Method and system for automatically generating malicious code behavior ontology

Abstract

The application discloses a malicious code behavior ontology automatic generation method and system, obtains an interaction behavior report by analyzing characteristics of malicious code behaviors, proposes a method for extracting behavior features from the behavior report and filtering, proposes a method for mining malicious code behavior knowledge by combining multiple algorithms, uses an association rule mining algorithm to mine the behavior knowledge of a malicious code family on the extracted feature attributes, and proposes an improved method for association rule mining; by proposing the malicious code behavior knowledge mining method combining a single algorithm and multiple algorithms, complementation is formed among the multiple algorithms, and the rules obtained by mining are more comprehensive in coverage; a malicious code ontology class hierarchy structure and a rule representation method in the ontology are established, a method for setting a score for the rules to enhance the expression capability of the ontology is proposed, and a complete process for automatically generating the malicious code behavior ontology is established; meanwhile, a process for detecting malicious codes by using the ontology is provided.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a method and system for automatically generating a malicious code behavior ontology for malicious code detection. Background Technology

[0002] The concept of ontology originates from philosophy. In applied fields, it is generally defined as a "formal specification of a shared conceptual model," meaning an ontology describes a model of concepts in a specific domain of the real world and the relationships between those concepts. Ontologies have significant applications in semantic web, knowledge engineering, and other fields. In the field of information security, their application is primarily in intrusion detection, with less research and application in malware analysis. Inspired by fuzzy ontology research in other fields, Huang HD et al. designed a malware analysis ontology based on first-class fuzzy set theory. Since the OWL language does not natively support the concept of fuzzy ontology, FML was introduced into their ontology. Later, they upgraded their ontology to be based on second-class fuzzy set theory, improving its expressive power. Besides constructing a malware analysis ontology, they also applied it to their TWMAN, TWMAN+, and MiT series malware analysis systems. Grégio A et al., based on a detailed analysis and summary of six major categories of malicious code behavior and their respective subcategories, proposed the structure of a malicious code behavior ontology. They then enriched the actual content of this ontology, defining several suspicious behaviors and their corresponding risk coefficients, which are used to infer and judge malicious code. Notably, the authors provided a very detailed analysis of some phenomena and possible causes of suspicious malicious code behavior, many of which are helpful for understanding and analyzing malicious code behavior. Obrst L et al. cited the diamond model of malicious code behavior, analyzed the meaning of the four vertices of the model, and presented a structure for a network security ontology. Mundie DA et al. combined expert knowledge and web retrieval methods to construct a dictionary belonging to the field of malicious code analysis, incorporating these concepts into the ontology. Shoaib M et al. proposed an ontology that models user interests to detect spam, using Naive Bayes and decision tree algorithms for classification. Syed Z et al. absorbed ontologs from other researchers, constructing an information security ontology covering many related concepts. Wang P et al. used an ontology combined with dynamic and static features to detect mobile phone malware.

[0003] Most existing malware domain ontologies model knowledge using manually defined rule sets. Much of this research focuses on constructing a reasonable malware ontology structure, with only a few creating ontologies usable for malware detection. Furthermore, most of these ontologies only conduct experiments on specific types of malware. For example, Huang HD's fuzzy ontology only experimented on a class called APT (Advanced Persistent Threat), and Grégio A's ontology defined only 42 rules to test the feasibility of his method. These ontology construction methods relying on manually defined rules are largely limited by scalability constraints.

[0004] Currently, static analysis-based malware detection methods are easily rendered ineffective by code obfuscation techniques. Dynamic analysis-based methods, by analyzing program behavior during runtime to capture its true intent, effectively avoid this problem. Using ontology to model the dynamic behavior of malware and applying it for malware detection not only has promising application prospects but also helps in understanding the changing trends of malware. Currently, the construction of malware ontology mainly relies on manual construction, which cannot be automated or efficiently built, thus limiting its scalability and practicality. Summary of the Invention

[0005] To address the aforementioned problems, this invention proposes an automatic generation method and system for malicious code behavior ontology. This method uses data mining algorithms to mine knowledge of malicious code behavior, then uses ontology language to describe the behavioral knowledge, and automatically generates a malicious code behavior ontology for malicious code detection.

[0006] In a first aspect, the present invention provides a method for automatically generating a malicious code behavior ontology, the method comprising the following steps:

[0007] The training set sample programs are run in a virtual machine environment system, and interactive behavior information of the running sample programs is collected and a behavior report is generated according to the format requirements.

[0008] Feature extraction is performed on the behavior reports, and the extracted features are then filtered to obtain the feature set of the program samples;

[0009] A malicious code behavior mining algorithm is used to mine the behavioral features of malicious code in the feature set, and the behavioral features are written into the ontology as malicious code behavior knowledge to construct a malicious code behavior ontology.

[0010] Furthermore, the modeling of malicious code categories in the malicious code behavior ontology is designed based on a hierarchical structure of malicious code categories. In the triples used to describe the characteristics of the malicious code behavior, the subject is the malicious code family category / instance, the object is the virtual machine environment system resource, and the predicate consists of the operation subject type / individual and the operation object type / individual.

[0011] Furthermore, the step of extracting features from the behavior report and processing and filtering the extracted features to obtain a feature set of the program sample specifically includes the following steps:

[0012] The original feature set is composed of file and registry operations, DLL module calls, and API calls extracted from the behavior report;

[0013] The original feature set is filtered to remove special characters from the feature names, resulting in the first feature set.

[0014] The second feature set is formed by expanding the paths of the file and registry operation features in the first feature set.

[0015] The feature set of the program sample is obtained by filtering the second feature set.

[0016] Furthermore, when extracting features from the behavior report, for DLL module calls / API calls, if a DLL module call / API call is recorded in the behavior report, the DLL module call value / API call value in the corresponding column of the feature attribute is TRUE; if no DLL module call / API call is recorded in the behavior report, the DLL module call value / API call value in the corresponding column of the feature attribute is FALSE. For file and registry operations, if the program sample operates on a file under a specific path, the feature attribute takes values ​​for each level of the entire path and then combines them with the operation.

[0017] Furthermore, the feature set of the program sample is obtained by filtering the second feature set. Specific methods include:

[0018] The filtering is performed based on the frequency of features appearing in the second feature set. An upper and lower threshold frequency range is set, and only features appearing within the frequency range are retained.

[0019] Furthermore, the malicious code behavior mining algorithm includes a malicious code behavior mining algorithm based on random cyclic association rule mining, and the algorithm specifically includes:

[0020] S01. Set the number of cyclic digging cycles T, with the initial value of the number of digging cycles i = 1;

[0021] S02. Randomly select P feature attributes from the feature set to generate a dataset;

[0022] S03. Perform rule mining on the dataset to obtain a rule set. If the rule set is not empty, execute S04 and S05. If the rule set is empty, execute S06.

