Malware family label correction method and device based on hybrid analysis

Abstract

The embodiment of the present invention provides a method and device for correcting malware family labels based on hybrid analysis, wherein the method includes: filtering malware in at least one malware family through a static filtering component and sending it into a sandbox to obtain a dynamic execution report; semantically mapping the dynamic execution report through a preset behavioral semantic knowledge base to obtain a corresponding semantic sequence; performing similarity clustering on the semantic sequence to obtain at least one malware cluster, and if there is inconsistency in the family label of the malware cluster, the malware cluster is determined to be an inconsistent cluster; determining the first distance of the inconsistent cluster, and determining the second distance of each semantic sequence in the inconsistent cluster, and correcting the family label in the inconsistent cluster according to the first distance and the second distance. The automated correction of errors caused by family annotation in upstream tasks is achieved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for correcting malware family labels based on hybrid analysis. Background Art

[0002] There are many confusions and conflicts in the naming of malware family labels. Since different vendors have different methods, angles, and naming rules for malware classification, different vendors and researchers will give different names to the same sample, and these names may conflict with each other. Controversial malicious sample labels are extremely detrimental to family classification, variant identification, and threat source profiling.

[0003] Currently, most malware labeling solutions are obtained from the detection results of the anti-virus engine in VirusTotal. VirusTotal has problems of confusion and conflict among multiple labels, so most solutions are superficial and it is difficult to deeply explore the label relationship.

[0004] The current common method for extracting malware family labels is automated malware labeling tools such as AVCLASS and Euphony. Automated malware labeling tools are a series of steps that aggregate the detection results of multiple anti-virus engines on the VirusTotal open source intelligence website, including the removal of universal tokens, the merging of aliases, the selection and voting of anti-virus engines, etc. Universal tokens and aliases are obtained by setting empirical thresholds and observing large-scale data. Therefore, it is inevitable that some missing or incorrect situations will occur, resulting in pollution in the label data. The upstream labeling errors will directly affect the effect of the downstream family classification task. Summary of the invention

[0005] In view of the problems in the prior art, an embodiment of the present invention provides a method and device for correcting malware family labels based on hybrid analysis.

[0006] Specifically, the embodiment of the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a method for correcting malware family labels based on hybrid analysis, characterized in that it includes: filtering malware in at least one malware family through a static filtering component and sending the resulting malware into a sandbox to obtain a dynamic execution report; semantically mapping the dynamic execution report through a preset behavioral semantic knowledge base to obtain a corresponding semantic sequence; performing similarity clustering on the semantic sequence to obtain at least one malware cluster, each malware cluster including at least one semantic sequence, each semantic sequence corresponding to a family label, and if there is an inconsistency in the family label of the malware cluster, determining the malware cluster as an inconsistent cluster; determining a first distance of the inconsistent cluster, and determining a second distance of each semantic sequence in the inconsistent cluster, and correcting the family label in the inconsistent cluster according to the first distance and the second distance.

[0008] Furthermore, filtering the malware in at least one malware family through a static filtering component and then sending it into a sandbox to obtain a dynamic execution report includes: obtaining a binary file of the malware in at least one malware family; for each binary file, detecting whether the binary file has a shell; if it is detected that there is no shell, filtering the binary file through a static filtering component and then sending it into a sandbox to obtain a dynamic execution report; if it is detected that there is a shell, sending the binary file into the sandbox to determine a corresponding dynamic execution report.

[0009] Furthermore, if it is detected that there is no shell, the binary file is filtered through a static filtering component and then input into a sandbox to obtain a dynamic execution report, including: if it is detected that there is no shell, the binary file is filtered through a static filtering component to determine the corresponding core code; according to the core code, a corresponding hash value is determined, and according to the hash value, an association relationship is determined, wherein the association relationship includes mutually unequal target hash values; the binary file corresponding to the target hash value is input into the sandbox to obtain a dynamic execution report.

[0010] Furthermore, filtering the binary file through a static filtering component to determine the corresponding core code includes: determining the original program entry point and file content size of the malware based on the binary file of the malware; and determining the corresponding core code based on the original program entry point and the file content size.

[0011] Furthermore, the behavioral semantics knowledge base is determined based on the ATT&CK technical matrix and Windows programming documentation.

[0012] Furthermore, the dynamic execution report is semantically mapped through a preset behavioral semantic knowledge base to obtain a corresponding semantic sequence, including: determining at least one corresponding quadruple based on at least one dynamic execution report, the quadruple including the caller name, the called function name, the called function parameters and the return value of the called function; and the at least one quadruple is semantically mapped through a preset behavioral semantic knowledge base to obtain at least one corresponding semantic sequence.

[0013] Furthermore, the semantically mapping the at least one quadruple through a preset behavioral semantic knowledge base to obtain at least one corresponding semantic sequence includes: semantically mapping the at least one quadruple through a preset behavioral semantic knowledge base and preset auxiliary rules to obtain at least one corresponding semantic sequence.

[0014] Further, the method of performing similarity clustering on the semantic sequences to obtain at least one malware cluster, each malware cluster including at least one semantic sequence, each semantic sequence corresponding to a family label, and if there is inconsistency in the family label of the malware cluster, then determining that the malware cluster is an inconsistent cluster includes: embedding at least one semantic sequence into a vector space to obtain at least one corresponding vector, and then performing similarity clustering on the at least one vector to obtain at least one malware cluster, each malware cluster including at least one vector, each vector corresponding to a family label, and if there is inconsistency in the family label, then determining that the malware cluster is an inconsistent cluster; and determining the first distance of the inconsistent cluster and determining the second distance of each semantic sequence in the inconsistent cluster include: determining the first distance according to the malware family to which the vector in the inconsistent cluster belongs; and for each vector in the inconsistent cluster, determining the corresponding second distance according to other vectors of the malware family to which the vector belongs.

[0015] Furthermore, embedding at least one semantic sequence into the vector space includes: embedding the at least one semantic sequence into the vector space through a Doc2Vec model.

