted feature. The second convolution model is used to convolve the vector sequence to obtain the convolution feature corresponding to the vector sequence. The first convolution model and the second convolution model are jointly trained.

[0143] Specifically, Figure 6 The malicious code detection model can also include a linear feature extraction module 604 and a nonlinear feature extraction module 606. The nonlinear feature extraction module 606 can include a linear feature extraction unit 606A and a nonlinear feature extraction unit 606B. The first convolutional model can be the linear feature extraction module 604, and the second convolutional model can be the linear feature extraction unit 606A. The server can input a vector sequence into the linear feature extraction unit 606A to obtain convolutional features. The linear feature extraction module 604 and the linear feature extraction unit 606A can be implemented using a convolutional neural network, such as a one-dimensional convolutional neural network (1D conv). A one-dimensional convolutional neural network can include multiple filters. When using a one-dimensional convolutional neural network for convolution, the length of the convolution window and the stride of the convolution can be preset or set as needed. For example, the length of the convolution window can be 500, and the stride of the convolution can be 500.

[0144] 508. The convolutional features are processed non-linearly to obtain the second extracted features.

[0145] Specifically, the server can perform exponential operations on each initial feature value of the convolutional feature to obtain the exponentially operated feature value corresponding to the initial feature value, and obtain the feature value of the second extracted feature based on the exponentially operated feature value to form the second extracted feature.

[0146] For example, the nonlinear feature extraction unit 606B can perform nonlinear processing on the convolutional features obtained by the linear feature extraction unit 606A to obtain the second extracted features.

[0147] 510. The feature values ​​in the first extracted features are weighted and calculated with the feature values ​​at the corresponding positions in the second extracted features to obtain the fused feature values. The fused feature values ​​are then combined according to their positions in the extracted features to obtain the fused features.

[0148] Specifically, the malicious code detection model 600 may also include a feature fusion module 608. The server can use the feature fusion module 608 to fuse the first extracted features output by the linear feature extraction module 604 and the second extracted features output by the nonlinear feature extraction module 606 to obtain fused features. For example, the result output by the linear feature extraction module 604 and the result output by the nonlinear feature extraction module 606 can be multiplied element-wise to obtain fused features.

[0149] The linear feature extraction module 604, the nonlinear feature extraction module 606, and the feature fusion module 608 can identify local indicators of malware. Local indicators refer to the code segments or the main code segments on which malware is judged to contain malicious code.

[0150] 512. Code detection is performed based on fusion features to obtain the code detection results corresponding to the target code.

[0151] Specifically, the server can compare the feature values ​​in the fused features with the feature threshold, block feature values ​​in the fused features that are less than the feature threshold, obtain the blocked fused features, obtain a feature extraction window of a preset size, obtain the key feature values ​​of each feature region corresponding to the feature extraction window in the blocked fused features, form key features, perform code detection based on key features, and obtain the code detection result corresponding to the target code.

[0152] The server can also perform fully connected processing based on fused features to obtain fully connected features. When the code detection result of the target code is determined to contain malicious code based on the fully connected features, the fully connected features are scaled to obtain code location features. Malicious substrings in the target code are determined based on the feature values ​​of the code location features. When the feature values ​​of the code location features are used to represent the probability that each vector in the vector sequence corresponds to a vector of malicious code, the server can obtain the feature values ​​of the code location features that are greater than a first probability threshold as malicious feature values, obtain the vectors corresponding to the malicious feature values ​​in the vector sequence as malicious vectors, and obtain the strings corresponding to the malicious vectors as malicious substrings in the target code.

[0153] For example, the malicious code detection model 600 may also include a shielding module 610, a pooling module 612, a fully connected module 614, and a classification module 616. The fully connected module 614 may correspond to an activation module, the pooling module 612 may use global max pooling, the fully connected module 614 may also be called a fully connected layer, for example, it may be a 128-dimensional (128D) fully connected layer, and the classification module 616 may also be called a classification layer, for example, it may be a 2-dimensional (2D) classification layer. The server can use the feature fusion module 608 to obtain the code detection result corresponding to the target code through the shielding module 610, the pooling module 612, the fully connected module 614, and the classification module 616. The classification module 616 can determine whether there is malicious code in the target code based on the fully connected features output by the fully connected module 614. When it is determined that there is malicious code in the target code, the server can perform a scale transformation on the fully connected module to obtain code location features, and determine the malicious substring in the target code based on the code location features, that is, determine the code segment on which the judgment of the presence of malicious code is based from the target code, such as... Figure 7 As shown, the hexadecimal representation of the target code is "MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00...", where "x00\x00\xb8\x00" is a malicious substring identified from the target code through code location features. Max pooling can be implemented using the pooling module, enabling the model to evaluate the relative strength of local metrics throughout the file, thereby identifying important global combinations.