[0023] S04. Match the antecedent of the rule set with the dataset. If there are data features in the dataset that can be covered by the antecedent of the rule set, remove the data from the dataset and record the number of removed data k. Return the remaining dataset to S03. Here, the antecedent of the rule set represents the features of the elements in the rule set.

[0024] S05. Calculate the score of each element in the rule set and add the rule set to the malicious code behavior rule set. score = w i *conf*log(k+1), where w i w represents the weighting coefficient in the i-th round of mining. i =w i-1 / α, ω0 are the initial weights of the rule, α is the weight decay factor, and conf is the rule confidence;

[0025] S06. Execute i = i + 1. If i is less than T, return to S02. If i is greater than or equal to T, end the loop.

[0026] Furthermore, the malicious code behavior mining algorithm includes a malicious code behavior mining algorithm that combines decision tree and circular association rule mining, and the algorithm specifically includes:

[0027] S01. Set the number of cyclic digging cycles T, with the initial value of the number of digging cycles i = 1;

[0028] S02. Initialize the first malicious code behavior rule set to an empty set, and randomly select P feature attributes from the feature set to generate a dataset;

[0029] S03. Perform decision tree rule mining on the dataset to obtain the first decision tree rule set;

[0030] S04. Perform cyclic association rule mining on the dataset to obtain a cyclic association rule set. If the cyclic association rule set is not empty, execute S05 and S06. If the cyclic association rule set is empty, retain the dataset and execute S07.

[0031] S05. Match the antecedent of the cyclic association rule set with the dataset. If the features of data in the dataset can be covered by the antecedent of the cyclic association rule set or the elements in the cyclic association rule set, then remove the data from the dataset and record the number of removed data k. The remaining dataset is returned to S04. Here, the antecedent of the cyclic association rule set represents the features of the elements in the cyclic association set.

[0032] S06. Calculate the score of each element in the cycle association rule set and add the cycle association rule set to the first malicious code behavior rule set, score = w i *conf*log(k+1), where w i w represents the weighting coefficient in the i-th round of mining. i =w i-1 / α, ω0 are the initial weights of the rule, α is the weight decay factor, and conf is the rule confidence;

[0033] S07. If the first malicious code behavior rule set is not empty, execute S08 and S09. If the first malicious code behavior rule set is empty, execute S10.

[0034] S08. Perform decision tree rule mining on the dataset to obtain the second decision tree rule set, calculate the score of each element in the second decision tree rule set, and put the second decision tree rule set into the first malicious code behavior rule set;

[0035] S09. Place the first decision tree rule set and the first malicious code behavior rule set into the malicious code behavior rule set set;

[0036] S10. Execute i = i + 1. If i is less than T, return to S02. If i is greater than or equal to T, end the loop.

[0037] Furthermore, the behavioral features are written into the ontology as malicious code behavior knowledge in the following ways: a single behavioral feature is represented by a single triple or a composite behavioral feature composed of multiple behaviors is defined by using a set structure defined in the OWL language.

[0038] A second aspect of the present invention provides a method for detecting malicious code using the malicious code behavior ontology generated above, the method comprising the following steps:

[0039] Both the malicious code behavior ontology and the file containing the behavior features of unknown samples are input into the ontology inference engine, wherein the sample program in the malicious code behavior ontology generates an inference engine instance in the ontology inference engine.

[0040] The ontology inference engine constructs a new graph model based on the inference engine instance and the unknown sample, and the graph model includes the inferred behavior rules of the unknown sample.

[0041] After obtaining the rule set of the unknown sample through querying, the score of the unknown sample belonging to each family is calculated by statistically analyzing the scores contained in the elements of the rule set. The family corresponding to the highest score is selected as the family affiliation prediction for the unknown sample.

[0042] A third aspect of the present invention provides an automatic malicious code behavior ontology generation system, comprising:

[0043] The behavior report generation module is used to run the training set sample program in a virtual machine environment system, collect interactive behavior information of the running sample program, and generate a behavior report according to the format requirements.

[0044] The feature set acquisition module is used to extract features from the behavior report and filter the extracted features to obtain the feature set of the program sample.

[0045] The ontology generation module is used to mine the behavioral features of malicious code in the feature set using a malicious code behavior mining algorithm, and write the behavioral features as malicious code behavior knowledge into the ontology to construct a malicious code behavior ontology.

[0046] This invention provides a method and system for automatically generating a malicious code behavior ontology, as well as a method for detecting malicious code using the generated malicious code behavior ontology. By extracting dynamic behavioral features of malicious code, constructing mining algorithms, and applying ontology-related theories, a method for automatically generating a malicious code behavior ontology combining multiple algorithms is proposed, and corresponding detection and verification are performed. The main beneficial effects of this invention are:

[0047] (1) A method for extracting dynamic behavior features of malicious code was established. By analyzing the characteristics of malicious code behavior, and based on the typical behaviors and characteristics of different types of malicious code, a dynamic behavior analysis tool was used to obtain system interaction behavior reports. A method for extracting behavioral features from the behavior reports and filtering the features was proposed. The obtained features were used as input data for subsequent behavior rule mining.

[0048] (2) A method combining multiple algorithms to mine malicious code behavior knowledge is proposed. Association rule mining is used to mine malicious code family behavior knowledge based on extracted feature attributes. To address problems encountered during the process, an improved method for association rule mining is proposed and successfully applied to behavior knowledge mining. Simultaneously, based on the methods for mining malicious code behavior knowledge using a single algorithm, a method combining multiple algorithms is specifically proposed. These algorithms complement each other, resulting in more comprehensive rule coverage. Furthermore, an ensemble method using multiple rule sets for classification is also proposed.

[0049] (3) A hierarchical model of malicious code ontology classes and a method for representing malicious code behavior rules in the ontology were established. A method for assigning scores to rules to enhance the expressive power of the ontology was proposed. Combined with the process of using algorithms to mine behavioral knowledge, a complete process for automatically generating a malicious code behavior ontology was established. At the same time, the process of using ontology reasoning for malicious code analysis and detection was given. Attached Figure Description

[0050] Figure 1 This is a schematic diagram of the method for automatically generating malicious code behavior ontology in an embodiment of the present invention;

[0051] Figure 2 This is a schematic diagram of the hierarchical relationship of classes in the malicious code behavior ontology designed in this embodiment of the invention;

[0052] Figure 3 This is a schematic diagram of the domain-adaptive aspect term extraction system based on syntactic structure in an embodiment of the present invention;

[0053] Figure 4 This is a schematic diagram illustrating the representation of a single behavior in the ontology in an embodiment of the present invention;

[0054] Figure 5 This is a schematic diagram illustrating how the intersection of behaviors is represented in the ontology in an embodiment of the present invention.

[0055] Figure 6 This is another schematic diagram illustrating the representation of behavioral intersection in the ontology in an embodiment of the present invention.

