A malware detection method based on API semantic parsing

Abstract

This invention discloses a malware detection method based on API semantic parsing, comprising: learning the representation vector of each API based on API call sequence samples; segmenting the API name into words and calculating the representation vector of each word; constructing an API graph with APIs and words as nodes based on API names and word sets; updating the representation vectors of all nodes using a graph convolutional neural network; acquiring API call sequence samples; transforming the API call sequence samples into representation vector sequence samples based on the representation vectors of each API node in the API graph; training an LSTM network using the labeled representation vector sequence samples to obtain a recognition model; for real-time API call sequences to be identified, transforming them into real-time representation vector sequences using the API graph; and inputting the real-time representation vector sequences into the recognition model to obtain malware detection results. This invention effectively improves the ability to detect malware.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of machine learning and information security, and particularly relates to a malware detection method based on API semantic parsing. BACKGROUND

[0002] Malware refers to any software used to harm computers, servers or computer networks. Malware includes viruses, worms, Trojans, ransomware and other forms. Malware is a serious problem that threatens personal, enterprise and national information security. Compared with traditional network threats, malware has the characteristics of multiple variants, rapid updates and high concealment. Therefore, how to effectively detect malware is an important research topic in the field of information security.

[0003] Existing malware detection methods are mainly divided into static detection and dynamic detection. Static detection achieves detection by analyzing the features of software code and the structure of files. The advantage of static detection is that it does not need to actually run the software, so the detection cost is relatively small. However, software packaging, code obfuscation and other techniques can easily evade static detection. Dynamic detection achieves detection by actually running the software in a sandbox environment and analyzing its behavior. The advantage of dynamic detection is that it is not affected by software packaging, code obfuscation and other disturbances.

[0004] API calling is the most important behavior in the dynamic running process of software, so analyzing API calling sequences is an important means to achieve dynamic malware detection. The main methods of API calling sequence analysis include sequence pattern mining (such as longest common subsequence mining), dependency graph analysis (such as path analysis), and timing model (such as LSTM). However, existing malware detection methods based on API calling sequence analysis have the following shortcomings: existing methods treat APIs as independent individuals, only consider the order of API calling, and ignore the internal semantics of APIs (the name of an API is often composed of multiple meaningful words, such as CreateThread, WriteProcessMemory, which can roughly describe the potential role of API behavior). Ignoring these semantics can cause the following problems: 1) two APIs with similar functions will be considered completely different, greatly reducing the generalization ability of the detection model. 2) The detection model cannot handle unknown APIs. SUMMARY

[0005] The purpose of the present application is to provide a malware detection method based on API semantic parsing, which improves the malware detection capability.

[0006] To achieve the above purpose, the technical solution adopted by the present application is:

[0007] A malware detection method based on API semantic analysis, the malware detection method based on API semantic analysis comprises:

[0008] Step 1, learning the representation vector of each API based on the API call sequence sample, tokenizing the API name into a word set, and calculating the representation vector of each word in the word set;

[0009] Step 2, constructing an API graph taking API and word as node based on API name and word set, and updating the representation vector of API node and word node in API graph by using graph convolutional neural network;

[0010] Step 3, obtaining API call sequence sample, converting API call sequence sample into representation vector sequence sample based on the representation vector of each API node in API graph, and training LSTM network to obtain recognition model by using labeled representation vector sequence sample;

[0011] Step 4, for real-time API call sequence to be identified, converting into real-time representation vector sequence by using the API graph, and inputting the real-time representation vector sequence into the recognition model to obtain malware detection result.

[0012] Several optional modes are also provided below, but not as additional limitations to the above general scheme, but only as further supplements or preferences, and each optional mode can be combined with the above general scheme alone or with other optional modes, without technical or logical contradiction.

[0013] Preferably, the representation vector of each API is learned based on the API call sequence, comprising:

[0014] A unique identifier is set for each API;

[0015] The corresponding identifier sequence is obtained according to the API call sequence, and several identifier sequences are combined to form an identifier sequence set;

[0016] The identifier sequence set is learned by using word2vec to obtain the representation vector of each API.