[0016] Furthermore, the method of correcting the family labels in the inconsistent cluster according to the first distance and the second distance includes: comparing the second distance of each semantic sequence with the first distance; if the second distance of each semantic sequence is less than or equal to the first distance, the family labels in the inconsistent cluster are correct; and determining the family labels in the inconsistent cluster according to the degree of cohesion of the family labels in the inconsistent cluster; if the second distance of each semantic sequence is greater than the first distance, the family labels in the inconsistent cluster are incorrect and an exception is thrown; otherwise, the family label of the semantic sequence corresponding to the second distance greater than the first distance is changed to the family label of the semantic sequence corresponding to the second distance less than the first distance.

[0017] In the second aspect, an embodiment of the present invention further provides a malware family label correction device based on hybrid analysis, characterized in that it includes: a first processing module, used to filter the malware in at least one malware family through a static filtering component and then send it into a sandbox to obtain a dynamic execution report; a second processing module, used to semantically map the dynamic execution report through a preset behavioral semantic knowledge base to obtain a corresponding semantic sequence; a third processing module, used to perform similarity clustering on the semantic sequence to obtain at least one malware cluster, each malware cluster includes at least one semantic sequence, each semantic sequence corresponds to a family label, and if there is an inconsistency in the family label of the malware cluster, the malware cluster is determined to be an inconsistent cluster; a fourth processing module, used to determine the first distance of the inconsistent cluster, and determine the second distance of each semantic sequence in the inconsistent cluster, and correct the family label in the inconsistent cluster according to the first distance and the second distance.

[0018] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method for correcting malware family labels based on hybrid analysis as described in the first aspect are implemented.

[0019] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the malware family label correction method based on hybrid analysis as described in the first aspect.

[0020] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the malware family label correction method based on hybrid analysis described in the first aspect.

[0021] The hybrid analysis-based malware family label correction method and device provided by the embodiment of the present invention can help security analysts better understand the real intentions of malicious samples when system calls map behavioral semantics through a behavioral semantics knowledge base, and can also reduce the blindness of artificial intelligence model learning. Through the hybrid analysis method of dynamic execution reporting and similarity clustering, the effectiveness of reviewing malicious sample family labels is improved in large-scale malicious sample family classification tasks; through the first average Euclidean distance and the second average Euclidean distance, automatic correction of errors caused by family annotation in upstream tasks is achieved to prevent the learning of erroneous prior knowledge in downstream tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 A flowchart diagram of some embodiments of a malware family label correction method based on hybrid analysis provided by the present invention;

[0024] Figure 2 It is a schematic diagram of the redundant locations of PE executable files;

[0025] Figure 3 A schematic diagram of the concepts related to computer system components;

[0026] Figure 4 Schematic diagrams of some embodiments of malware family label correction methods;

[0027] Figure 5 It is a schematic diagram of the structure of some embodiments of the malware family label correction device based on hybrid analysis provided by the present invention;

[0028] Figure 6 It is a schematic diagram of the structure of an electronic device provided according to the present invention. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other.

[0031] It should be noted that the concepts such as "first" and "second" mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0032] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0033] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.

[0034] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0035] See also Figure 1 , Figure 1 1 is a flowchart of some embodiments of the malware family label correction method based on hybrid analysis provided by the present invention. Figure 1 As shown, the method comprises the following steps:

[0036] Step 101: The malware in at least one malware family is filtered by a static filtering component and then sent to a sandbox to obtain a dynamic execution report.

[0037] As an example, the static filtering component may be a table composed of keywords, which is used to filter out duplicate malicious samples.

[0038] As an example, the result of the static filtering component is a dictionary structure consisting of a key-value pair, namely key:value; the key refers to the hash value of the core code of the malicious sample, and the value refers to the sample path and name corresponding to the key. The sample list corresponding to the same key has only one behavior sequence in the subsequent dynamic analysis, so the 1:N key:value pair is filtered into a 1:1 key-value pair, that is, the redundant malicious samples corresponding to each key are filtered out to reduce the number of subsequent analyses.

[0039] As an example, there are multiple malware in a malware family, each of which belongs to the same type and has the same attack principle, and is a variant based on the same attack principle.

[0040] As an example, the dynamic execution report can be obtained by sending the malware into a sandbox, or by analyzing and tracking the malware through other analysis methods. The dynamic execution report is used to record the behavior of the sample in a controlled environment (i.e., sandbox) and a series of interactions with the system. As an example, the results of the dynamic behavior report include the underlying calling function starting with NT, the calling time, the caller, the function parameters, the function return value, etc.

[0041] As an example, the results of the dynamic execution report include functions, files copied and deleted by the application, memory images of selected processes, screenshots of the malware while it was executed, network traffic generated by the analysis machine, etc.

[0042] As an example, a malware sample can be automatically started by setting the registry. The dynamic execution report can be found at:

[0043] <1.exe,NtSetValueKey,[HKEY_LOCAL_MACHINE\SOFTWARE\

[0044] MICROSOFT\WINDOWS\CURRENTVERSION\RUN],0>

[0045] Step 102 , semantic mapping is performed on the dynamic execution report through a preset behavior semantic knowledge base to obtain a corresponding semantic sequence.

[0046] As an example, at least one dynamic execution report is semantically mapped through a preset behavioral semantic knowledge base, that is, the concept of knowledge graph is introduced. The malware ontology is a knowledge model in the malware field, which contains all relevant concepts related to malware individuals, malware behaviors, and computer system components. The behavioral semantic knowledge base is constructed based on these concepts.

[0047] As an example, a table of keyword-semantic sequences may be set to match the keywords in the dynamic execution report with the keywords recorded in the table. If the match is successful, it means that the semantic sequence corresponding to the keyword corresponds to the dynamic execution report.

[0048] Still taking the above malware sample as an example to implement the self-starting dynamic execution report by setting the registry, the semantic sequence obtained after semantic mapping is: AutoRun, mapping the semantics of multiple malware samples to obtain at least one semantic sequence.

