Evolutionary malware identification method with instruction and system call sequence association reconstruction

Abstract

The present application relates to a kind of instruction and system call sequence association reconstruction evolvable malware identification method, belong to computer and information science technology field.The present application simultaneously obtains system call and instruction sequence generated when target program runs in virtual machine environment, according to time stamp association two kinds of sequences, and reconstructs into hybrid sequence according to execution time sequence;Convert reconstruction sequence into representation matrix by embedding model;Feature vector is generated by using convolutional neural network processing representation matrix;The similarity between the feature vector and the application clustering cluster center that has been constructed is calculated, the category of the feature vector corresponding target program is judged;Finally, the feature vector is added to the cluster of belonging, and the cluster center of the cluster is updated.The present application can simultaneously focus on instruction and system call behavior, extract and utilize the cross correlation characteristics between them, avoid ignoring instruction level operation, and simultaneously without high-cost model retraining process can realize the identification of unknown type malware.

Description

TECHNICAL FIELD

[0001] The application relates to an evolvable malware identification method based on reconstruction of instruction and system call sequence association, and belongs to the technical field of computer and information science. BACKGROUND

[0002] Computer malware brings serious security threats to cyberspace. Early identification methods of malware include static analysis and dynamic analysis. Static analysis generally analyzes the malicious functions of a target program by decompiling and disassembling the binary file of the target program, so as to identify the malware. Dynamic analysis directly observes and identifies the malicious operations and behaviors of the target program by running the target program in a controllable execution environment. Both of the two identification methods usually require rich prior knowledge and expert experience, and the labor cost is high. In the current information society, the number of malware is increasing rapidly, and new variants are constantly emerging, which makes the manual analysis and identification method face great challenges.

[0003] Machine learning and deep learning technologies have been widely used in the automatic identification of malware. Such methods train models to complete the identification task. Among them, the identification method using system call trace sequences generated during the running of malware has attracted widespread attention from academia and industry. This method mines short sequence features, frequency features and behavior semantic features in the system call sequence to train the model to identify known types of malware. However, in addition to using system calls, malware will also directly use instructions to complete certain operations during running, and these operations may have an association with potential malicious behaviors. Therefore, the identification method using only system call sequences ignores the instruction execution information of the target application program, resulting in a decline in identification performance. On the other hand, when facing unknown types of target programs, the model needs to be retrained to update the model to maintain the effectiveness of identification. However, model retraining is usually a resource-intensive process.

[0004] Therefore, the application provides an evolvable malware identification method based on reconstruction of instruction and system call sequence association. This method simultaneously obtains the instruction and system call execution information during the running of a target program, reconstructs the two sequences into a hybrid sequence through the association of timestamp information, avoids ignoring instruction operation behaviors, constructs an application program clustering cluster, matches the category of the target program by calculating and comparing the similarity of the feature vector of the target program and the cluster centroid, and updates the application program clustering cluster in real time to identify malicious programs. Moreover, this method can identify unknown types of malicious programs without the need for a resource-intensive model retraining process. SUMMARY

[0005] The purpose of the present application is to solve the problem of performance decline caused by ignoring the instruction execution information during the running of the target application program in the machine learning malware identification method using only the system call sequence, and to solve the problem of large resource consumption caused by the need for retraining to update the identification model when facing unknown types of target programs.

[0006] The design principle of the present application is as follows: first, run the target application program in the virtual machine environment, and monitor and record its system call and instruction execution sequences respectively; next, associate and reconstruct the system call and instruction execution sequences according to the timestamp information to obtain a mixed sequence containing both instructions and system calls; then, embed the instructions and system calls in the associated reconstructed sequence into a vector space using the word embedding model in the natural language processing field, and then connect the embedded vectors together in the original order to generate a representation matrix; then input the representation matrix of the associated reconstructed sequence into a convolutional neural network to automatically extract local features and significant features using convolution kernels and pooling layers, and concatenate the obtained features into a high-dimensional abstract feature vector of the associated reconstructed sequence; then calculate the similarity between the feature vector and the centroid of each application program cluster to determine the category of the target application program corresponding to the feature vector; finally, add the feature vector to the malware clustering cluster and update the centroid of the corresponding clustering cluster.