[0056] Figure 7 This is a schematic diagram of a malicious code detection method using an ontology generated by an automatic ontology generation method in an embodiment of the present invention;

[0057] Figure 8 This is the logical representation of the features shown in Table 1 in the embodiments of the present invention in RDF;

[0058] Figure 9 This is a schematic diagram of the structure of the automatic generation system for malicious code behavior ontology in an embodiment of the present invention. Detailed Implementation

[0059] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the drawings, not the entire structure.

[0060] Before discussing the exemplary embodiments in more detail, it should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the steps as sequential processes, many of these steps can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the steps can be rearranged. The process can be terminated when its operation is complete, but may also have additional steps not included in the figures. The process can correspond to a method, function, procedure, subroutine, subroutine, etc.

[0061] Furthermore, the terms "first," "second," etc., may be used herein to describe various directions, actions, steps, or elements, but these directions, actions, steps, or elements are not limited by these terms. These terms are only used to distinguish a first direction, action, step, or element from another direction, action, step, or element. For example, without departing from the scope of this application, a first set of features may be referred to as a second set of features, and similarly, a second set of features may be referred to as a first set of features. Both the first set of features and the second set of features are sets of features, but they are not the same set of features. The terms "first," "second," etc., should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0062] This invention provides a method and system for automatically generating a malicious code behavior ontology, and a method for detecting malicious code using the generated malicious code behavior ontology, as follows:

[0063] Based on Embodiment 1 of the present invention

[0064] This embodiment illustrates a method for automatically generating a malicious code behavior ontology. This method uses data mining algorithms to mine knowledge about malicious code behavior, and then uses an ontology language to describe the behavioral knowledge, thereby automatically generating a malicious code behavior ontology. This embodiment focuses on introducing the structural design of the malicious code behavior ontology.

[0065] This embodiment describes an automatic generation method for malicious code behavior ontology, such as... Figure 1 As shown, it includes the following steps:

[0066] S100. Run the training set sample program in a virtual machine environment system, collect interactive behavior information of the running sample program, and generate a behavior report according to the format requirements.

[0067] S200. Extract features from the behavior report, and then filter the extracted features to obtain a feature set of the program sample;

[0068] S300. Utilize a malicious code behavior mining algorithm to mine the behavioral features of malicious code in the feature set, and write the behavioral features as malicious code behavior knowledge into the ontology to construct a malicious code behavior ontology.

[0069] Preferably, the specific implementation steps of S100 are as follows: A training set program sample runs in a virtual machine environment equipped with Cuckoo Sandbox. The host, acting as a server, collects interactive behavior information of the program sample running on the client side and generates a corresponding behavior report according to the required format. The behavior report includes information such as API calls, DLL module calls, registry and file operations, and network communication records executed during the program sample's execution. Existing research on malicious code analysis has shown that this information is an effective behavioral characteristic for identifying malicious code.

[0070] Preferably, after obtaining the behavior report, feature extraction is performed on the behavior report. In S200, in addition to extracting the relevant behavior information, the extracted results are also processed and filtered, and the output results are used as the feature set of the program sample to form a data set for further analysis.

[0071] In traditional ontology construction methods, the rule set in the ontology knowledge base is generally defined by domain experts based on their professional knowledge. The knowledge contained within is largely derived from extensive and in-depth research, and therefore possesses high authority. However, due to the long time and significant investment required for such in-depth research, the update speed of the resulting knowledge base often struggles to keep pace with the rapidly changing field, much like how traditional malware detection methods based on manually written signatures cannot keep up with the rapid evolution of malware. Therefore, this invention, S300, uses algorithms to mine knowledge from data and automatically generate an ontology knowledge base.

[0072] Furthermore, the modeling of malicious code categories in the malicious code behavior ontology is designed based on the malicious code category hierarchy. In the triple used to describe the characteristics of the malicious code behavior, the subject is the malicious code family category / instance, the object is the virtual machine environment system resource, and the predicate is the operation subject type / individual and the operation object type / individual.

[0073] Preferably, in the W3C recommendation standard OWL, the syntax for representing ontologies is standardized, and concept classes and relations can be represented using a fixed syntax. However, there are various ways to represent relationships between real-world concepts in an ontology. For example, the name of a registry key can be used as a data property of the registry, or it can be used as an independent type and represented by an object property to indicate the relationship between the two. A more rationally designed structure will help the ontology more accurately and efficiently describe real-world concepts and model relations. Drawing on experience from research on ontology design and construction, and based on an understanding of some relevant concepts and knowledge in the domain, this invention adopts the following design for the structure of the malicious code behavior ontology:

[0074] The hierarchical design of conceptual classes in ontology generally follows the type relationships in the real world, establishing the conceptual hierarchy according to the subordinate relationships between classes in the real world. This invention models malicious code categories in the ontology based on a hierarchical design of malicious code categories.

[0075] Modeling system resources as objects of triples is relatively simple and consistent, with APIs, DLL modules, system calls, files, registry, process information, etc., all serving as subclasses of operating system objects.

[0076] For the predicate relation in a triple, different operations correspond to different types. That is, each operation corresponds to an object attribute. The domain of the object attribute corresponds to the type or instance of the subject of this operation, i.e., the type or individual of malicious code. The range corresponds to the type or instance of the object of this operation, i.e., the type or individual of the operating system object.

[0077] Based on the above description of each part of the triplet, this embodiment designs as follows: Figure 2 The class hierarchy of the ontology is shown, with Thing serving as the parent object of all objects in the ontology.

[0078] exist Figure 2 The conceptual class hierarchy only represents the structural hierarchy of classes. During the processing of the malicious code training set, many corresponding instances of conceptual classes are extracted. These instances are then added to their respective categories, forming an `instanceOf` relationship with each category. The object property `Operation` is an abstract type for all malicious code operations. Each of its sub-properties represents a specific operation of the malicious code. For example, `CreateFile` represents the operation of creating a file. In its specific definition, its domain is `Malware`, indicating that the `CreateFile` operation is initiated and executed by a `Malware`, and its value domain is `File`, indicating that the object of this operation is a file in the system. The definitions of other object property types are similar.

[0079] Based on Embodiment 2 of the present invention

[0080] Based on Example 1, this embodiment focuses on introducing a method for mining the rule set of the ontology knowledge base. The existing process of manually generating ontology knowledge bases has the disadvantages of high cost and slow speed. Therefore, this application proposes a method for mining a knowledge base of malicious code family behaviors. The knowledge set mined by this method is written into the ontology to complete the construction of the malicious code behavior ontology.

[0081] For the constructed malware behavior ontology to effectively encompass the behavioral characteristics of malware families and be used for detecting unknown samples, its rule set needs to truly represent the correlation between malware behavior and families, directly determining the quality of the constructed ontology. Therefore, the process of mining the rule set becomes a crucial point in the automatic ontology generation process, with feature extraction and mining algorithms being key to the mined results.