[0049] Step 103, clustering the semantic sequences by similarity to obtain at least one malware cluster, each malware cluster includes at least one semantic sequence, each semantic sequence corresponds to a family label, and if there is inconsistency in the family labels of the malware cluster, the malware cluster is determined to be an inconsistent cluster.

[0050] As an example, malware clusters are obtained by clustering, and each malware cluster includes malware from at least one malware family. If the malware in a malware cluster all come from the same malware family, it means that the labels of each malware in the malware cluster are consistent. If the malware in a malware cluster come from different malware families, it means that there are labels of multiple malware families in the malware cluster, and the malware cluster is determined to be an inconsistent cluster.

[0051] As an example, each semantic sequence corresponds to a malware, and one malware corresponds to a label.

[0052] According to the Computer Antivirus Research Organization (CARO) malware naming scheme (naming scheme is a label), which has influenced the current detection names, most AV vendors use the same or similar components as CARO recommends, but usually have their own terminology and order. For example, Microsoft's naming scheme: <type:platform:family:variant:suffixes>.

[0053] As an example, the algorithm for similarity clustering can be an unsupervised learning algorithm. Unsupervised learning is a machine learning training method that can discover potential meaningful structures in unlabeled data.

[0054] Step 104 , determining a first distance of the inconsistent clusters, and determining a second distance of each semantic sequence in the inconsistent clusters, and correcting the family labels in the inconsistent clusters according to the first distance and the second distance.

[0055] As an example, the first distance and the second distance may be Euclidean distances.

[0056] Accurate extraction of malware labels helps security researchers analyze malware-related information, such as its type, operating platform, family information, variant sequence, etc.; it helps propose and implement efficient removal plans in emergency response, and it helps AI engineers establish benchmark labels for supervised learning models, so that artificial intelligence models can learn a wide range of benchmark facts and provide support for security data operations or subsequent research work.

[0057] As an example, the semantic sequences of all malware in the inconsistent cluster can be mapped to the vector space, the vector data of each sample can be obtained, and the average value of these vector data, that is, the first distance, is calculated. The vector data has 1024 dimensions.

[0058] As an example, if you want to calculate the second distance of semantic sequence A in an inconsistent cluster, you can map the other semantic sequences in the inconsistent cluster except semantic sequence A to the vector space, and then calculate the average value of the data mapped to the vector space, that is, the second distance. Similarly, you can calculate the second distance of each semantic sequence in the inconsistent cluster in turn.

[0059] As an example, the Mahalanobis distance, the standard Euclidean distance, the standard deviation, etc. may be selected as needed to represent the average value of the semantic sequences in the inconsistent clusters.

[0060] The hybrid analysis-based malware family label correction method disclosed in some embodiments of the present invention can help security analysts better understand the real intentions of malicious samples when mapping behavioral semantics to system calls through a behavioral semantics knowledge base, and can also reduce the blindness of artificial intelligence model learning. Through a hybrid analysis method of dynamic execution reporting and similarity clustering, the effectiveness of reviewing malicious sample family labels in large-scale malicious sample family classification tasks is improved; through the first distance and the second distance, automatic correction of errors caused by family annotation in upstream tasks is achieved to prevent incorrect prior knowledge from being learned in downstream tasks.

[0061] In some optional implementations, malware in at least one malware family is filtered through a static filtering component and then sent into a sandbox to obtain a dynamic execution report, including: obtaining a binary file of malware in at least one malware family; for each binary file, detecting whether the binary file has a shell; if it is detected that there is no shell, filtering the binary file through the static filtering component and then entering the sandbox to obtain a dynamic execution report; if it is detected that there is a shell, entering the binary file into the sandbox to determine the corresponding dynamic execution report.

[0062] In order to increase the success rate of the attack and reduce the cost of the attack, attackers usually use a large number of malicious samples with the same attack payload. When the same sample appears, repeated analysis will waste a lot of human resources and time costs. Therefore, once the security vendor detects the malicious sample through different analysis techniques, it will record the hash value of the sample and add it to the blacklist (the blacklist is generated in real time, and the hash values ​​recorded in the blacklist are not equal). Before analyzing the malicious sample, it is only necessary to query whether the hash value of the sample is in the blacklist. In order to avoid the direct filtering of the anti-virus engine based on the blacklist, the attacker will try to modify the non-core part of the malware without affecting the operation of the malware, so as to bypass the blacklist. Therefore, how to locate the redundant space of the malware has become the primary problem for the attacker. The above method filters through the static filtering component to complete the extraction of the target core code of the binary file of the malware.

[0063] In addition, because binary files with shells may cause data loss, it is necessary to first detect whether at least one binary file of the malware has a shell. If there is a shell, it means that the file may have data compression or encryption, and it is impossible to obtain complete data, and it is impossible to accurately match the data through the static filtering component. Therefore, the file can be directly sent to the sandbox for dynamic detection; if not, the target core code in the file can be extracted through the static filtering component. The hash value of the target core code is in the blacklist.

[0064] In some optional implementations, if no shell is detected, the binary file is filtered through a static filtering component and then input into a sandbox to obtain a dynamic execution report, including: if no shell is detected, the binary file is filtered through a static filtering component to determine the corresponding core code; determine the corresponding hash value according to the core code, and determine the association relationship according to the hash value, the association relationship includes unequal target hash values; input the binary file corresponding to the target hash value into the sandbox to obtain a dynamic execution report.

[0065] like Figure 2 As shown in the figure, the redundant position diagram of the PE executable file (i.e., the binary file of the malware, or the PE segment), the attacker can change the bytes of the binary file itself by inserting redundant bytes in the PE header, the tail of the PE segment, the new PE redundant segment, and the tail of the PE, thereby causing the hash value of the full-text encryption hash algorithm (such as md5, sha-1, etc.) to change. Among them, the "PE" in the PE executable file is Portable Executable, and the PE executable file is a new executable file format introduced by Microsoft for Windows NT.