[0007] The technical solution of the present application is implemented by the following steps:

[0008] Step 1, simultaneously acquire the execution information of instructions and system calls during the running of the target application program;

[0009] Step 1.1, start the system call monitoring function in the virtual machine;

[0010] Step 1.2, start the instruction interception function in the virtual machine monitor;

[0011] Step 1.3, run the target application program to be identified in the virtual machine;

[0012] Step 1.4, monitor and record the system call execution information during the running of the target application program, including the called kernel function name and its execution timestamp;

[0013] Step 1.5, intercept and record the key instruction execution information during the running of the target application program, including the instruction name and its execution timestamp;

[0014] Step 1.6, according to the order of the timestamps, arrange the contents in the system call execution record and the instruction execution record into a system call sequence and an instruction sequence respectively;

[0015] Step 1.7, associate and reconstruct the system call sequence and the instruction sequence into a mixed sequence;

[0016] Step 2, convert the association reconstruction sequence into a numerical representation matrix;

[0017] Step 2.1, use the word embedding model in the field of natural language processing to embed the instructions and system calls in the association reconstruction sequence into the vector space respectively;

[0018] Step 2.2, connect the embedded vectors of instructions and system calls to form a numerical representation matrix according to the order in the association reconstruction sequence;

[0019] Step 3, extract the features of the representation matrix to generate a feature vector;

[0020] Step 3.1, input the representation matrix of the association reconstruction sequence into the convolutional neural network;

[0021] Step 3.2, use different size convolution kernels in the convolution layer to extract local features and generate feature maps;

[0022] Step 3.3, use max pooling to extract significant features in the feature map and generate a pooling feature;

[0023] Step 3.4, splice the pooling features corresponding to different convolution kernels to generate a high-dimensional abstract feature vector corresponding to the association reconstruction sequence;

[0024] Step 4, calculate the similarity between the feature vector and the cluster center of the constructed application program, so as to determine the category of the target application program corresponding to the feature vector;

[0025] Step 5, add the feature vector to the application program clustering cluster and update the cluster center of the corresponding clustering cluster.

[0026] Beneficial effects

[0027] Compared with other malware identification methods using only system call sequences, the present application can simultaneously focus on the execution information of instructions and system calls in the running process of the target application, extract and use the cross-correlation features between instructions and system calls, avoid the inability to identify operation behaviors using instructions, and additionally, without the need for a high-resource-consuming model retraining process, the present application can realize the identification of malware when facing unknown types of target programs. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 The principle framework diagram of the evolvable malware identification method of the present application for instruction and system call sequence association reconstruction. DETAILED DESCRIPTION

[0029] In order to better illustrate the purposes and advantages of the present application, the embodiments of the method of the present application will be further described in detail below with examples.

[0030] The specific process is as follows:

[0031] Step 1, simultaneously acquire the execution information of instructions and system calls in the running process of the target application to be identified;

[0032] Step 1.1, install and run Process Monitor in the virtual machine providing the execution environment;

[0033] Step 1.2, in the virtual machine monitor, set the corresponding control bits in the Pin-based VM-execution control field, the Primary Processor-based VM-execution control field and the Secondary Processor-based VM-execution control field in the Virtual Machine Control Stucture (VMCS), and perform interception setting on key instructions such as LGDT, SGDT, LIDT, SIDT, LLDT, SLDT, LTR, STR, RDTSC, RDTSCP, etc.;

[0034] Step 1.3, run the target application to be identified in the virtual machine, and query its process ID;

[0035] Step 1.4, use Process Monitor to monitor and record the system call execution information in the running process of the target application to be identified through its process ID, including the called kernel function name and its execution timestamp;

[0036] Step 1.5, in the VM-exit handler of the virtual machine monitor, record the intercepted instruction execution information in the running process of the target application to be identified through its process ID, including the instruction name and its execution timestamp;

[0037] Step 1.6, after the running of the target application to be identified ends, arrange the contents in the system call execution record and the instruction execution record in the order of the timestamps, into the system call sequence (using to represent) and the instruction sequence (using to represent) corresponding to the running process of the target application respectively;

[0038] Step 1.7, associate the system call sequence and the instruction sequence by comparing the timestamp information, and then merge and reconstruct the system call sequence and the instruction sequence into a hybrid sequence (using [I1, S2, …, S m, …] represents), only instruction names and kernel function names are contained in the sequence, in addition, a fixed uniform length K is set as the standard length of the sequence according to experience, when the length of the mixed sequence is greater than K, the sequence is truncated, and when the length is less than K, it is padded, and the sequence with a final length of K after processing is called an associated reconstruction sequence.

