A method and device for detecting malicious software

Abstract

The present application provides a malware detection method and device, which uses the network behavior data and API call sequence data generated during the operation of the software to be detected as the first original data set; uses a pre-trained dynamic behavior detection model to extract features from the first original data set, determines network behavior features and API call behavior features, and determines whether the software to be detected is malware based on the network behavior features and the API call behavior features. Through pre-training, the dynamic behavior detection model can achieve a high malware detection accuracy. The model extracts features from the first original data set from two aspects, network behavior and API call behavior. The feature extraction direction increases, making the dynamic behavior detection mining information more comprehensive, and the detection has comprehensive and in-depth nature, so that the detection result has a high accuracy rate.

Description

Technical Field

[0001] The present application relates to the field of machine learning technology, and in particular to a malware detection method and device. Background Art

[0002] Malware is a general term for software that disrupts the normal operation of the system. Malware is between virus software and regular software, and has both normal functions such as downloading and media playback and malicious behaviors such as pop-up ads and backdoors. These malware can be combined with a variety of evasion techniques and security vulnerabilities to break through the detection of existing traditional defense systems and bring substantial harm to users. Therefore, studying malware detection methods is an important research direction for maintaining the security of the cyber world.

[0003] Existing malware detection can be roughly divided into two categories, namely static file detection methods and dynamic behavior detection methods. With the development of code obfuscation technology and code encryption technology, the source code of malware can hide some typical features, making it very difficult to detect typical features in the source code of malware using static file detection methods. Dynamic behavior detection methods generally detect malware based on the characteristics of network behavior, which can well make up for this shortcoming of static file detection. Therefore, dynamic behavior detection methods are currently commonly used to detect malware.

[0004] However, traditional network behavior features only include file operation features, registry operation features, and simple network connection request features, and the information mining is relatively one-sided. The detection effect of malware depends largely on the extracted features, which makes the traditional dynamic behavior detection method have a low accuracy rate in malware detection. Summary of the invention

[0005] The present application provides a malware detection method and device, which makes the information mining during malware detection more comprehensive and has a higher accuracy rate for malware detection.

[0006] In a first aspect, the present application provides a malware detection method, comprising:

[0007] The network behavior data and API call sequence data generated during the operation of the software to be detected are used as the first original data set; a pre-trained dynamic behavior detection model is used to extract features of the first original data set, determine network behavior features and API call behavior features, and determine whether the software to be detected is malware based on the network behavior features and the API call behavior features.

[0008] Optionally, the dynamic behavior detection model includes a feature extraction module, a weak learner and a strong learner; the weak learner includes a network behavior feature learner and an API call behavior feature learner;

[0009] The method of using the pre-trained dynamic behavior detection model to extract features from the first original data set, determining network behavior features and API call behavior features, and judging whether the software to be detected is malware based on the network behavior features and the API call behavior features includes:

[0010] Using a feature extraction module to extract features from the first original data set, and determine network behavior features and API call behavior features;

[0011] Using the network behavior feature learner, based on the network behavior feature, determine a first probability that the software to be detected is malware;

[0012] Using the API call behavior feature learner, determining a second probability that the software to be detected is malware based on the API call behavior feature;

[0013] Using the strong learner, it is determined whether the software to be detected is malware based on the first probability and the second probability.

[0014] This model can use different weak learners to perform preliminary detection on the software to be detected based on multiple features, and then use the strong learner to make a comprehensive judgment based on the detection results of multiple features, and finally determine the maliciousness of the software to be detected. Thus, the detection accuracy can be improved, making the detection effect of the dynamic behavior detection model better.

[0015] Optionally, the network behavior feature includes at least one of: a file operation related feature, a registry operation related feature, a network connection request related feature, a domain name related feature in an external network connection, and an intranet detection information related feature;

[0016] The API call behavior feature includes at least one of an API call sequence order feature and an API call sequence content feature.