[0082] Based on S200 in Embodiment 1, feature extraction is performed on the behavior report, and the extracted features are then filtered to obtain a feature set of the program sample. Preferably, feature extraction is performed on the behavior report, and the extracted features are processed and filtered to obtain a feature set of the program sample, specifically as follows: Figure 3 As shown, it includes the following steps:

[0083] S201. Extract the original feature set from the file and registry operations, DLL module calls, and API calls in the behavior report;

[0084] S202. Filter the original feature set to remove special characters from the feature names and form the first feature set.

[0085] S203. Expand the paths of the file and registry operation features in the first feature set to form the second feature set;

[0086] S204. After filtering the second feature set, the feature set of the program sample is obtained.

[0087] In practice, Cuckoo Sandbox integrates many report formats. The system can be configured to generate the required formats, or custom formats can be generated by writing report templates. Among the formats integrated into Cuckoo Sandbox are many currently popular formats, such as XML, HTML, and JSON. Considering that JSON is highly readable and easy to process, and many open-source tools provide convenient JSON processing interfaces, this embodiment chooses JSON as the report output format.

[0088] Preferably, when performing feature extraction on the behavior report, for DLL module calls / API calls, if a DLL module call / API call is recorded in the behavior report, the DLL module call value / API call value in the corresponding column of the feature attribute is TRUE; if no DLL module call / API call is recorded in the behavior report, the DLL module call value / API call value in the corresponding column of the feature attribute is FALSE.

[0089] Preferably, for file operation information, if a sample performs an operation on a file under a specific path, then the feature attributes are used to take values ​​for each level of the entire path, and then combined with the operation to form the feature dimension of the sample. For example, if a sample reads the file C:\Windows\regedit.exe, then the corresponding attribute columns READ_C_, READ_C__Windows, and READ_C__Windows_regedi.exe (underscores are used in the implementation to replace colons and backslashes due to their special nature) are TRUE. The rationale behind this approach is that lower-level directories in a file path hierarchy are subsets of higher-level directories. Therefore, accessing two different subdirectories under the same directory may have the same purpose. For example, deleting binary file information in a software installation directory and deleting configuration files in the same directory are both destructive behaviors against the software. Furthermore, malicious code often modifies its own binary file to dynamically change itself, or deletes its own binary file to achieve self-hiding. Therefore, if the file name is the same as its own name, then the value of "Operation Type_self" in the feature attributes is TRUE.

[0090] For registry operation information, a similar processing method as for file operation information was adopted, taking values ​​for multi-level paths and combining operation types for extraction.

[0091] Furthermore, in the process of feature extraction, some malicious code programs use many special characters. Since these special characters often have no specific meaning and are mostly isolated cases, they are difficult to be used as characteristic behaviors of a family. Therefore, this application filters them during processing. In addition, when processing feature names, this application replaces some special characters (such as commas, colons, forward slashes, backslashes, quotation marks, etc.) with underscores to avoid confusion and errors when writing to the feature set file or ontology file.

[0092] In a specific example, a sample named example.exe called the API function DnsQuery_W, read the file C:\Windows\regedit.exe, deleted the file C:\example.exe, changed the value of the registry key HKEY_CURRENT_USER\Software\Aasppapmmxkvs\A1_861, but did not call the API function CreateServiceA. The corresponding characteristic attributes of this sample are shown in Table 1:

[0093] Table 1 Examples of Feature Processing Methods

[0094]

[0095]

[0096] Preferably, the feature set of the program sample is obtained by filtering the second feature set. Specific methods include:

[0097] The filtering is performed based on the frequency of features appearing in the second feature set. An upper and lower threshold frequency range is set, and only features appearing within the frequency range are retained.

[0098] In practical implementation, due to the large dimensionality of the original feature set, features are filtered during actual mining to reduce feature dimensionality and increase efficiency. The goal of this invention in mining malicious code family behavior features is to obtain an interpretable feature set; therefore, feature transformation algorithms such as PCA, which project features into a new space to obtain new feature representations, are not applicable. Therefore, this invention filters features based on their frequency of occurrence, setting an upper and lower threshold range [f...]. min ,f max Only when the frequency f appears attr ∈[f min ,f max The features of [ ] are preserved and used as the feature set for subsequent input into the mining algorithm. The formula for calculating feature frequency is:

[0099] f attr =n attr / n

[0100] Where n attr This represents the number of samples where the feature `attr` is TRUE, and `n` represents the total number of samples. This approach targets features with very low frequency, which are likely present in only a very small number of samples and unlikely to be common behavioral features of a code family; while features with very high frequency are likely to appear in most malicious code families, resulting in poor ability to distinguish the family to which unknown samples belong. Therefore, this patent selects the frequency filtering range parameter [f...]. min ,f max Choosing a very small value for the value of ] results in fewer feature attributes, which is more conducive to rule mining.

[0101] Based on Embodiment 3 of the present invention

[0102] This embodiment, based on Embodiments 1 and 2, mainly introduces S300 and the use of a malicious code behavior mining algorithm to mine the behavioral features of malicious code in the feature set. Since the mining rules need to be interpretable, the applicable algorithms should not have feature transformation properties. Therefore, this invention mainly uses the following algorithms for rule mining:

[0103] (1) Using decision tree algorithm to mine rules

[0104] Decision tree algorithms build classification models by learning to construct a tree structure from data. Each node in the tree structure is a data partitioning node. Data with different attribute values ​​descend from the root node to the leaf nodes along different paths. The class label in each leaf node represents the classification result. During training, the attribute selection for each intermediate node can be measured by information gain or the Gini index to select the optimal attribute. To prevent overfitting, a pruning process can be incorporated.

[0105] A model built from a decision tree can be naturally converted into rules. On the path from the root node to the leaf node, each split node serves as a predecessor of the rule, and the class label of the leaf node serves as the result of the rule, thus obtaining a set of rules equivalent to the decision tree.

[0106] (2) Improved association rule mining algorithm for rule mining

[0107] Association rule mining is a highly effective algorithm for extracting rule information. It has many classic applications in data mining, such as market analysis, and is constantly being evolved and improved to handle more problems. Association rule mining mainly consists of two steps: frequent itemset generation and rule generation. Each step sets support and confidence thresholds as criteria for judging the output results. Support ensures that frequent itemsets appear frequently enough in the dataset, while confidence ensures that the association rules in the output are strongly related to their premises, i.e., the rules are reliable.

[0108] Association rule mining is an algorithm for mining general relationships between attributes, also known as object-oriented association mining (OOA). In the process of association rule mining, OOA specifies the class label of the data as the result attribute column of the association rule, and can introduce some measures as the utility of the rule as an additional measure for filtering the rule.

[0109] This invention uses Out-of-Action (OOA) to mine rule sets for the behavior of malicious code families. Because some families' sample sets exhibit very obvious common characteristics, while the characteristics of other families' samples are not obvious, the rules generated during association rule mining often concentrate on families with obvious characteristics. Families with indistinct characteristics are always covered by the feature sets of other families, making it impossible to mine rule information. Furthermore, because some feature dimensions have high correlation, the size of frequent itemsets during the mining process is very large, often exhausting memory during the loop of generating frequent itemsets and reporting heap memory overflow errors.