[0017] Preferably, the API name is tokenized into a word set, comprising:

[0018] Each API name is tokenized based on camel case;

[0019] All the words obtained by tokenization are summarized and de-duplicated to obtain a word set.

[0020] Preferably, the representation vector of each word in the word set is calculated, comprising:

[0021] The pre-trained word2vec English word vector is used as a representation vector for the known English words in the word set, and the representation vector is randomly initialized for the unknown words in the word set.

[0022] Preferably, the API graph is constructed as a graph AG=(V, E, A), where V is a node set containing all APIs and words; E is an edge set containing all associations between APIs and words, and there is an edge between a word contained in an API name and the API; and A is an attribute set, the attribute of an API node is a representation vector of the API, and the attribute of a word node is a representation vector of the word.

[0023] The malware detection method based on API semantic parsing provided by the application considers the regularity of API calling sequences and the semantics of API names, so that the generalization ability of the malware detection model is stronger; the API graph is used to learn the association between APIs and words constituting the APIs, so that the model can adapt to unknown APIs and words. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 A flowchart of the malware detection method based on API semantic parsing of the application;

[0025] Figure 2 A flowchart of API sequence learning and API semantic learning of the application;

[0026] Figure 3 An embodiment of the API graph of the application is shown in the figure;

[0027] Figure 4 A flowchart of real-time malware detection based on the recognition model of the application. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only some of the embodiments of the application, but not all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the application.

[0029] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the application belongs. The terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the application.

[0030] In view of the deficiencies in malware detection in the prior art, the embodiment proposes a malware detection method based on API semantic analysis, as shown in Figure 1 The malware detection method based on API semantic analysis of the embodiment is divided into an offline training part and a real-time identification part, and an identification model for real-time identification is obtained through the offline training part. Specifically, the following steps are included:

[0031] Step 1, learn the representation vector of each API based on the API call sequence sample, divide the API name into a word set, and calculate the representation vector of each word in the word set.

[0032] On the one hand, the embodiment learns the representation vector of each API from the API call sequence by using word embedding technology; on the other hand, the API is regarded as a collection of words, and the representation vector of each word is calculated.

[0033] As shown in Figure 2 The detailed steps of API sequence learning and API semantic learning are as follows:

[0034] (1-1) API sequence learning: first, set a unique identifier for each API, then the API call sequence generated by running a software can be represented as an identifier sequence. Then, by dynamically running a large number of software and monitoring their running process, a large number of API call sequences are obtained to form an API sequence set, and the API call sequence is converted into a corresponding identifier sequence to form an identifier sequence set ASS. Finally, word2vec is used to learn the set ASS to obtain the representation vector of each API.

[0035] (1-2) API semantic learning: first, based on the camel naming convention, the name of each API is tokenized to obtain a number of words that make up the API name. Then, the words obtained by tokenization are summarized and de-duplicated to obtain a word set WS. Finally, for each word w in the set WS, if w is an English word, a pre-trained English word vector is used as its representation vector; if w is an unknown word, its representation vector is randomly initialized.

[0036] It should be noted that in English expression, English words are all known words, and some English expressions formed by abbreviations or self-defined English expressions are considered unknown in the embodiment. In order to facilitate expression, these unknown English expressions are referred to as unknown words, and unknown English expressions in the case of known English words can also be understood as unknown non-English words.

[0037] The pre-trained English word vector of the embodiment is obtained based on the existing pre-trained word2vec model.

[0038] Step 2, based on the API name and the word set, an API graph taking API and word as nodes is constructed, and a graph convolutional neural network is used to update the representation vectors of API nodes and word nodes in the API graph.