[0017] The network behavior characteristics of the above-mentioned software can better characterize whether the software is malicious. Due to the development of the Internet and technology, more and more malware have certain network behaviors, and network behaviors can directly summarize the external performance characteristics of the software; malware can implement its functions through API calls. According to past experience, there are large differences in the accessed API sequences between benign application software and different types of malware, so API call behavior can comprehensively reflect the behavioral characteristics of the software from the bottom layer. Information mining from these two aspects of network behavior characteristics and API call behavior characteristics can make the characteristics of the software to be detected comprehensively and deeply detected, and improve the accuracy of dynamic behavior detection model detection.

[0018] Optionally, the method further includes:

[0019] Based on the Adaboost algorithm, construct the network behavior feature learner;

[0020] Based on the bidirectional long short-term memory algorithm, construct the API call behavior feature learner;

[0021] The strong learner is constructed based on a logistic regression algorithm.

[0022] Compared with other algorithms, the Adaboost algorithm has increased its classification accuracy through multiple iterations, and has better binary classification performance; the bidirectional long short-term memory algorithm can transmit information in both directions, and has dependencies on both input and output. For API call behavior characteristics with strong temporal characteristics, the bidirectional long short-term memory algorithm has an absolute advantage. The logistic regression algorithm has the advantages of fast training speed and easy improvement of classification accuracy by adjusting the threshold.

[0023] Optionally, the training process of the dynamic behavior detection model includes:

[0024] The network behavior data and API call sequence data generated during the running of the sample software are used as sample data sets;

[0025] Extracting features from the sample data set to determine network behavior features and API call behavior features of the sample data set;

[0026] Based on the network behavior characteristics of the sample data set, training the network behavior feature learner;

[0027] Based on the API call behavior features of the sample data set, training the API call behavior feature learner;

[0028] After reaching a preset first training stop condition, determining a first probability sample based on a final output result of the network behavior feature learner;

[0029] After reaching a preset second training stop condition, determining a second probability sample based on a final output result of the API calling behavior feature learner;

[0030] Based on the first probability sample and the second probability sample, the strong learner is trained until a preset third training stop condition is reached.

[0031] The training process of the dynamic behavior detection model is a layered model training process. First, the first layer learner is trained, and then the second layer learner is trained with the output of the first layer learner, thus completing the training process of the entire model. The model can be trained multiple times to continuously increase the accuracy of the dynamic behavior detection model in detecting malware.

[0032] Optionally, the method further includes:

[0033] Determine whether the sum of the number of the network behavior features and the number of the API call behavior features is less than a preset number;

[0034] If it is determined that the software to be detected is not malware based on the network behavior characteristics and the API call behavior characteristics, and it is determined that the sum of the number of the network behavior characteristics and the number of the API call behavior characteristics is less than a preset number, a pre-trained static detection model is used to detect whether the software to be detected is malware.

[0035] The above judgment shows that the sum of the number of network behavior features and the number of API call behavior features is less than the preset number. It is possible that malware has incorporated evasion techniques such as anti-virtual machine and anti-debugging into dynamic behavior detection. The acquired feature data that can be used as evidence of malware is small, and the dynamic behavior detection model has a low accuracy rate in detecting malware. Using a static detection model can effectively make up for the defects of the dynamic behavior detection model. Static detection and dynamic behavior detection achieve a good complementary effect, and the overall detection accuracy is higher.

[0036] Optionally, the detecting whether the software to be detected is malware by using a pre-trained static detection model includes:

[0037] Using the source data of the software to be detected as a second original data set;

[0038] Using a pre-trained static detection model, extracting features from the second original data set, determining the original features of the executable file PE, and judging whether the software to be detected is malware according to the original features of the PE;

[0039] The PE original features include: PE's own attributes, the number of section tables of the location of the program entry point relative to the entire program, whether the first 20 bytes of the function entry contain jump instructions, the number of sections for loading code, the number of sections for loading data, the ratio of the file size of the program to the file size mapped to the memory, the average entropy value of all sections, whether there are other sections with executable permissions except the code section, and at least one of the dynamic link library distribution features of the import table and export table.