[0110] To reduce the dimensionality of data attributes input to the OOA association rule mining algorithm, this invention adopts a method similar to that in the random forest algorithm, that is, the dataset is mined multiple times, and each mining process randomly selects a certain number of P feature attributes from the dataset and inputs them into the mining algorithm. The selection of the value P is determined by observing the algorithm's operation during the actual mining process, and the criterion is that no memory space overflow error occurs in multiple runs.

[0111] Furthermore, in each specific mining process, since the actual discovery of a rule mining operation often only yields a rule set containing one or two families, this invention designs a cyclic association rule mining algorithm to mine rules. In each round of the cyclic association rule mining, the maximum number of rules mined is limited to N. rule After completing one round, the antecedents of the obtained rule set are matched with the dataset. If the features of a data point can be covered by the antecedents of the rule set, the data point is removed from the dataset, and the remaining data enters the next round of mining.

[0112] In the rule set obtained through this cyclic mining, the rules obtained in the i-th round will not cover subsequent datasets, while the rules obtained in the (i+1), (i+2), ... rounds may cover data records cleared in the i-th round and earlier. This means that rules mined earlier should be given higher priority. Furthermore, each mined rule has a confidence level, representing its priority. Based on these properties, this invention uses a score for the rules obtained through cyclic mining as a measure of the reference value of association rules. This not only solves the rule coverage problem but also avoids the insufficient expressive power of deterministic rules, enhancing the modeling ability of the generated ontology to real-world phenomena. First, a value that decreases with the number of mining cycles is set as the weight coefficient of the rules mined in each round, i.e., the weight coefficient w in the i-th round of mining. i Set to w i =w i-1 / α, and simultaneously combining the confidence score (conf) of the mined rules and the number of covered data points (k), calculate the score of the rule. The calculation method is as follows:

[0113] score = w i *conf*log(k+1)

[0114] Setting w during the cyclic mining process iThe reasons for continuously decreasing support and combining it with the conf value are as described above: rules mined earlier have higher credibility, and confidence itself is a measure of rule credibility; the 1 in log(k+1) is to ensure the result is always greater than 0. Including this as a factor considers that when the number of samples covered by the rule's antecedents is small, the rule's confidence may be high, but the number of data points in the overall dataset that match the rule is not large. Taking the logarithm smooths the trend of the logarithmic value, so that increasing the k value has a smaller impact on the score after the k value reaches a large value. The reason for not directly using support as a factor here is that the number of data points in the dataset changes during each round of mining.

[0115] In summary, the malicious code behavior mining algorithm based on random cyclic association rule mining specifically includes:

[0116] S01. Set the number of cyclic digging cycles T, with the initial value of the number of digging cycles i = 1;

[0117] S02. Randomly select P feature attributes from the feature set to generate a dataset;

[0118] S03. Perform rule mining on the dataset to obtain a rule set. If the rule set is not empty, execute S04 and S05. If the rule set is empty, execute S06.

[0119] S04. Match the antecedents of the rule set with the dataset. If there are data features in the dataset that can be covered by the antecedents of the rule set, remove the data from the dataset and record the number of removed data k. Return the remaining dataset to S03. Here, the antecedents of the rule set represent the features of the elements in the rule set. For example, the form of rule mining is A->B, that is, B is derived from A. A is the antecedent of the rule, and B is the consequent or conclusion of the rule.

[0120] S05. Calculate the score of each element in the rule set and add the rule set to the malicious code behavior rule set. score = w i *conf*log(k+1), where w i w represents the weighting coefficient in the i-th round of mining. i =w i-1 / α, ω0 are the initial weights of the rule, α is the weight decay factor, and conf is the rule confidence;

[0121] S06. Execute i = i + 1. If i is less than T, return to S02. If i is greater than or equal to T, end the loop.

[0122] The specific implementation process is shown in Table 2:

[0123] Table 2. Malicious code behavior mining algorithms based on random cyclic association rule mining.

[0124]

[0125]

[0126] As shown in Table 2, the condition in the do-while loop is (RuleSubset is not empty). The reason is that if RuleSubset is empty, it means that no new rules have been obtained in the current mining process, and therefore no data rows have been deleted from the dataset. If the next loop is still entered, the Apriori algorithm will still return an empty rule set under the same input data, causing the entire algorithm to fall into an infinite loop.

[0127] Furthermore, when using WEKA's association rule mining, this invention replaces all items in the feature set whose attribute value is FALSE with the default value, i.e., with a question mark. This is because the object mined in the definition of association rules is an existing attribute. If a sample does not have a certain behavior, and the corresponding attribute value is represented as FALSE, then association rule mining considers the sample to be a counterexample of this behavior, rather than ignoring this behavior, which would deviate from the original meaning.

[0128] (3) Use the random forest algorithm to mine rules

[0129] Because decision tree models are relatively simple and yield very limited rules, random cyclic association rule mining algorithms often tend to generate a large number of easily categorized behavioral rules for certain families, while leaving very few rules for other families. Therefore, this invention also attempts to use random forests to mine rules, aiming to obtain a richer set of malicious code behavior rules.

[0130] Random forest is a classification model based on decision trees. The model enhances its performance by integrating multiple decision trees. Random forest introduces two layers of randomness: randomness in sample extraction and randomness in feature selection. This achieves the effect of cross-validation and avoids the problem of overfitting.

[0131] By constructing a model using random forests and converting all the resulting decision trees into rules, we obtain the rules mined using random forests. Similar to the method described above, each rule is also assigned a score. Since decision trees in random forests are often not pruned, the leaf nodes of the generated decision trees contain 0 negative examples. The score is calculated using only the number of positive examples, k, and logk is used to calculate the score for each rule.

[0132] There is a significant drawback to converting random forests into rules: the number of samples covered by the leaf nodes of each decision tree in a random forest is often very small, resulting in small scores for the converted rules and poor rule representativeness. At the same time, the total number of rules obtained from random forests is enormous, leading to poor rule interpretability.

[0133] (4) Combining decision tree and random cyclic association rule mining algorithms

[0134] While decision tree algorithms are classic, a single decision tree model is too simplistic, yielding limited and incomplete rule information. Furthermore, during rule mining using the random cyclic association rule mining algorithm, it was found that after several iterations, the dataset shrinks, the remaining data's features become less distinct, and the mining process stops, yielding no new rules. Throughout the cycle, the mined rules tend to concentrate on a few families with particularly prominent features, sometimes failing to uncover any rules for any specific family. This means that using this algorithm alone for ontology knowledge base rule mining also results in poor rule coverage, and some family samples will not be correctly identified. Random forests, on the other hand, produce rules with poor representativeness and are difficult to interpret. Considering these three points, this invention combines decision trees and the random cyclic association rule mining algorithm to create an ontology knowledge base that better represents the characteristics of malicious code behavior, while simultaneously enhancing the detection capability of unknown samples. The behavior rule mining process in the ensemble algorithm includes:

[0135] S01. Set the number of cyclic digging cycles T, with the initial value of the number of digging cycles i = 1;

[0136] S02. Initialize the first malicious code behavior rule set to an empty set, and randomly select P feature attributes from the feature set to generate a dataset;

[0137] S03. Perform decision tree rule mining on the dataset to obtain the first decision tree rule set;

[0138] S04. Perform cyclic association rule mining on the dataset to obtain a cyclic association rule set. If the cyclic association rule set is not empty, execute S05 and S06. If the cyclic association rule set is empty, retain the dataset and execute S07.