[0039] Step 2, convert the associated reconstruction sequence into a numerical representation matrix;

[0040] Step 2.1, run the collected known category malicious programs and benign applications in the virtual machine environment one by one, and use the mixed sequence of instructions and system calls in the execution process of all applications to build a corpus, the word segmentation in the corpus is the instruction name and the kernel function name, use the corpus to train the Wrod2Vec embedding model in the skip-gram way, finally get the word table of each instruction name and kernel function name and its corresponding distributed vector representation, then query the word table to obtain the associated reconstruction sequence [I1, S2, …, S m ,…,I K ] in the execution process of the target application to be identified, and the embedding vector [v1, v2, …, v m ,…,v K ], m∈[1, K] of the instruction and system call in the sequence, wherein width represents the embedding vector dimension;

[0041] Step 2.2, according to the order in the associated reconstruction sequence, the embedding vectors of the instructions and system calls are connected to form the corresponding numerical representation matrix V of the instructions and system calls

[0042] Step 3, extract the features of the representation matrix to generate a feature vector;

[0043] Step 3.1, input the representation matrix V of the associated reconstruction sequence into the TextCNN, it should be noted that the TextCNN is a trained model whose performance meets the requirements after being trained by the representation matrix and the corresponding label of the collected known category malicious programs and benign applications.

[0044] Step 3.2, in the convolution layer, the size of each convolution kernel is set to h x width, wherein h represents the height of the convolution kernel, and width represents the width of the convolution kernel; the height of the convolution kernel determines the number of embedding vectors that can be covered by the convolution kernel window in the convolution calculation process; and the width of the convolution kernel is equal to the dimension of the embedding vector, so that the convolution operation can only be performed in the head-to-tail direction of the sequence; one convolution operation of each convolution kernel obtains a feature value, and the calculation formula is as follows:

[0045] c t =f(W·Vt:t+h-1 +b)

[0046] In the above formula, c t represents the feature value obtained by one convolution calculation, using ReLU (Rectified Linear Unit) as the activation function f(·), represents the weight parameter matrix in the convolution operation, V t:t+h-1 represents the part from position t to t+h-1 in the feature matrix, and b represents the bias in the convolution layer. After each convolution kernel performs the convolution operation on the input feature matrix, the corresponding feature map c is output, and the calculation formula is as follows:

[0047] c = (c1, c2, c3, …, c K-h+1 )

[0048] In the above formula, K is the fixed and unified length of the associated reconstruction sequence, and h represents the height of the convolution kernel. In TextCNN, multiple convolution kernels with different heights are set to extract features, and the convolution layer outputs multiple groups of feature maps.

[0049] Step 3.3, in the pooling layer, the pooling operation is used to further abstract the feature map, and the maximum pooling is used to capture key and prominent local features, and the layer outputs the pooled features.

[0050] Step 3.4, the pooled features corresponding to different convolution kernels are spliced to generate a high-dimensional abstract feature vector corresponding to the associated reconstruction sequence k∈N * , where d represents the dimension of the feature vector;

[0051] Step 4, the similarity between the feature vector of the associated reconstruction sequence and the cluster center of the constructed application is calculated, so as to determine the category to which the target application corresponding to the feature vector belongs; wherein the feature vectors of the known category malicious programs and benign applications collected by the method in steps 1-3 are obtained, and the K-means algorithm is used to cluster these feature vectors to obtain the cluster center of the constructed application cluster, using C = {C1, C2, …, C n},n∈N * represents all the obtained cluster centers, using μ = {μ1, μ2, …, μ n},n∈N * represents the cluster center corresponding to the cluster, using λ = {λ1, λ2, …, λ n},n∈N * represents the category label corresponding to the cluster;

[0052] Step 4.1, the cosine similarity SIM between the feature vector k∈N * of the target application to be identified and all cluster centers is calculatedkp = Similarity(x k , μ p ), p e [1, n], the calculation formula is as follows:

[0053]

[0054] Step 4.2, when SIM kp ≤ θ, p e [1, n], it is considered that the target application to be identified belongs to the known category, and then further compare the size of all cosine similarities, if when p = z, z e [1, n], the corresponding cosine similarity SIM kz is minimum, then the feature vector is inducted into the clustering cluster C z , and the category label λ z of the clustering cluster is taken as the category label of the target application to be identified.

[0055] Step 4.3, when SIM kp > θ, p e [1, n], then directly determine the target application to be identified as malware, and set its corresponding new category as λ n+1 , that is, λ = λ U {λ n+1}.

[0056] Step 5, add the feature vector into the application clustering cluster, and update the center of the corresponding clustering cluster;

[0057] Step 5.1, when SIM kp ≤ θ, p e [1, n], and the minimum cosine similarity SIM kz and the category label λ z of the target application are determined, the feature vector x k is added to the clustering cluster C z , that is, C z = C z U {x k}, and then the center μ z ' of the clustering cluster is recalculated, and the calculation formula is as follows:

[0058]

[0059] Step 5.2, when SIM kp > θ, p e [1, n], x k is taken as a new clustering cluster C n+1 alone, then further C = C U {C n+1}, and x k is taken as the center μ n+1 of the clustering cluster, that is, μ = μ U {μ n+1}.