[0040] The final detection effect of the static detection model depends to a great extent on the extraction of original data features, so it is very necessary to extract effective features. The static detection model is improved on the basis of existing technologies, and effective feature extraction is performed from more aspects, so that the static detection model can mine sufficient information and increase the accuracy of the static detection model in detecting malware.

[0041] In a second aspect, the present application provides a model training method for training a dynamic behavior detection model, wherein the dynamic behavior detection model includes a weak learner and a strong learner; the weak learner includes a network behavior feature learner and an API call behavior feature learner; the method includes:

[0042] The network behavior data and API call sequence data generated during the running of the sample software are used as sample data sets;

[0043] Extracting features from the sample data set to determine network behavior features and API call behavior features of the sample data set;

[0044] Based on the network behavior characteristics of the sample data set, training the network behavior feature learner;

[0045] Based on the API call behavior features of the sample data set, training the API call behavior feature learner;

[0046] After reaching a preset first training stop condition, determining a first probability sample based on a final output result of the network behavior feature learner;

[0047] After reaching a preset second training stop condition, determining a second probability sample based on a final output result of the API calling behavior feature learner;

[0048] Based on the first probability sample and the second probability sample, the strong learner is trained until a preset third training stop condition is reached.

[0049] In a third aspect, the present application provides a malware detection device, comprising:

[0050] A data set determination module, used to use the network behavior data and API call sequence data generated during the operation of the software to be detected as the first original data set;

[0051] The malware detection module is used to use a pre-trained dynamic behavior detection model to extract features from the first original data set, determine network behavior features and API call behavior features, and determine whether the software to be detected is malware based on the network behavior features and the API call behavior features.

[0052] Optionally, the dynamic behavior detection model includes a feature extraction module, a weak learner and a strong learner; the weak learner includes a network behavior feature learner and an API call behavior feature learner;

[0053] The feature extraction module is specifically used to extract features from the first original data set using the feature extraction module to determine network behavior features and API call behavior features;

[0054] The network behavior feature learner module is specifically used to use the network behavior feature learner to determine a first probability that the software to be detected is malware based on the network behavior feature;

[0055] The API call behavior feature learner module is specifically used to use the API call behavior feature learner to determine a second probability that the software to be detected is malware based on the API call behavior feature;

[0056] The strong learner module is specifically configured to use the strong learner to determine whether the software to be detected is malware based on the first probability and the second probability.

[0057] Optionally, the network behavior feature includes at least one of: a file operation related feature, a registry operation related feature, a network connection request related feature, a domain name related feature in an external network connection, and an intranet detection information related feature;

[0058] The API call behavior feature includes at least one of an API call sequence order feature and an API call sequence content feature.

[0059] Optionally, the device further comprises a learner building module, which is used to:

[0060] Based on the Adaboost algorithm, construct the network behavior feature learner;

[0061] Based on the bidirectional long short-term memory algorithm, construct the API call behavior feature learner;

[0062] The strong learner is constructed based on a logistic regression algorithm.

[0063] Optionally, the device further includes a model training module, which is used to:

[0064] The network behavior data and API call sequence data generated during the running of the sample software are used as sample data sets;

[0065] Extracting features from the sample data set to determine network behavior features and API call behavior features of the sample data set;

[0066] Based on the network behavior characteristics of the sample data set, training the network behavior feature learner;

[0067] Based on the API call behavior features of the sample data set, training the API call behavior feature learner;

[0068] After reaching a preset first training stop condition, determining a first probability sample based on a final output result of the network behavior feature learner;

[0069] After reaching a preset second training stop condition, determining a second probability sample based on a final output result of the API calling behavior feature learner;

[0070] Based on the first probability sample and the second probability sample, the strong learner is trained until a preset third training stop condition is reached.