[0066] As an example, a key position location method is designed and implemented to determine the corresponding core code: first, the address of the original program entry point (OEP) is obtained in the unpacked malicious sample, and then the start and end positions of each PE segment (i.e., the binary file of the malware, or the PE executable file) are calculated. Specifically, when calculating the end position of the PE section, it is determined whether the virtual address can be aligned with the memory block size determined by the hardware conditions when the executable file is loaded into the memory. If not, the operating system will fill in 0 for alignment. Then locate and take out the PE segment where the original entry point is located. At the same time, considering that there is an attacker inserting or modifying bytes at redundant positions after the PE segment in an attempt to counter the attack, when taking the section table segment, only the actual size of the current PE section is taken, and the redundant fields are discarded to obtain the core code.

[0067] As an example, the corresponding hash value is determined according to the core code, and the association relationship is determined according to the hash value, that is, the association relationship includes the target hash value and the binary file corresponding to the target hash value. The target hash value is a non-repeated hash value obtained by determining the corresponding hash value according to the core code.

[0068] As an example, a blacklist can also be determined based on the corresponding hash value of the core code. The blacklist is generated in real time based on the corresponding hash value of the core code, and the hash values ​​recorded in the blacklist are not equal to each other. The blacklist can also be pre-set. If the hash value corresponding to the core code is not in the blacklist, it is removed. If the hash value corresponding to the core code is in the blacklist, the core code is determined to be the target core code. Without affecting the operation of the malware, the attacker is prevented from bypassing the blacklist by modifying the non-core part of the malware. In some optional implementations, the binary file is filtered through a static filtering component to determine the corresponding core code, including: determining the original program entry point and file content size of the malware based on the binary file of the malware; determining the corresponding core code based on the original program entry point and file content size.

[0069] As an example, in order to avoid changes in hash values ​​caused by attackers' modification based on redundant positions, it is necessary to determine the core code. In this way, the static filtering component can only focus on the core executable code of the sample, and changes in redundant positions will not cause changes in the hash results, that is, it is not sensitive to changes in the non-core parts of the malicious sample. The core code segment is obtained in the PE executable file as follows.

[0070]

[0071] For the redundant locations of PE executable files, a sample data normalization technology based on diversity screening is implemented. This technology is based on locating the location of the core attack payload code of the PE executable file, thereby avoiding the hash value changes caused by changes in the bytes of the redundant locations.

[0072] In some optional implementations, the behavioral semantics knowledge base is determined based on the ATT&CK technical matrix and Windows programming documentation.

[0073] The ATT&CK technology matrix describes the technical model used in each stage of the attack from the attacker's perspective.

[0074] Windows programming documentation, Windows built-in development documentation. Constructing a behavioral semantics knowledge base prepares for semantic mapping.

[0075] In some optional implementations, the dynamic execution report is semantically mapped through a preset behavioral semantic knowledge base to obtain a corresponding semantic sequence, including: determining at least one corresponding quadruple based on at least one dynamic execution report, the quadruple including the caller name, the called function name, the called function parameters and the return value of the called function; semantically mapping at least one quadruple through a preset behavioral semantic knowledge base to obtain at least one corresponding semantic sequence.

[0076] The caller name defines the current function called by the executable program. The executable program (i.e., the target core code) can be the initially running malware, the software released / modified by the malware, or the normal software. Figure 3 As shown in the figure, the computer system component defines the classification architecture of computer components, including subclasses and individuals of all system components. The behavior API points to the name of the API function currently called, which includes different types of APIs. The return value defines the return value of the current API, including 0 and non-0. In this way, the behavior semantics of a single API can be described by a four-tuple:

[0077] <Caller\_name,API\_name,API\_exinfo,API\_ret> .

[0078] An example of a malicious sample reading itself:

[0079] <22703.file.exe,NtReadFile,C:$\backslash$program$\backslash$

[0080] 71733$\backslash$22703.file.exe,0\textgreater>

[0081] First, the API names (function names) are processed and classified. The API names are represented by a string of words, such as "NtCreateFile". In addition, some API names end with various suffixes, such as Ex, A, W, ExA, and ExW. These suffixes are then removed to ensure that the extracted features can resist conflicts using multiple versions of the same API call. In order to handle heterogeneous API parameters, APIs representing functions in different fields, such as "InternetCrackUrl" and "DnsQuery", can be classified as network type functions, and "NtDeleteFile" and "NtOpenFile" can be classified as file type functions. Secondly, for the parameters of APIs that identify different functional areas, regular expressions are used to convert specific heterogeneous parameters of system components into parameter subtypes. Some specific APIs have more than one function parameter, so the system component in the quadruple is a list. In addition, for the return value, it is given a 0 or non-0 form. The information extracted from the quadruple using the above steps is semantically mapped at the same time. The quadruple can accurately and concisely reflect the key information of the malicious code, which is conducive to improving the efficiency of data analysis.

[0082] In some optional implementations, at least one quadruple is semantically mapped through a preset behavioral semantic knowledge base to obtain at least one corresponding semantic sequence, including: at least one quadruple is semantically mapped through a preset behavioral semantic knowledge base and preset auxiliary rules to obtain at least one corresponding semantic sequence.

[0083] As an example, an auxiliary rule could be defined:

[0084] 1. Defines a series of self-operation behaviors such as self-reading, self-deleting, and self-modifying, which are mainly caused by functions such as NtReadFile, NtCreateFile, and NtDeleteFile. The key to this semantics is whether the caller name and the file in the parameter point to the same file.

[0085] 2. Defines rename semantics, which is usually caused by the MoveFileWithProgress function. The key to this semantics is whether the directories of the two parameters in the parameter list are the same.

[0086] 3. Defined excessive behavior semantics, which means that malware runs a single API more than 1,500 times in the sandbox, which is excessive behavior semantics. Behavior semantics are divided into normal excessive behavior and abnormal excessive behavior according to the type of API.