[0060] Test result: the real malicious software samples are used in the experiment, the application can synchronously intercept and acquire the instruction sequence and system call sequence executed by the malicious software samples in real time, and has low-cost evolution capability and effective identification capability for unknown type malicious software samples used in the experiment.

[0061] The above detailed description further describes the purpose, technical scheme and beneficial effects of the application. It should be understood that the above description is only a specific embodiment of the application and is not used to limit the protection scope of the application. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the application should be included in the protection scope of the application.

Claims

1. A method for identifying evolvable malware by reconstructing instructions and system call sequences, characterized in that... The method includes the following steps: Step 1: Simultaneously obtain the execution information of instructions and system calls during the target application's runtime; Step 1.1: Start the system call monitoring function in the virtual machine; Step 1.2: Enable the instruction interception function in the virtual machine monitor; Step 1.3: Run the target application to be identified in a virtual machine; Step 1.4: Monitor and record system call execution information during the execution of the target application, including the names of the called kernel functions and their execution timestamps; Step 1.5: Intercept and record key instruction execution information executed during the target application's runtime, including instruction names and their execution timestamps; Step 1.6: Organize the contents of the system call execution record and instruction execution record into a system call sequence and an instruction sequence according to the timestamp order; Step 1.7: Associate and reconstruct the system call sequence and instruction sequence into a hybrid sequence; Step 2: Convert the associated reconstruction sequence into a numerical representation matrix; Step 2.1: Use a word segmentation embedding model from the field of natural language processing to embed the instructions and system calls in the associated reconstructed sequence into vector spaces respectively; Step 2.2: Connect the embedding vectors of instructions and system calls in the order of the associated reconstruction sequence to form a numerical representation matrix; Step 3: Extract the features of the representation matrix to generate feature vectors; Step 3.1: Input the representation matrix of the associated reconstructed sequence into the convolutional neural network; Step 3.2: Extract local features in the convolutional layer using convolutional kernels of different sizes to generate feature maps; Step 3.3: Using max pooling, extract salient features from the feature map and generate pooled features; Step 3.4: Concatenate the pooling features corresponding to different convolution kernels to generate a high-dimensional abstract feature vector corresponding to the associated reconstructed sequence; Step 4, wherein the constructed application clusters are obtained by unsupervised clustering of feature vectors of known category applications; the similarity between the feature vector and the centroid of the constructed application clusters is calculated to determine the category to which the target application corresponding to the feature vector belongs; Step 5: Add the feature vectors to the application clusters and update the centroids of the corresponding clusters.

2. The method for identifying evolvable malware by reconstructing the association between instructions and system call sequences according to claim 1, characterized in that... In step 1.7 of step 1, the system call sequence and instruction sequence are associated by comparing timestamp information, and then the system call sequence and instruction sequence are merged and reconstructed into a hybrid sequence according to the order of execution time.

3. The method for identifying evolvable malware by reconstructing the association between instructions and system call sequences according to claim 1, characterized in that... In step 3.1 of step 3, the convolutional neural network has been trained using the collected representation matrices of known categories of malicious and benign applications and their corresponding labels. After the model file of the convolutional neural network is saved after the classification performance meets the requirements, the trained network is used only to extract and generate feature vectors of the associated reconstructed sequence representation matrix during the process of classifying the target application. It is not used for the classification task.

4. The method for identifying evolvable malware by reconstructing the association between instructions and system call sequences according to claim 1, characterized in that... In step 4, the application clusters are obtained by using the method described in steps 1-3 to collect feature vectors of known categories of malicious and benign applications, and then using an unsupervised clustering algorithm to cluster these feature vectors. Then, for the target application to be identified, the method described in steps 1-3 is used to obtain the feature vector corresponding to its associated reconstruction sequence, and similarity is used to calculate the similarity between this feature vector and the centroids of each application cluster. When the similarity between this feature vector and all centroids is... If the similarity between the feature vector and all centroids is less than or equal to a set threshold, then the similarity between the feature vector and all centroids is further compared, and the feature vector is assigned to the cluster containing the centroid with the lowest similarity. Simultaneously, the category of the application in that cluster is determined as the category of the target application to be identified. Conversely, if the similarity between the feature vector and all centroids is greater than a set threshold... If so, the target application to be identified will be directly identified as malware, and a new category will be set accordingly.

5. The method for identifying evolvable malware by reconstructing the association between instructions and system call sequences according to claim 1, characterized in that... In step 5, for clusters whose similarity to the centroids of all clusters is less than or equal to a set threshold... The feature vectors are added to the cluster containing the centroid of the cluster with the lowest similarity, and then the centroid of that cluster is updated; while for clusters with similarity to the centroids of all clusters greater than a set threshold... If the eigenvectors are used, they are treated as a new cluster and used as the initial centroid of that cluster.

Images