[0071] Optionally, the device further includes a static detection module, configured to:

[0072] Determine whether the sum of the number of the network behavior features and the number of the API call behavior features is less than a preset number;

[0073] If it is determined that the software to be detected is not malware based on the network behavior characteristics and the API call behavior characteristics, and it is determined that the sum of the number of the network behavior characteristics and the number of the API call behavior characteristics is less than a preset number, a pre-trained static detection model is used to detect whether the software to be detected is malware.

[0074] Optionally, when the static detection module uses a pre-trained static detection model to detect whether the software to be detected is malware, it is specifically used to:

[0075] Using the source data of the software to be detected as a second original data set;

[0076] Using a pre-trained static detection model, extracting features from the second original data set, determining the original features of the executable file PE, and judging whether the software to be detected is malware according to the original features of the PE;

[0077] The PE original features include: PE's own attributes, the number of section tables of the location of the program entry point relative to the entire program, whether the first 20 bytes of the function entry contain jump instructions, the number of sections for loading code, the number of sections for loading data, the ratio of the file size of the program to the file size mapped to the memory, the average entropy value of all sections, whether there are other sections with executable permissions except the code section, and at least one of the dynamic link library distribution features of the import table and export table.

[0078] In a fourth aspect, the present application provides an electronic device, including: a memory and a processor;

[0079] The memory is used to store program instructions;

[0080] The processor is used to call and execute program instructions in the memory to perform the method as described in any one of the first aspect or any one of the second aspect.

[0081] In a fifth aspect, the present application provides a computer-readable storage medium storing a computer program that can be loaded by a processor and execute any method of the first aspect or any method of the second aspect.

[0082] The present application provides a malware detection method and device, which uses the network behavior data and API call sequence data generated during the operation of the software to be detected as the first original data set; uses a pre-trained dynamic behavior detection model to extract features from the first original data set, determines network behavior features and API call behavior features, and determines whether the software to be detected is malware based on the network behavior features and the API call behavior features. Through pre-training, the dynamic behavior detection model can achieve a high malware detection accuracy. The model extracts features from the first original data set from two aspects, network behavior and API call behavior. The feature extraction direction increases, making the dynamic behavior detection mining information more comprehensive, and the detection has comprehensive and in-depth nature, so that the detection result has a high accuracy rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0084] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0085] Figure 2 A flowchart of a malware detection method provided in one embodiment of the present application;

[0086] Figure 3 An architecture diagram of a dynamic behavior detection model provided in one embodiment of the present application;

[0087] Figure 4 An architectural diagram of a dynamic and static combined detection model provided in one embodiment of the present application;

[0088] Figure 5 A schematic diagram of the structure of a malware detection device provided in one embodiment of the present application;

[0089] Figure 6 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0090] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0091] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0092] Malware is a general term for software that disrupts the normal operation of the system. Malware is between virus software and regular software, and has both normal functions such as downloading and media playback and malicious behaviors such as pop-up ads and backdoors. These malware can be combined with a variety of evasion techniques and security vulnerabilities to break through the detection of existing traditional defense systems and bring substantial harm to users. Therefore, studying malware detection methods is an important research direction for maintaining the security of the cyber world.

[0093] Existing malware detection can be roughly divided into two categories, namely static file detection methods and dynamic behavior detection methods. Static file detection mainly detects the source code of the software, while dynamic behavior detection detects the data generated during the execution of the software. With the development of code obfuscation technology and code encryption technology, the source code of malware can hide some typical features, making it very difficult to detect typical features in the source code of malware using static file detection methods. Dynamic behavior detection methods generally detect malware based on the characteristics of network behavior, which can well make up for this shortcoming of static file detection. Therefore, dynamic behavior detection methods are currently commonly used to detect malware.

[0094] However, traditional network behavior features only include file operation features, registry operation features, and simple network connection request features, which can only directly summarize the external performance features of the program, and the information mining is relatively one-sided. The detection effect of malware depends to a large extent on the extracted features, which makes the traditional dynamic behavior detection method have a low accuracy rate in detecting malware from a single direction.