[0039] The API graph constructed in this embodiment has a structure of graph AG=(V, E, A), where V is a node set containing all APIs and words; E is an edge set containing all associations between APIs and words, and there is an edge between a word contained in an API name and the API; and A is an attribute set, the attribute of an API node is the representation vector of the API, and the attribute of a word node is the representation vector of the word. As shown in the figure, it is a schematic diagram of an API graph constructed in this embodiment. Figure 3

[0040] After the API graph is constructed, the representation learning of the API graph nodes is performed: a graph convolutional neural network is used to process AG, propagate and fuse the representation vectors of the nodes, and finally obtain the representation vectors of all nodes, including the representation vectors of all APIs and the representation vectors of all unknown words. Through the propagation and fusion based on the API graph, this embodiment forms the association between APIs and words, so that the recognition model can adapt to unknown APIs and words during the training process.

[0041] Step 3, obtaining API call sequence samples, converting the API call sequence samples into representation vector sequence samples based on the representation vectors of the API nodes in the API graph, and training an LSTM network using the labeled representation vector sequence samples to obtain a recognition model.

[0042] The labeling of the representation vector sequence sample depends on the origin of the corresponding API call sequence sample, that is, if the API call sequence sample is generated by normal software running, the representation vector sequence sample is labeled as normal, and if the API call sequence sample is generated by malicious software running, the representation vector sequence sample is labeled as abnormal.

[0043] The training of the model is a conventional technical means in the field of neural networks, and this embodiment will not be described in detail, and the LSTM network outputs the recognition result through a fully connected layer after processing the representation vector sequence.

[0044] Step 4, as shown in Figure 4 For a real-time API call sequence to be identified, the representation vectors of the API nodes in the API graph are used to convert the real-time API call sequence into a real-time representation vector sequence, and the real-time representation vector sequence is input into the recognition model to obtain a malicious software detection result.

[0045] ​Any combination of the technical features in the above-described embodiments can be made, and for the sake of brevity, not all possible combinations are described, however, as long as there is no conflict, any combination of the technical features should be considered within the scope of the present disclosure.

[0046] The above-described embodiments only express several implementation manners of the present application, and the description is relatively specific and detailed, but should not be understood as a limitation on the scope of the present application. It should be pointed out that, for ordinary skilled persons in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A malware detection method based on API semantic parsing, characterized in that, The malware detection method based on API semantic analysis comprises: Step 1, learning the representation vector of each API based on the API call sequence sample, tokenizing the API name into a word set, and calculating the representation vector of each word in the word set; wherein the API name is tokenized into a word set, comprising: tokenizing each API name based on the camel case naming method; all words obtained by tokenization are summarized and de-duplicated to obtain a word set; Step 2, based on the API name and the word set, an API graph taking API and word as node is constructed, and the representation vector of the API node and the word node in the API graph is updated using a graph convolutional neural network; the API graph is constructed as a graph AG = (V, E, A), wherein V is a node set, including all APIs and words; E is an edge set, including all API and word associations, and there is an edge between the word in the API name and the API; A is an attribute set, the attribute of the API node is the representation vector of the API, and the attribute of the word node is the representation vector of the word; Step 3, obtaining an API call sequence sample, converting the API call sequence sample into a representation vector sequence sample based on the representation vector of each API node in the API graph, and training an LSTM network using the labeled representation vector sequence sample to obtain a recognition model; Step 4, for a real-time API call sequence to be identified, the API graph is converted into a real-time representation vector sequence, and the real-time representation vector sequence is input into the recognition model to obtain a malware detection result.

2. The API semantics resolution based malware detection method of claim 1, wherein, The representation vector of each API learned based on the API call sequence comprises: A unique identifier is set for each API; According to the API call sequence, the corresponding identifier sequence is obtained, and several identifier sequences are combined to form an identifier sequence set; The word2vec is used to learn the identifier sequence set to obtain the representation vector of each API. 3.The API semantics parsing based malware detection method of claim 1, wherein, The calculation of the representation vector of each word in the word set comprises: The pre-trained word2vec English word vector is used as the representation vector for the known English words in the word set, and the representation vector of the unknown words in the word set is randomly initialized.

Images