[0087] 4. The two semantics of searching files and getting file attributes are mainly caused by functions such as NtQueryAttributesFile, NtQueryDirectoryFile, and NtQueryFullAttributesFile. The key to distinguishing these two semantics is whether the return value of the function is 0.

[0088] 5. In order to highlight the malicious behavior of the sample, the unmatched API calls are classified as normal behaviors.

[0089] Building auxiliary rules is helpful to improve the accuracy of semantic mapping.

[0090] In some optional implementations, semantic sequences are clustered by similarity to obtain at least one malware cluster, each malware cluster includes at least one semantic sequence, each semantic sequence corresponds to a family label, and if there is inconsistency in the family label of the malware cluster, the malware cluster is determined to be an inconsistent cluster, including: embedding at least one semantic sequence into a vector space to obtain at least one corresponding vector, and then performing similarity clustering on at least one vector to obtain at least one malware cluster, each malware cluster includes at least one vector, each vector corresponds to a family label, and if there is inconsistency in the family label, the malware cluster is determined to be an inconsistent cluster; and determining a first distance of the inconsistent clusters, and determining a second distance of each semantic sequence in the inconsistent clusters, including: determining the first distance according to the malware family to which the vector in the inconsistent cluster belongs; for each vector in the inconsistent cluster, determining the corresponding second distance according to other vectors of the malware family to which the vector belongs.

[0091] As an example, if there are incorrect and incorrect family labels in the inconsistent clue cluster, and there are samples belonging to normal points, then this situation belongs to labeling error, and the labels of the abnormal point family are automatically corrected to the labels of the normal point family.

[0092] As an example, two samples a and f (samples are semantic sequences of malware) are clustered in an inconsistent cluster, where a is the blackmoon family, and there are three samples a, b, and c under the blackmoon family. The first distance refers to the average distance determined based on the semantic sequences of all malicious samples in the malware family blackmoon. For example, for the first distance of a, the distance between each sample in the blackmoon family and other samples is calculated pairwise, that is, the first distance = (Distance(a,b)+Distance(a,c)+Distance(b,c)) / 3.

[0093] As an example, the second distance refers to the average distance determined based on the semantic sequence and other samples in the malware family except the semantic sequence. For example, two samples a and f are clustered in an inconsistent cluster. The malware families of a and f are inconsistent, where a is the blackmoon family and f is the wannacry family. For the second distance of a, the second distance = (Distance (a, b) + Distance (a, c)) / 2. As an example, a highly parallel version of the hierarchical clustering algorithm can be used to cluster behavioral similarity.

[0094] As an example, in order to determine the family label problem in the inconsistent cluster, the average Euclidean distance of all samples under each family label can be calculated first, that is, the first distance is determined according to the malware family to which the vector in the inconsistent cluster belongs. Secondly, the average distance between each sample in the inconsistent clue cluster and other samples in its family is calculated, that is, for each vector in the inconsistent cluster, the corresponding second distance is determined according to other vectors in the malware family to which the vector belongs, and this distance is compared with the average distance of its family to determine whether the sample is an outlier (outlier).

[0095] In some optional implementations, embedding at least one semantic sequence into a vector space includes: embedding at least one semantic sequence into a vector space through a Doc2Vec model.

[0096] As an example, the semantic sequence A may be {autorun, find_other, load_other}. After the semantic sequence A is subjected to unsupervised learning by the Doc2Vec model, the semantic sequence A embedded in the vector space is obtained, such as [01012532…1206].

[0097] As an example, for the processed semantic sequence embedding, the Doc2Vec model is used to embed the semantic document into the vector space and convert it into a low-dimensional vector representation, which is beneficial for the next step of calculation.

[0098] In some alternative implementations, correcting the family labels in the inconsistent cluster according to the first distance and the second distance includes: comparing the second distance of each semantic sequence with the first distance. If the second distance of each semantic sequence is less than or equal to the first distance, the family labels in the inconsistent cluster are all correct, and the family labels in the inconsistent cluster are determined according to the cohesion degree of the family labels in the inconsistent cluster; if the second distance of each semantic sequence is greater than the first distance, the family labels in the inconsistent cluster are all incorrect, and an exception is thrown; otherwise, the family label of the semantic sequence corresponding to the second distance greater than the first distance is changed to the family label of the semantic sequence corresponding to the second distance less than the first distance.

[0099] As an example, if the family labels in the inconsistent cluster are all correct, it is considered that this case belongs to multi-label or malware aliases. When the average distance of these families does not exceed the distance threshold, that is, when it belongs to a highly cohesive family label, it is a malware alias problem, otherwise it is a multi-label type.

[0100] As an example, if the family labels in the inconsistent cluster are all incorrect, the true situation of these samples cannot be inferred based on the existing basis, so nothing is done at this time. However, these outliers will be thrown to attract the attention of security researchers or practitioners to the true attribution of these malicious samples.

[0101] Still taking the above as an example, correcting the family labels in the inconsistent cluster according to the first distance and the second distance can correct the family labels in the inconsistent cluster by judging the size relationship between the first distance (denoted as dis1) and the second distance (denoted as dis2):

[0102] 1. For sample a, dis1 > dis2, while for sample f, dis1 < dis2, then the family label of sample f is incorrect, and the label of sample f should be blackmoon;

[0103] 2. For sample f, dis1 > dis2, while for sample a, dis1 < dis2, then the family label of sample a is incorrect, and the label of sample a should be wannacry;

[0104] 3. If both sample a and sample f have dis1 > dis2, then consider that there is an alias or multi-label relationship between the samples;

[0105] 4. If both sample a and sample f have dis1 < dis2, then the family labels of the samples are all incorrect, and an exception is thrown.