[0095] Based on this, the present application provides a malware detection method and device, which makes the information mining during malware detection more comprehensive and has a higher accuracy rate for malware detection.

[0096] The embodiments of the present application are further described in detail below in conjunction with the drawings in the specification.

[0097] Figure 1 A schematic diagram of an application scenario provided by this application. This application can detect malware in computers used in daily life. During the use of a computer system, malware can disrupt the normal operation of the system and cause losses to users, so it is necessary to quickly and accurately detect malware to prevent malware from affecting the normal use of the computer. Figure 1 The software installed in the computer can be detected by loading the malware detection method proposed in this application on a server. The relevant data of the software to be detected in the computer is transmitted to the server (via wired / wireless), and the server executes the method of this application, applies the dynamic behavior detection model proposed in this application, conducts comprehensive mining of the malware information, and finally determines the malware detection result (whether it is malware).

[0098] In addition, the malware detection method of the present application can be integrated into anti-virus software or a detection function in anti-virus software.

[0099] The specific implementation of malware detection can refer to the following embodiments.

[0100] Figure 2 This is a flowchart of a malware detection method provided in an embodiment of the present application. The execution subject of the method in this embodiment can be the server in the above scenario, and can also be other devices with computing capabilities (computers, smart phones, etc.). Figure 2 As shown, the method includes:

[0101] S201. Use the network behavior data and API call sequence data generated during the operation of the software to be detected as the first original data set.

[0102] For the embodiments of the present application, when testing the software to be tested, the software to be tested can be run first, and network behavior data and API call sequence data are extracted from all data generated during the running of the software to be tested, and the extracted network behavior data and API call sequence data are the first original data set.

[0103] Among them, due to the development of the Internet and technology, users' network behaviors have become diverse, resulting in the continuous generation of massive network behavior data. Network behavior data includes network behavior data collected from various terminals in the network; API call sequence data includes API data pointing to the use of triggered APIs. Malware can notify the system to perform certain operations through API calls to realize its functions.

[0104] In some scenarios, a communication connection can be established between the execution subject of the method of this embodiment and the device where the software to be detected is located. Before performing the detection, the execution subject of the method of this embodiment initiates a data request to the device where the software to be detected is located, so that the device where the software to be detected is located responds to the data request and feeds back all relevant data of the software to be detected to the execution subject, and the execution subject filters out the network behavior data and API call sequence data generated during the software running process.

[0105] In other scenarios, a communication connection can be established between the execution subject of the method of this embodiment and the device where the software to be detected is located. Before performing the detection, the execution subject of the method of this embodiment initiates a data request to the device where the software to be detected is located, so that the device where the software to be detected is located responds to the data request, and filters out the network behavior data and API call sequence data generated during the software operation process from all relevant data of the software to be detected, and feeds back to the execution subject.

[0106] In other scenarios, the network behavior data and API call sequence data generated during the operation of the software to be tested can be directly extracted from the device where the software is located and uploaded to the execution entity.

[0107] S202. Using a pre-trained dynamic behavior detection model, perform feature extraction on the first original data set, determine network behavior features and API call behavior features, and determine whether the software to be detected is malware based on the network behavior features and the API call behavior features.

[0108] A dynamic behavior detection model is pre-built and trained to enable it to determine whether the software to be detected is malware based on the network behavior data and API call sequence data generated during the operation of the software to be detected. At the same time, based on the model, network behavior features and API call behavior features can be extracted from the first original data set, and based on the extracted features, it can be determined whether the software to be detected is malware.