[0139] S05. Match the antecedent of the cyclic association rule set with the dataset. If there are data features in the dataset that can be covered by the antecedent or elements of the cyclic association rule set, remove the data from the dataset and record the number of removed data k. Return the remaining dataset to S04. Here, the antecedent of the cyclic association rule set represents the features of the elements in the cyclic association set; the conclusion of the cyclic association rule set represents the elements in the cyclic association set. For example, the form of the cyclic association rule is A->B, that is, B is derived from A. A is the antecedent of the rule, and B is the consequent or conclusion of the rule.

[0140] S06. Calculate the score of each element in the cycle association rule set and add the cycle association rule set to the first malicious code behavior rule set, score = w i *conf*log(k+1), where w i w represents the weighting coefficient in the i-th round of mining. i =w i-1 / α, ω0 are the initial weights of the rule, α is the weight decay factor, and conf is the rule confidence;

[0141] S07. If the first malicious code behavior rule set is not empty, execute S08 and S09. If the first malicious code behavior rule set is empty, execute S10.

[0142] S08. Perform decision tree rule mining on the dataset to obtain the second decision tree rule set, calculate the score of each element in the second decision tree rule set, and put the second decision tree rule set into the first malicious code behavior rule set;

[0143] S09. Place the first decision tree rule set and the first malicious code behavior rule set into the malicious code behavior rule set set;

[0144] S10. Execute i = i + 1. If i is less than T, return to S02. If i is greater than or equal to T, end the loop.

[0145] In the malware behavior mining algorithm combining decision trees and cyclic association rule mining, a total of T mining operations are performed. Each mining process randomly selects a certain number of P feature attributes from the dataset as input, outputting a decision tree rule set and a cyclic association rule mining rule set. In the cyclic association rule mining, unlike the malware behavior mining algorithm based on random cyclic association rule mining, each iteration removes data rows that can be completely matched by the rule's antecedent or conclusion. Furthermore, after cyclic mining, the remaining data is used to extract rules using a decision tree as a supplement, to avoid the cyclic association rule mining results containing only partial family rule information. If no rules are found during this process, the mining process restarts to prevent the current mining result from being entirely rules generated by the decision tree. Thus, the improvement on the malware behavior mining algorithm based on random cyclic association rule mining forms an algorithm combining decision trees and random cyclic association rule mining. The specific implementation process of the algorithm combining decision trees and random cyclic association rule mining is shown in Table 3.

[0146] Table 3. Malicious code behavior mining algorithm combining decision tree and circular association rule mining.

[0147]

[0148]

[0149] A malicious code behavior mining algorithm combining decision trees and cyclic association rule mining yielded rule sets from T random decision trees and rule sets from T random cyclic association rules appended to decision trees. The former, compared to the rule set from a single decision tree, is richer and contains more relevant rules with more feature attributes; compared to the rule set from a random forest, it is less large and fragmented. Meanwhile, the latter complements the former, further enriching the resulting rule set. Furthermore, the latter differs significantly from the former, better meeting the requirement of "individual learner diversity" in ensemble algorithms, thus contributing to better ensemble results.

[0150] Based on Embodiment 4 of the present invention

[0151] This embodiment, based on Embodiments 1-3, primarily introduces how to incorporate behavioral characteristics as malicious code behavior knowledge into an ontology. After the algorithm discovers the behavioral rules of malicious code, these rules need to be written into the ontology. These rules can be mainly divided into two types: rules composed of single behaviors and rules composed of composite behaviors. The latter is a superset of the former, so its representation is more complex. This embodiment provides a detailed description of the representation of these two types of rules, illustrating how to represent these rules in the ontology using the OWL language.

[0152] Preferably, the behavior feature is written into the ontology as malicious code behavior knowledge in the following ways: a single behavior feature is represented by a single triple or a composite behavior feature composed of multiple behaviors is defined by using a set structure defined in the OWL language.

[0153] Furthermore, the specific implementation of representing a single behavioral feature through a single triple is as follows: the triple representation of the relationship between concept classes in the ontology makes the representation of a single behavior more direct. The subject of the behavior is the "subject" in the triple, the object is the "object" in the triple, and the type of the behavior is defined as the "predicate" in the triple.

[0154] Rules consisting of a single behavior are represented by a relation between a class or individual and a triple representing that single behavior. For example, the rule "All samples that call the API function DnsQuery_W belong to the Agobot malware family" can be formally represented as follows:

[0155]

[0156] The → symbol indicates the CallAPI behavior. The expression "can be deduced" indicates that the left side of the rule represents the premise, and the right side represents the result. In the ontology, this rule is represented as follows: Figure 4 The form shown corresponds to the description in the OWL language, as shown in Table 4. Here, owl:Restriction represents an anonymous class that has a CallAPI relationship with DnsQuery_W, meaning it calls the API function DnsQuery_W. ExampleClass is equivalent to this anonymous class and is also a subclass of Agobot. Thus, the synthesized relationship expresses the required rules.

[0157] Table 4 Figure 4 Corresponding OWL language description

[0158]

[0159] Furthermore, by using the set structure defined in the OWL language to define composite behavioral features consisting of multiple behaviors, the specific implementation method is as follows:

[0160] A single triple can represent a single behavior, so multiple unrelated behaviors can be represented independently using multiple triples. However, the representation of a composite behavior consisting of multiple related behaviors requires the use of the Collection structure defined in the OWL language. Collection structures include types such as intersection, union, and complement.

[0161] Rules composed of complex behaviors also require the use of set structures. For example, the rule "All samples that call the API function DnsQuery_W and the API function OutputDebugStringA belong to the Agobot malware family" can be formally represented as follows:

[0162]

[0163] In the ontology, this rule is represented as follows: Figure 5 The forms shown are corresponding to the descriptions in the OWL language, as shown in Table 5.