[0106] Among them, the aliases of malware families are actually synonymous aliases, that is, although the names are different, they actually refer to the same entity. For example, mira and miras refer to the same family, and qukart and berbew also refer to the same family. Multi-label relationships are caused by the inconsistent granularity or measurement described by the names of malware families. For example, a sample is labeled trojan in terms of category and blackmoon in terms of family. Both labels are correct, but the measurement of the description is not consistent.

[0107] In a multi-label relationship, the first distances corresponding to family labels are generally very different. For example, the relationship between trojan and blackmoon mentioned above is a subordinate relationship, that is, there are several different families under the trojan label, and the blackmoon label is only one of them. Although trojan and blackmoon are both correct for describing the corresponding samples, the granularity of the category is obviously too coarse. Therefore, a behavioral cohesion threshold is defined here, which is calculated by the median absolute deviation (MAD). MAD is defined as the median of the absolute deviations from the data point to the median:

[0108] MAD=median(|Xi-median(X)|) Formula (1)

[0109] Among them, Xi represents the first distance of the i-th family, and median represents the median operation;

[0110] That is, the threshold of the degree of behavioral cohesion is defined as the value of the calculated MAD.

[0111] Still taking the above example, if the a and f samples are both dis1>dis2, we need to compare the first distance of the families behind the two samples a and f in the cluster with the behavior cohesion threshold (referred to as the threshold). If:

[0112] 1. If the first distances of two sample families are both less than the behavior threshold, it is an alias relationship, and the corresponding family name is changed to the other family name.

[0113] 2. If the first distance of the a sample family is less than the threshold, while the f sample is greater than the threshold, it is a multi-label relationship. Here, only the family label of the f sample in the cluster is changed to the a sample family label.

[0114] 3. If the f sample is smaller than the threshold and the a sample is larger than the threshold, it is multi-label. Here, the label of a is changed to the corresponding family name of f.

[0115] 4. Sample a and sample f are both greater than the threshold, so the operation cannot be performed and an exception is thrown.

[0116] like Figure 4 The overall block diagram shown in the figure is a deep analysis of a large number of real malware captured in the existing network. According to the ATT&CK technical matrix, the underlying calls in the dynamic sandbox execution report of the malicious sample are mapped to the upper-level semantic representation. Unsupervised clustering learning is performed using the behavioral semantic similarity of the samples. Finally, the sample labels of different families in the same cluster are merged to achieve the label correction effect in malware classification. Specifically:

[0117] 1. Enter the executable file in the preparation module, first detect the shell of the binary file, and then enter the static filtering component based on the result of the shell check. The purpose of this step is to alleviate the problem of the difficult balance between the growth rate of malicious samples and analysis efficiency in large-scale malware.

[0118] 2. Input the sample into the sandbox to obtain its dynamic execution report, and then map the underlying calls in the sandbox report into behavioral semantics based on the malware behavioral semantics knowledge base we constructed offline.

[0119] 3. In the cluster analysis module, the generated behavioral semantics are converted into an embedding space representation through the Doc2Vec model, and then clustered based on good behavioral similarity through a hierarchical clustering algorithm. Finally, the clue clusters containing inconsistent families are analyzed and located.

[0120] 4. Determine whether the samples in the clue cluster are outliers (abnormal points) under their original family labels, so as to determine the type of label problem (label error, family alias, multiple labels), and finally correct the malware family label description.

[0121] 5. Input is large-scale malware and its family labels, and the output is the diagnosis of all malware family labels.

[0122] The label contamination phenomenon that may exist in large-scale malware family classification tasks usually leads to three different types of mislabeling problems, including mislabeling, ontology problems, and multiple labels. According to the above method, tests are conducted on the latest and well-annotated Bodmas dataset, where a total of 2,003 samples are involved in the three different types of labeling problems. According to the above method, when correcting the wrong labels in the dataset, using the same features and models, correcting the labels can improve the accuracy by 2.6%. More importantly, this method is very important for supplementing the malware family alias knowledge base.

[0123] See also Figure 5 , Figure 5 1 is a schematic diagram of the structure of some embodiments of the malware family label correction device based on hybrid analysis provided by the present invention. As an implementation of the methods shown in the above figures, the present invention also provides some embodiments of the malware family label correction device based on hybrid analysis. These device embodiments are similar to Figure 1 The embodiments of some methods shown correspond to each other, and the device can be applied to various electronic devices.

[0124] like Figure 5 As shown, some embodiments of the malware family label correction device based on hybrid analysis include a first processing module 501, a second processing module 502, a third processing module 503 and a fourth processing module 504: the first processing module 501 is used to filter the malware in at least one malware family through a static filtering component and send it into a sandbox to obtain a dynamic execution report; the second processing module 502 is used to semantically map the dynamic execution report through a preset behavioral semantic knowledge base to obtain a corresponding semantic sequence; the third processing module 503 is used to perform similarity clustering on the semantic sequence to obtain at least one malware cluster, each malware cluster includes at least one semantic sequence, each semantic sequence corresponds to a family label, and if there is an inconsistency in the family label of the malware cluster, the malware cluster is determined to be an inconsistent cluster; the fourth processing module 504 is used to determine a first distance of the inconsistent cluster, and determine a second distance of each semantic sequence in the inconsistent cluster, and correct the family label in the inconsistent cluster according to the first distance and the second distance.

[0125] In an optional implementation of some embodiments, the first processing module 501 is also used to: obtain binary files of malware in at least one malware family; for each binary file, detect whether the binary file has a shell; if it is detected that there is no shell, filter the binary file through a static filtering component and input it into a sandbox to obtain a dynamic execution report; if it is detected that there is a shell, input the binary file into the sandbox to determine the corresponding dynamic execution report.

[0126] In an optional implementation of some embodiments, the first processing module 501 is also used for: if no shell is detected, filtering the binary file through a static filtering component to determine the corresponding core code; determining the corresponding hash value according to the core code, and determining an association relationship according to the hash value, the association relationship including mutually unequal target hash values; inputting the binary file corresponding to the target hash value into the sandbox to obtain a dynamic execution report.