[0109] The malware detection method provided in this embodiment uses the network behavior data and API call sequence data generated during the operation of the software to be detected as the first original data set; using the pre-trained dynamic behavior detection model, the first original data set is feature extracted to determine the network behavior features and API call behavior features, and the software to be detected is judged to be malware based on the network behavior features and the API call behavior features. Through pre-training, the dynamic behavior detection model can achieve a high accuracy of malware detection. The model extracts features from the network behavior and API call behavior of the first original data set, and the feature extraction direction is increased, so that the dynamic behavior detection mining information is more comprehensive, the detection is comprehensive and in-depth, and the detection result has a high accuracy. In some experiments, the accuracy, recall and F1 score of the experimental results are usually used to characterize the effect of malware detection. The accuracy refers to the ratio of the number of correctly detected malicious samples to the number of all detected malicious samples, which reflects the false alarm rate of malicious sample detection, and the false alarm rate decreases with the increase of accuracy. The recall rate refers to the ratio of the number of correctly detected malicious samples to the number of all samples marked as malicious. It also reflects the false negative rate of malicious sample detection. The false negative rate decreases with the increase of the recall rate. The F1 score is a weighted reconciliation of the precision and recall rate, and is a comprehensive evaluation of the experimental results.

[0110] In some specific embodiments, the above-mentioned dynamic behavior detection model may include a feature extraction module, a weak learner and a strong learner, and the weak learner includes a network behavior feature learner and an API call behavior feature learner. Correspondingly, the above-mentioned use of a pre-trained dynamic behavior detection model to extract features from the first original data set, determine network behavior features and API call behavior features, and determine whether the software to be detected is malware based on the network behavior features and the API call behavior features. Specifically, it may include: using the feature extraction module to extract features from the first original data set to determine network behavior features and API call behavior features; using the network behavior feature learner to determine the first probability that the software to be detected is malware based on the network behavior features; using the API call behavior feature learner to determine the second probability that the software to be detected is malware based on the API call behavior features; using the strong learner to determine whether the software to be detected is malware based on the first probability and the second probability.

[0111] In this embodiment, the feature extraction module is used to extract features from the first original data set to determine the network behavior features and API call behavior features. The dynamic behavior detection model is a hierarchical model integration framework, which uses two weak learners, the network behavior feature learner and the API call behavior feature learner, as the first layer, and calculates the probability that the software to be detected is malware based on the network behavior features and the API call behavior features (referred to as the first probability and the second probability in this application, respectively); the framework uses the strong learner as the second layer, and comprehensively judges whether the software to be detected is malware based on the output results of the weak learners in the first layer.

[0112] This model can use different weak learners to perform preliminary detection on the software to be detected based on multiple features, and then use the strong learner to make a comprehensive judgment based on the detection results of multiple features, and finally determine the maliciousness of the software to be detected. Thus, the detection accuracy can be improved, and the detection effect of the dynamic behavior detection model can be better. In some experiments, the experimental results of the first-layer detection model in Table 1 and the experimental results of the second-layer detection model in Table 2 can be compared. The results of the second-layer model are the final experimental results of the dynamic behavior detection model. Compared with the results of the first-layer model, the accuracy rates are increased by 2.95% and 0.88% respectively. This reflects that there are problems in analyzing from a single behavior direction, and also proves the effectiveness and necessity of the dynamic behavior detection model.

[0113] Table 1 Experimental results of the first layer detection model

[0114]

[0115] Table 2 Experimental results of the second layer detection model

[0116]

[0117] In some specific embodiments, the network behavior features extracted by the above-mentioned dynamic behavior detection model may include at least one of file operation related features, registry operation related features, network connection request related features, domain name related features in network external connections, and intranet detection information related features; API call behavior features may include at least one of API call sequence order features and API call sequence content features.

[0118] Specifically, traditional network behavior research only extracts features from file operations, registry operations, and simple network connection request information. To enhance its versatility, this application expands the features of domain names and intranet detection information in network external connections.