[0154] The server can also determine the probability of malicious code detection corresponding to the target code based on the fusion features. When the probability of malicious code detection is greater than the second probability threshold, it is determined that there is malicious code in the target code.

[0155] 514. Determine whether the code in the target program has been completely detected. If not, return to the step of obtaining code of a preset length from the target program as the target code to be detected; if yes, execute step 516.

[0156] 516. Based on the code detection results corresponding to each target code, the program detection results corresponding to the target program are obtained.

[0157] In this embodiment, no manual construction of features or compiler knowledge is required. The trained malware detection model is universal and robust to changes in malware. The model has fast inference speed, allowing for the detection of large files. Its computational complexity is linearly related to the sequence length, meaning that computational and memory usage scales with the sequence length, such as the size of a binary file. The model can identify crucial code segments for forensic analysis from binary files, thus determining the code segments that indicate malware presence and providing better interpretation capabilities when analyzing malware. A code segment refers to a section of code within software code. The code detection method provided in this embodiment is also applicable to emerging file formats, compilers, and instruction set architectures. It learns to distinguish between benign and malicious Windows executables without relying on expensive and unreliable feature engineering, and considers both local and global contexts when examining the entire file.

[0158] In some embodiments, since network activation functions require a large amount of memory, a data-parallel model training approach can be used. For example, in the case of... Figure 6 When training the malware detection model, a DGX-1 system with 8 GPUs (Graphics Processing Units) can be used. When training the model in data parallel with a training set of 400,000 samples, fully utilizing the computing power of these 8 GPUs, one training round takes approximately 16.75 hours, and a total of 10 rounds are required. If training with a training set of two million samples using the same system, it would take a month. During training, to accelerate model convergence, the batch size can be increased, and the number of content units occupied by convolutional activation units can be controlled by adjusting the filter window length and stride. For example, increasing the filter window length or stride can control the number of content units occupied by the convolutional activation units. A global max-pooling layer following the convolutional layers allows for the simultaneous consideration of local and global contexts when inspecting the entire file. The global context refers to the entire text input into the model.

[0159] It should be understood that, although Figure 2-7 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2-7 At least some of the steps in the process may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the steps or stages in other steps.

[0160] In some embodiments, such as Figure 8 As shown, a code detection device is provided. This device can be a software module, a hardware module, or a combination of both integrated into a computer device. Specifically, the device includes: a target code acquisition module 802, a target substring sequence acquisition module 804, a vector sequence composition module 806, a feature extraction module 808, a feature fusion module 810, and a code detection result acquisition module 812, wherein:

[0161] The target code acquisition module 802 is used to acquire the target code to be detected.

[0162] The target substring sequence is obtained by module 804, which is used to divide the target code into strings and obtain the target substring sequence.

[0163] The vector sequence composition module 806 is used to obtain the substring vectors corresponding to each target substring in the target substring sequence and form a vector sequence.

[0164] The feature extraction module 808 is used to perform linear feature extraction on the vector sequence to obtain the first extracted feature, and to perform nonlinear feature extraction on the vector sequence to obtain the second extracted feature.

[0165] The feature fusion module 810 is used to fuse the first extracted features and the second extracted features to obtain fused features.

[0166] The code detection result acquisition module 812 is used to perform code detection based on fusion features and obtain the code detection result corresponding to the target code.

[0167] In some embodiments, the target substring sequence obtaining module 804 is further configured to obtain the current substring from the target code, compare the current substring with the code substrings in the code substring set, and when the comparison is consistent, use the current substring as the target substring corresponding to the target code; the code substring is obtained by dividing the malicious code file into strings; and the target substrings corresponding to the target code are arranged into a target substring sequence according to their positions in the target code.

[0168] In some embodiments, the target substring sequence obtaining module 804 is further configured to obtain the current substring from the target code, compare the current substring with the code substrings in the code substring set; when the comparison is consistent, obtain the backward character corresponding to the current substring from the target code, add the backward character to the current substring, and obtain the updated current substring; when the updated current substring is inconsistent with the code substrings in the code substring set, use the current substring before the update as the target substring corresponding to the target code.

[0169] In some embodiments, the feature extraction module 808 includes:

[0170] The first feature extraction unit is used to convolve the vector sequence using the first convolution model to obtain the first extracted features.

[0171] The convolution feature acquisition unit is used to convolve the vector sequence using the second convolution model to obtain the convolution features corresponding to the vector sequence. The first convolution model and the second convolution model are jointly trained.

[0172] The second feature extraction unit is used to perform nonlinear processing on the convolutional features to obtain the second extracted features.