[0164] Table 5 Figure 5 The corresponding OWL language description of the represented behavior

[0165]

[0166] Will Figure 4 Replacing `intersectionOf` with `unionOf` in Table 4 represents the "or" relationship. For the "no" relationship, `complementOf` is used, and by combining the intersection and complement, the "difference" relationship can be obtained. Figure 6 Here's an example of this relationship, representing the rule "All samples that call the API function DnsQuery_W but not the API function OutputDebugStringA belong to the Agobot malware family," which can be formally represented as follows:

[0167]

[0168] Based on Embodiment 5 of the present invention

[0169] This embodiment, based on Embodiments 1-4, mainly introduces a method for malicious code detection and analysis using the ontology generated by the methods in Embodiments 1-4. Figure 7 As shown, the method includes the following steps:

[0170] S701. Input the malicious code behavior ontology and the file containing the behavior features of unknown samples into the ontology inference engine, wherein the sample program in the malicious code behavior ontology generates an inference engine instance in the ontology inference engine.

[0171] S702, The ontology inference engine constructs a new graph model based on the inference engine instance and the unknown sample, the graph model including the inferred behavior rules of the unknown sample;

[0172] S703. After obtaining the rule set of the unknown sample through query, calculate the score of the unknown sample belonging to each family by statistically analyzing the scores contained in the elements in the rule set, and select the family corresponding to the highest score as the family affiliation prediction for the unknown sample.

[0173] In practice, the ontology inference engine uses the Jena inference engine, leveraging the JenaInference API to perform ontology inference and detect and analyze malicious code. To obtain behavioral information from unknown samples, it is also necessary to input them into the Cuckoo Sandbox for feature extraction. The resulting feature vectors are then written to an RDF file, where behavioral information is represented as triples. For example, the logical representation of the feature attributes in the RDF file shown in Table 1 is as follows: Figure 8 The corresponding RDF language representation of the form shown is shown in Table 6, where some rows are omitted.

[0174] Table 6 Figure 8 Corresponding RDF language representation

[0175]

[0176] Furthermore, after obtaining the set of rules that the unknown sample conforms to, the scores contained in these rules are statistically analyzed to calculate the score to which the unknown sample belongs to each family. The family corresponding to the highest score is selected as the prediction of the family affiliation of the unknown sample. The classification result established in this form also serves as one of the evaluation methods for assessing the effectiveness of the automatic ontology generation method proposed in this patent.

[0177] In practice, the rules extracted by the decision tree and the rules mined by the cyclic association rule mining algorithm are complementary, thus helping to build a better family prediction model using an ensemble approach. In this embodiment, for family prediction of unknown samples using multiple rule sets mined from Table 3, the ensemble method described in Table 7 is adopted. Each rule subset in Set<RuleSet> is treated as a separate rule set for inference. The results of each inference are voted on, and the voting results serve as the classification result for the unknown samples.

[0178] Table 7 shows an algorithm that integrates multiple rule sets for classifying unknown samples.

[0179]

[0180]

[0181] Based on Embodiment 6 of the present invention

[0182] This embodiment introduces an automatic malicious code behavior ontology generation system, such as... Figure 9 As shown, it includes:

[0183] The behavior report generation module 901 is used to run the training set sample program in a virtual machine environment system, collect interactive behavior information of the running sample program, and generate a behavior report according to the format requirements.

[0184] The feature set acquisition module 902 is used to extract features from the behavior report and filter the extracted features to obtain the feature set of the program sample.

[0185] The ontology generation module 903 is used to mine the behavioral features of malicious code in the feature set using a malicious code behavior mining algorithm, and write the behavioral features as malicious code behavior knowledge into the ontology to construct a malicious code behavior ontology.

[0186] The specific working process of the malicious code behavior ontology automatic generation system 900 in this embodiment refers to the description of the above-mentioned malicious code behavior ontology automatic generation method embodiments 1-5, and will not be repeated here.

[0187] This invention addresses the above-described method and system for automatically generating malicious code behavior ontology, as well as a method for detecting malicious code using the generated malicious code behavior ontology. By extracting dynamic behavioral features of malicious code, constructing mining algorithms, and applying ontology-related theories, a method for automatically generating malicious code behavior ontology by combining multiple algorithms is proposed, and corresponding detection and verification are performed. The main beneficial effects of this invention are:

[0188] (1) A method for extracting dynamic behavior features of malicious code was established. By analyzing the characteristics of malicious code behavior, and based on the typical behaviors and characteristics of different types of malicious code, a dynamic behavior analysis tool was used to obtain system interaction behavior reports. A method for extracting behavioral features from the behavior reports and filtering the features was proposed. The obtained features were used as input data for subsequent behavior rule mining.

[0189] (2) A method combining multiple algorithms to mine malicious code behavior knowledge is proposed. Association rule mining is used to mine malicious code family behavior knowledge based on extracted feature attributes. To address problems encountered during the process, an improved method for association rule mining is proposed and successfully applied to behavior knowledge mining. Simultaneously, based on the methods for mining malicious code behavior knowledge using a single algorithm, a method combining multiple algorithms is specifically proposed. These algorithms complement each other, resulting in more comprehensive rule coverage. Furthermore, an ensemble method using multiple rule sets for classification is also proposed.

[0190] (3) A hierarchical model of malicious code ontology classes and a method for representing malicious code behavior rules in the ontology were established. A method for assigning scores to rules to enhance the expressive power of the ontology was proposed. Combined with the process of using algorithms to mine behavioral knowledge, a complete process for automatically generating a malicious code behavior ontology was established. At the same time, the process of using ontology reasoning for malicious code analysis and detection was given.

[0191] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A method for automatically generating a malicious code behavior ontology, characterized in that, The method includes the following steps: The training set sample programs are run in a virtual machine environment system, and interactive behavior information of the running sample programs is collected and a behavior report is generated according to the format requirements. Feature extraction is performed on the behavior report, and the extracted features are processed and filtered to obtain the feature set of the program sample; A malicious code behavior mining algorithm is used to mine the behavioral features of malicious code in the feature set, and the behavioral features are written into the ontology as malicious code behavior knowledge to construct a malicious code behavior ontology. The malicious code behavior mining algorithm includes a malicious code behavior mining algorithm that combines decision tree and cyclic association rule mining. The algorithm specifically includes: S01. Set the number of cyclic digging cycles T, with the initial value of the number of digging cycles i = 1; S02. Initialize the first malicious code behavior rule set to an empty set, and randomly select P feature attributes from the feature set to generate a dataset; S03. Perform decision tree rule mining on the dataset to obtain the first decision tree rule set; S04. Perform cyclic association rule mining on the dataset to obtain a cyclic association rule set. If the cyclic association rule set is not empty, execute S05 and S06. If the cyclic association rule set is empty, retain the dataset and execute S07. S05. Match the antecedent of the cyclic association rule set with the dataset. If the features of data in the dataset can be covered by the antecedent of the cyclic association rule set or the elements in the cyclic association rule set, then remove the data from the dataset and record the number of removed data k. The remaining dataset is returned to S04. Here, the antecedent of the cyclic association rule set represents the features of the elements in the cyclic association set. S06. Calculate the score of each element in the cycle association rule set and add the cycle association rule set to the first malicious code behavior rule set, score = w i *conf*log(k+1), where w i w represents the weighting coefficient in the i-th round of mining. i =w i-1 / α, ω0 are the initial weights of the rule, α is the weight decay factor, and conf is the rule confidence; S07. If the first malicious code behavior rule set is not empty, execute S08 and S09. If the first malicious code behavior rule set is empty, execute S10. S08. Perform decision tree rule mining on the dataset to obtain the second decision tree rule set, calculate the score of each element in the second decision tree rule set, and put the second decision tree rule set into the first malicious code behavior rule set; S09. Place the first decision tree rule set and the first malicious code behavior rule set into the malicious code behavior rule set set; S10. Execute i = i + 1. If i is less than T, return to S02. If i is greater than or equal to T, end the loop.