[0127] In an optional implementation of some embodiments, the first processing module 501 is also used to: determine the original program entry point and file content size of the malware based on the binary file of the malware; determine the corresponding core code based on the original program entry point and file content size.

[0128] In an optional implementation of some embodiments, the behavioral semantics knowledge base is determined based on the ATT&CK technical matrix and Windows programming documentation.

[0129] In an optional implementation of some embodiments, the second processing module 502 is also used to: determine at least one corresponding quadruple based on at least one dynamic execution report, the quadruple including the caller name, the called function name, the called function parameters and the return value of the called function; and semantically map at least one quadruple through a preset behavioral semantic knowledge base to obtain at least one corresponding semantic sequence.

[0130] In an optional implementation of some embodiments, the second processing module 502 is further used to: perform semantic mapping on at least one quadruple through a preset behavioral semantic knowledge base and preset auxiliary rules to obtain at least one corresponding semantic sequence.

[0131] In an optional implementation of some embodiments, the third processing module 503 is also used to: embed at least one semantic sequence into the vector space to obtain at least one corresponding vector, and then perform similarity clustering on the at least one vector to obtain at least one malware cluster, each malware cluster includes at least one vector, each vector corresponds to a family label, and if there is an inconsistency in the family label, the malware cluster is determined to be an inconsistent cluster; and the fourth processing module 504 is also used to: determine a first distance according to the malware family to which the vector in the inconsistent cluster belongs; for each vector in the inconsistent cluster, determine a corresponding second distance according to other vectors of the malware family to which the vector belongs.

[0132] In an optional implementation of some embodiments, embedding at least one semantic sequence into a vector space includes: embedding at least one semantic sequence into a vector space through a Doc2Vec model.

[0133] In an optional implementation of some embodiments, the fourth processing module 504 is also used to: compare the second distance of each semantic sequence with the first distance; if the second distance of each semantic sequence is less than or equal to the first distance, the family labels in the inconsistent clusters are correct, and the family labels in the inconsistent clusters are determined according to the degree of cohesion of the family labels in the inconsistent clusters; if the second distance of each semantic sequence is greater than the first distance, the family labels in the inconsistent clusters are incorrect, and an exception is thrown; otherwise, the family label of the semantic sequence corresponding to the second distance greater than the first distance is changed to the family label of the semantic sequence corresponding to the second distance less than the first distance.

[0134] In some optional implementations of the embodiments, it can be understood that the modules recorded in the device and the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the device and the modules and units contained therein, and will not be described in detail here.

[0135] Here is an example:

[0136] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute a malware family label correction method based on hybrid analysis, the method comprising: filtering malware in at least one malware family through a static filtering component and sending it into a sandbox to obtain a dynamic execution report; semantically mapping the dynamic execution report through a preset behavioral semantic knowledge base to obtain a corresponding semantic sequence; performing similarity clustering on the semantic sequence to obtain at least one malware cluster, each malware cluster includes at least one semantic sequence, each semantic sequence corresponds to a family label, and if there is inconsistency in the family label of the malware cluster, the malware cluster is determined to be an inconsistent cluster; determining a first distance of the inconsistent cluster, and determining a second distance of each semantic sequence in the inconsistent cluster, and correcting the family label in the inconsistent cluster according to the first distance and the second distance.

[0137] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above-mentioned methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0138] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the malware family label correction method based on hybrid analysis provided by the above methods, and the method includes: filtering the malware in at least one malware family through a static filtering component and sending it into a sandbox to obtain a dynamic execution report; semantically mapping the dynamic execution report through a preset behavioral semantic knowledge base to obtain a corresponding semantic sequence; similarity clustering the semantic sequence to obtain at least one malware cluster, each malware cluster includes at least one semantic sequence, each semantic sequence corresponds to a family label, and if there is an inconsistency in the family label of the malware cluster, the malware cluster is determined to be an inconsistent cluster; determining a first distance of the inconsistent cluster, and determining a second distance of each semantic sequence in the inconsistent cluster, and correcting the family label in the inconsistent cluster according to the first distance and the second distance.

[0139] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the above-mentioned malware family label correction method based on hybrid analysis, the method comprising: filtering the malware in at least one malware family through a static filtering component and sending it into a sandbox to obtain a dynamic execution report; semantically mapping the dynamic execution report through a preset behavioral semantic knowledge base to obtain a corresponding semantic sequence; similarity clustering the semantic sequences to obtain at least one malware cluster, each malware cluster including at least one semantic sequence, each semantic sequence corresponding to a family label, if there is an inconsistency in the family label of the malware cluster, determining the malware cluster as an inconsistent cluster; determining a first distance of the inconsistent cluster, and determining a second distance of each semantic sequence in the inconsistent cluster, and correcting the family label in the inconsistent cluster according to the first distance and the second distance.

[0140] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0141] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0142] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.< / type:platform:family:variant:suffixes>

Claims

1. A malware family label correction method based on hybrid analysis, characterized in that: include: The malware in at least one malware family is filtered by a static filtering component and then sent to a sandbox to obtain a dynamic execution report; The dynamic execution report is semantically mapped through a preset behavior semantic knowledge base to obtain a corresponding semantic sequence; Performing similarity clustering on the semantic sequences to obtain at least one malware cluster, each malware cluster including at least one semantic sequence, each semantic sequence corresponding to a family label, and if there is inconsistency in the family labels of the malware cluster, determining the malware cluster as an inconsistent cluster; Determine a first distance of the inconsistent cluster, and determine a second distance of each semantic sequence in the inconsistent cluster, and correct the family label in the inconsistent cluster according to the first distance and the second distance; Determining a first distance of the inconsistent cluster, and determining a second distance of each semantic sequence in the inconsistent cluster, and correcting the family label in the inconsistent cluster according to the first distance and the second distance, specifically includes: Determine a first distance based on the malware family to which the vectors in the inconsistent cluster belong; For each vector in the inconsistent cluster, determine a corresponding second distance based on other vectors of the malware family to which the vector belongs; Compare the second distance of each semantic sequence with the first distance. If the second distance of each semantic sequence is less than or equal to the first distance, the family labels in the inconsistent cluster are correct. Determine the family labels in the inconsistent cluster according to the cohesion degree of the family labels in the inconsistent cluster. If the second distance of each semantic sequence is greater than the first distance, the family labels in the inconsistent clusters are incorrect and an exception is thrown; Otherwise, the family label of the semantic sequence corresponding to the second distance greater than the first distance is changed to the family label of the semantic sequence corresponding to the second distance less than the first distance.