[0173] In some embodiments, the second feature extraction unit is further configured to perform exponential operations on each initial feature value of the convolutional feature to obtain the exponential operation feature value corresponding to the initial feature value; and obtain the feature value of the second extracted feature based on the exponential operation feature value to form the second extracted feature.

[0174] In some embodiments, the code detection result obtaining module 812 includes:

[0175] The comparison unit is used to compare the feature values ​​in the fused features with the feature threshold.

[0176] The masked fused features are used to mask feature values ​​smaller than the feature threshold in the fused features, thus obtaining the masked fused features.

[0177] The code detection result unit is used to perform code detection based on the masked fusion features to obtain the code detection result corresponding to the target code.

[0178] In some embodiments, the code detection result obtaining unit is further used to obtain a feature extraction window of a preset size; obtain the key feature values ​​of each feature region corresponding to the feature extraction window in the masked fusion features, and form key features; perform code detection based on the key features to obtain the code detection result corresponding to the target code.

[0179] In some embodiments, the code detection result obtaining module 812 includes:

[0180] The fully connected feature acquisition unit is used to perform fully connected processing based on the fused features to obtain fully connected features.

[0181] The code localization feature acquisition unit is used to perform scale transformation on the fully connected features to obtain code localization features when the code detection result of the target code based on the fully connected features indicates the presence of malicious code.

[0182] The malicious substring determination unit is used to determine malicious substrings in the target code based on the feature values ​​of code location characteristics.

[0183] In some embodiments, the feature values ​​of the code location features are used to represent the probability that each vector in the vector sequence is a vector corresponding to malicious code. The malicious substring determination unit is also used to obtain feature values ​​in the code location features that are greater than a first probability threshold as malicious feature values; obtain the vectors corresponding to the malicious feature values ​​in the vector sequence as malicious vectors; and obtain the strings corresponding to the malicious vectors as malicious substrings in the target code.

[0184] In some embodiments, the feature fusion module 810 includes:

[0185] The fusion feature value acquisition unit is used to perform weighted calculations on the feature values ​​in the first extracted features and the feature values ​​at the corresponding positions in the second extracted features to obtain the fusion feature value.

[0186] The fusion feature unit is used to combine the various fusion feature values ​​according to their positions in the feature extraction process to obtain the fusion feature.

[0187] In some embodiments, the target code acquisition module 802 is further configured to acquire code of a preset length from the target program as the target code to be detected.

[0188] The device also includes:

[0189] The return module is used to return code of a preset length from the target program as the target code to be detected if the code in the target program has not been completely detected, until the code in the target program has been completely detected.

[0190] The program detection result acquisition module is used to obtain the program detection result corresponding to the target program based on the code detection result corresponding to each target code.

[0191] In some embodiments, the code detection result obtaining module 812 further includes:

[0192] The malicious code detection probability determination unit is used to determine the malicious code detection probability corresponding to the target code based on the fused features.

[0193] The malicious code determination unit is used to determine that malicious code exists in the target code when the probability of malicious code detection is greater than a second probability threshold.

[0194] For specific limitations regarding the code detection device, please refer to the limitations of the code detection method above, which will not be repeated here. Each module in the aforementioned code detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independently of the processor in the computer device, or stored in software in the memory of the computer device, so that the processor can call and execute the corresponding operations of each module.

[0195] In some embodiments, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data involved in the code detection method. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements a code detection method.

[0196] In some embodiments, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 10As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a code detection method. The display screen can be an LCD screen or an e-ink display. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0197] Those skilled in the art will understand that Figure 9 and 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0198] In some embodiments, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0199] In some embodiments, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0200] In some embodiments, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the steps in the above-described method embodiments.

[0201] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0202] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0203] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A code detection method, characterized in that, The method includes: Obtain the target code to be detected; The target code is split into strings to obtain a sequence of target substrings; Obtain the substring vectors corresponding to each target substring in the target substring sequence, and form a vector sequence; Linear feature extraction is performed on the vector sequence to obtain a first extracted feature, and nonlinear feature extraction is performed on the vector sequence to obtain a second extracted feature; The first extracted feature and the second extracted feature are fused together to obtain the fused feature. Based on the fusion features, code detection is performed to obtain the code detection result corresponding to the target code.

2. The method according to claim 1, characterized in that, The process of splitting the target code into substrings to obtain the target substring sequence includes: The current substring is obtained from the target code, and compared with the code substrings in the code substring set. If they match, the current substring is taken as the target substring corresponding to the target code. The code substring is obtained by splitting the malicious code file into strings. The target substrings corresponding to the target code are arranged into a target substring sequence according to their positions in the target code.