2. The method for automatically generating malicious code behavior ontology according to claim 1, characterized in that, The modeling of malicious code categories in the malicious code behavior ontology is designed based on the malicious code category hierarchy. In the triple used to describe the characteristics of the malicious code behavior, the subject is the malicious code family category / instance, the object is the virtual machine environment system resource, and the predicate is the operation subject type / individual and the operation object type / individual.

3. The method for automatically generating malicious code behavior ontology according to claim 1, characterized in that, The process of extracting features from the behavior report, and then processing and filtering the extracted features to obtain a feature set of the program sample, specifically includes the following steps: The original feature set is composed of file and registry operations, DLL module calls, and API calls extracted from the behavior report; The original feature set is filtered to remove special characters from the feature names, resulting in the first feature set. The second feature set is formed by expanding the paths of the file and registry operation features in the first feature set. The feature set of the program sample is obtained by filtering the second feature set.

4. The method for automatically generating malicious code behavior ontology according to claim 3, characterized in that, When performing feature extraction on behavior reports, for DLL module calls / API calls, if a DLL module call / API call is recorded in the behavior report, the DLL module call value / API call value in the corresponding column of the feature attribute is TRUE; if no DLL module call / API call is recorded in the behavior report, the DLL module call value / API call value in the corresponding column of the feature attribute is FALSE. For file and registry operations, if the program sample operates on a file under a specific path, the value of each level of the entire path is taken in the feature attribute, and then combined with the operation respectively.

5. The method for automatically generating malicious code behavior ontology according to claim 3, characterized in that, The feature set of the program sample is obtained by filtering the second feature set. Specific methods include: The filtering is performed based on the frequency of features appearing in the second feature set. An upper and lower threshold frequency range is set, and only features appearing within the frequency range are retained.

6. The method for automatically generating malicious code behavior ontology according to claim 1, characterized in that, The malicious code behavior mining algorithm includes a malicious code behavior mining algorithm based on random cyclic association rules, and the algorithm specifically includes: S01. Set the number of cyclic digging cycles T, with the initial value of the number of digging cycles i = 1; S02. Randomly select P feature attributes from the feature set to generate a dataset; S03. Perform rule mining on the dataset to obtain a rule set. If the rule set is not empty, execute S04 and S05. If the rule set is empty, execute S06. S04. Match the antecedent of the rule set with the dataset. If there are data features in the dataset that can be covered by the antecedent of the rule set, remove the data from the dataset and record the number of removed data k. Return the remaining dataset to S03. Here, the antecedent of the rule set represents the features of the elements in the rule set. S05. Calculate the score of each element in the rule set and add the rule set to the malicious code behavior rule set. score = w i *conf*log(k+1), where w i w represents the weighting coefficient in the i-th round of mining. i =w i-1 / α, ω0 are the initial weights of the rule, α is the weight decay factor, and conf is the rule confidence; S06. Execute i = i + 1. If i is less than T, return to S02. If i is greater than or equal to T, end the loop.

7. The method for automatically generating malicious code behavior ontology according to claim 2, characterized in that, The behavior features are written into the ontology as malicious code behavior knowledge in the following ways: a single behavior feature is represented by a single triple, or a composite behavior feature composed of multiple behaviors is defined by using the set structure defined in the OWL language.

8. A method for detecting malicious code using a malicious code behavior ontology generated according to any one of claims 1-7, characterized in that, The method includes the following steps: Both the malicious code behavior ontology and the file containing the behavior features of unknown samples are input into the ontology inference engine, wherein the sample program in the malicious code behavior ontology generates an inference engine instance in the ontology inference engine. The ontology inference engine constructs a new graph model based on the inference engine instance and the unknown sample, and the graph model includes the inferred behavior rules of the unknown sample. After obtaining the rule set of the unknown sample through querying, the score of the unknown sample belonging to each family is calculated by statistically analyzing the scores contained in the elements of the rule set. The family corresponding to the highest score is selected as the family affiliation prediction for the unknown sample.

9. A malicious code behavior ontology automatic generation system, characterized in that, include: The behavior report generation module is used to run the training set sample program in a virtual machine environment system, collect interactive behavior information of the running sample program, and generate a behavior report according to the format requirements. The feature set acquisition module is used to extract features from the behavior report and filter the extracted features to obtain the feature set of the program sample. The ontology generation module is used to mine the behavioral features of malicious code in the feature set using a malicious code behavior mining algorithm, and write the behavioral features as malicious code behavior knowledge into the ontology to construct a malicious code behavior ontology. The malicious code behavior mining algorithm includes a malicious code behavior mining algorithm that combines decision tree and cyclic association rule mining. The algorithm specifically includes: S01. Set the number of cyclic digging cycles T, with the initial value of the number of digging cycles i = 1; S02. Initialize the first malicious code behavior rule set to an empty set, and randomly select P feature attributes from the feature set to generate a dataset; S03. Perform decision tree rule mining on the dataset to obtain the first decision tree rule set; S04. Perform cyclic association rule mining on the dataset to obtain a cyclic association rule set. If the cyclic association rule set is not empty, execute S05 and S06. If the cyclic association rule set is empty, retain the dataset and execute S07. S05. Match the antecedent of the cyclic association rule set with the dataset. If the features of data in the dataset can be covered by the antecedent of the cyclic association rule set or the elements in the cyclic association rule set, then remove the data from the dataset and record the number of removed data k. The remaining dataset is returned to S04. Here, the antecedent of the cyclic association rule set represents the features of the elements in the cyclic association set. S06. Calculate the score of each element in the cycle association rule set and add the cycle association rule set to the first malicious code behavior rule set, score = w i *conf*log(k+1), where w i w represents the weighting coefficient in the i-th round of mining. i =w i-1 / α, ω0 are the initial weights of the rule, α is the weight decay factor, and conf is the rule confidence; S07. If the first malicious code behavior rule set is not empty, execute S08 and S09. If the first malicious code behavior rule set is empty, execute S10. S08. Perform decision tree rule mining on the dataset to obtain the second decision tree rule set, calculate the score of each element in the second decision tree rule set, and put the second decision tree rule set into the first malicious code behavior rule set; S09. Place the first decision tree rule set and the first malicious code behavior rule set into the malicious code behavior rule set set; S10. Execute i = i + 1. If i is less than T, return to S02. If i is greater than or equal to T, end the loop.

Images