2. The malware family label correction method based on hybrid analysis according to claim 1 is characterized in that: The filtering of malware in at least one malware family by a static filtering component and then sending the malware into a sandbox to obtain a dynamic execution report includes: Obtain a binary file of malware from at least one malware family; For each binary file, detecting whether the binary file has a packer; If no shell is detected, the binary file is filtered by a static filtering component and then input into a sandbox to obtain a dynamic execution report; If a shell is detected, the binary file is input into the sandbox to determine the corresponding dynamic execution report.

3. The malware family label correction method based on hybrid analysis according to claim 2 is characterized in that: If no shell is detected, the binary file is filtered by the static filtering component and then input into the sandbox to obtain a dynamic execution report, including: If no shell is detected, the binary file is filtered through a static filtering component to determine the corresponding core code; Determining a corresponding hash value according to the core code, and determining an association relationship according to the hash value, wherein the association relationship includes mutually unequal target hash values; The binary file corresponding to the target hash value is input into the sandbox to obtain a dynamic execution report.

4. The malware family label correction method based on hybrid analysis according to claim 3 is characterized in that: The filtering of the binary file through a static filtering component to determine the corresponding core code includes: Determine the original program entry point and file content size of the malware according to the binary file of the malware; The corresponding core code is determined according to the original program entry point and the file content size.

5. The malware family label correction method based on hybrid analysis according to claim 1, characterized in that: The behavioral semantics knowledge base is determined based on the ATT&CK technical matrix and Windows programming documentation.

6. The malware family label correction method based on hybrid analysis according to claim 1, characterized in that: The semantic mapping of the dynamic execution report through a preset behavior semantic knowledge base to obtain a corresponding semantic sequence includes: Determine at least one corresponding quadruple according to at least one dynamic execution report, wherein the quadruple includes a caller name, a called function name, called function parameters, and a return value of the called function; The at least one quadruple is semantically mapped through a preset behavior semantic knowledge base to obtain at least one corresponding semantic sequence.

7. The malware family label correction method based on hybrid analysis according to claim 6 is characterized in that: The semantic mapping of the at least one quadruple by a preset behavior semantic knowledge base to obtain at least one corresponding semantic sequence includes: The at least one quadruple is semantically mapped using a preset behavior semantic knowledge base and preset auxiliary rules to obtain at least one corresponding semantic sequence.

8. The malware family label correction method based on hybrid analysis according to claim 1, characterized in that: The obtaining at least one malware cluster by clustering the semantic sequences by similarity, each malware cluster including at least one semantic sequence, each semantic sequence corresponding to a family label, and if there is inconsistency in the family labels of the malware cluster, determining the malware cluster as an inconsistent cluster includes: After embedding at least one semantic sequence into the vector space, at least one corresponding vector is obtained, and then the at least one vector is clustered by similarity to obtain at least one malware cluster, each malware cluster includes at least one vector, each vector corresponds to a family label, and if there is a label inconsistency in the family label, the malware cluster is determined to be an inconsistent cluster.

9. The malware family label correction method based on hybrid analysis according to claim 8, characterized in that: The embedding of at least one semantic sequence into a vector space comprises: The at least one semantic sequence is embedded into a vector space through a Doc2Vec model.

10. A malware family label correction device based on hybrid analysis, characterized in that: include: A first processing module is used to filter malware in at least one malware family through a static filtering component and then send it to a sandbox to obtain a dynamic execution report; A second processing module is used to perform semantic mapping on the dynamic execution report through a preset behavior semantic knowledge base to obtain a corresponding semantic sequence; A third processing module is used to perform similarity clustering on the semantic sequences to obtain at least one malware cluster, each malware cluster includes at least one semantic sequence, each semantic sequence corresponds to a family label, and if there is inconsistency in the family labels of the malware cluster, the malware cluster is determined to be an inconsistent cluster; a fourth processing module, configured to determine a first distance of the inconsistent clusters, and determine a second distance of each semantic sequence in the inconsistent clusters, and correct the family labels in the inconsistent clusters according to the first distance and the second distance; The fourth processing module is specifically used for: Determining a first distance of the inconsistent cluster, and determining a second distance of each semantic sequence in the inconsistent cluster, and correcting the family label in the inconsistent cluster according to the first distance and the second distance, specifically includes: Determine a first distance based on the malware family to which the vectors in the inconsistent cluster belong; For each vector in the inconsistent cluster, determine a corresponding second distance based on other vectors of the malware family to which the vector belongs; Compare the second distance of each semantic sequence with the first distance. If the second distance of each semantic sequence is less than or equal to the first distance, the family labels in the inconsistent cluster are correct. Determine the family labels in the inconsistent cluster according to the cohesion degree of the family labels in the inconsistent cluster. If the second distance of each semantic sequence is greater than the first distance, the family labels in the inconsistent clusters are incorrect and an exception is thrown; Otherwise, the family label of the semantic sequence corresponding to the second distance greater than the first distance is changed to the family label of the semantic sequence corresponding to the second distance less than the first distance.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the malware family label correction method based on hybrid analysis as described in any one of claims 1 to 9 are implemented.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the malware family label correction method based on hybrid analysis as described in any one of claims 1 to 9 are implemented.

13. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by the processor, the processor implements the steps of the malware family label correction method based on hybrid analysis as described in any one of claims 1 to 9.

Images