3. The method according to claim 2, characterized in that, The step of obtaining the current substring from the target code, comparing the current substring with the code substrings in the code substring set, and when they match, using the current substring as the target substring corresponding to the target code includes: Obtain the current substring from the target code, and compare the current substring with the code substrings in the code substring set; When the comparison is consistent, the backward character corresponding to the current substring is obtained from the target code, and the backward character is added to the current substring to obtain the updated current substring; When the updated current substring does not match the code substrings in the code substring set, the current substring before the update is taken as the target substring corresponding to the target code.

4. The method according to claim 1, characterized in that, The process of performing linear feature extraction on the vector sequence to obtain first extracted features, and performing nonlinear feature extraction on the vector sequence to obtain second extracted features, includes: The vector sequence is convolved using a first convolution model to obtain the first extracted feature; The vector sequence is convolved using a second convolution model to obtain the convolution features corresponding to the vector sequence. The convolution features are then subjected to nonlinear processing to obtain the second extracted features. The first convolutional model and the second convolutional model are jointly trained.

5. The method according to claim 4, characterized in that, The nonlinear processing of the convolutional features to obtain the second extracted features includes: Perform an exponential operation on each initial feature value of the convolutional feature to obtain the exponentially operated feature value corresponding to the initial feature value; The feature value of the second extracted feature is obtained based on the exponential operation feature value, and the second extracted feature is formed.

6. The method according to claim 5, characterized in that, The code detection based on the fused features to obtain the code detection result corresponding to the target code includes: The feature values ​​in the fused features are compared with the feature thresholds; By masking out feature values ​​in the fused features that are less than the feature threshold, the masked fused features are obtained. Based on the fused features after masking, code detection is performed to obtain the code detection result corresponding to the target code.

7. The method according to claim 6, characterized in that, The code detection based on the masked fusion features to obtain the code detection result corresponding to the target code includes: Obtain a feature extraction window of a preset size; In the masked fusion features, the key feature values ​​of each feature region corresponding to the feature extraction window are obtained to form key features; Based on the key features, code detection is performed to obtain the code detection result corresponding to the target code.

8. The method according to claim 1, characterized in that, The code detection based on the fused features to obtain the code detection result corresponding to the target code includes: Based on the fusion features, full-connection processing is performed to obtain full-connection features; When the code detection result of the target code is determined to contain malicious code based on the fully connected features, the fully connected features are subjected to scale transformation to obtain code localization features; The malicious substring in the target code is determined based on the feature value of the code location feature.

9. The method according to claim 8, characterized in that, The feature value of the code location feature is used to represent the probability that each vector in the vector sequence is a vector corresponding to malicious code. Determining the malicious substring in the target code based on the feature value of the code location feature includes: The feature values ​​in the code location features that are greater than a first probability threshold are obtained as malicious feature values; Obtain the vector corresponding to the malicious feature value in the vector sequence, and use it as the malicious vector; Obtain the string corresponding to the malicious vector and use it as a malicious substring in the target code.

10. The method according to claim 1, characterized in that, The process of fusing the first extracted features and the second extracted features to obtain the fused features includes: The feature values ​​in the first extracted features are weighted and calculated with the feature values ​​at the corresponding positions in the second extracted features to obtain the fused feature values. The fused feature values ​​are combined according to their positions in the feature extraction process to obtain the fused feature.

11. The method according to claim 1, characterized in that, The acquisition of the target code to be detected includes: Obtain code of a preset length from the target program as the target code to be detected; The method further includes: If the code in the target program has not been completely detected, the step of obtaining code of a preset length from the target program as the target code to be detected is returned until the code in the target program has been completely detected. The program detection result corresponding to the target program is obtained based on the code detection result corresponding to each of the target codes.

12. The method according to claim 1, characterized in that, The code detection based on the fused features to obtain the code detection result corresponding to the target code includes: The probability of detecting malicious code corresponding to the target code is determined based on the fusion features. When the probability of detecting malicious code is greater than the second probability threshold, it is determined that malicious code exists in the target code.

13. A code detection device, characterized in that, The device includes: The target code acquisition module is used to acquire the target code to be detected. The target substring sequence acquisition module is used to perform string segmentation on the target code to obtain the target substring sequence; The vector sequence composition module is used to obtain the substring vectors corresponding to each target substring in the target substring sequence and form a vector sequence. The feature extraction module is used to perform linear feature extraction on the vector sequence to obtain a first extracted feature, and to perform nonlinear feature extraction on the vector sequence to obtain a second extracted feature; The feature fusion module is used to fuse the first extracted feature and the second extracted feature to obtain the fused feature; The code detection result acquisition module is used to perform code detection based on the fusion features and obtain the code detection result corresponding to the target code.

14. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 12.

15. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 12.

Images