[0119] Among them, in terms of file operation behavior, there are obvious differences between benign software and some types of malware. For example, ransomware will traverse files of a specific format on the host, and then encrypt some of the files; in order to evade malware detection, some Trojan programs will hide the real malicious code in the resource file, and then release it from the resource file to the local during operation. Therefore, through the relevant features of file operation behavior, benign software and some malware can be effectively distinguished. In this embodiment, API list data can be extracted from network behavior data, and compared with API list data of non-malware software to determine whether there is a different behavior from non-malware software in the file operation behavior of the software to be detected. It mainly includes features such as whether to traverse certain specific files, whether to read and write certain specific files, whether to modify certain specific files, whether to create certain specific files, whether to delete certain specific files, and whether to move certain specific files. In this application, it is summarized as file operation related features.

[0120] In terms of registry operation behavior, the registry is equivalent to the database of the Windows system, storing various types of parameters, and is directly related to the startup of the system, the loading of hardware drivers, and the operation of some applications. In order to run normally, various applications will operate on the registry, but the registry items operated by some malware are quite different from those of non-malware. For example, malware may modify the InternetExplorer\Main\StartPage item under the registry HKEY_LOCAL_MACHINE directory to hijack the IE browser; malware may add a new value to the AuthRoot\Certificates item under the registry HKEY_LOCAL_MACHINE directory to add a root certificate to the target host to facilitate subsequent man-in-the-middle attacks. Similar to the file operation behavior analysis method, the registry operation behavior of the software to be detected can be determined by extracting API list data from network behavior data, and the type of registry operation behavior can be used as a registry operation-related feature to appropriately improve the generalization ability of the model. These features mainly include whether to open and close certain specific registry items, whether to read certain specific registry items, whether to write certain specific registry items, whether to create certain specific registry items, and whether to delete certain specific registry items.

[0121] In terms of network connection behavior, initiating a network connection externally is a prerequisite for malware to spread or be controlled. In view of this feature, this embodiment can analyze the network external connection behavior of the software to be detected in detail. The Uniform Resource Locator (URL) accessed by the application is obtained from the network behavior data generated during the operation of the software to be detected, and the analysis determines whether the URL uses the Hypertext Transfer Protocol Secure (HTTPS), whether the URL contains a domain name or an Internet Protocol (IP) interconnection protocol between networks, the Hidden Markov model (HMM) coefficient of the domain name in the URL, and the resource type requested in the URL. Features such as these are summarized as network connection request-related features in this application.

[0122] In terms of domain names in network outreach, most websites currently use HTTPS for encrypted communication to improve security, but HTTPS certificates need to be deployed, which means a certain cost. Most malware do not have security requirements and generally use HTTP. Some malware do not need to use domain names as communication channels, and applying for domain names requires a certain cost, so domain names will not be bound to IPs; for websites that bind domain names, it is also necessary to distinguish whether the domain name is a malicious domain name. Generally, the domain names of regular websites are character combinations with special meanings or normal semantics, but the domain names of malicious websites contain a large number of disordered characters. By calculating the HMM coefficient of the domain name, normal domain names and malicious domain names can be effectively distinguished. Some malware will load malicious code files from remote servers, and these malicious code files are usually various types of script files. Therefore, the above communication protocol type, whether the domain name is bound, whether the domain name is a disordered character combination, and the type of resource requested can be used as domain name-related features in network outreach.

[0123] In terms of intranet detection information, malware such as worms often use the victim host as a springboard to perform a series of intranet host discovery and vulnerability scanning behaviors, and then spread the infection to the intranet. These behaviors can directly distinguish malware from non-malware. In the analysis of the intranet detection behavior of the software to be detected, this embodiment can determine whether the software to be detected has intranet IP segment communication behavior by parsing the network behavior data, and use it as one of the intranet detection information related features.

[0124] Among them, when the software to be detected is running, all API call behaviors of the software to be detected can be monitored through the hook technology. According to past experience, there are large differences in the API access sequences between benign software and different types of malware. Therefore, the API call sequence after vectorization processing can be used as the API call sequence content feature to characterize whether the software to be detected is malware.

[0125] Since the API sequence characteristics have obvious temporal characteristics, in some specific implementations, the N-Gram model can be selected to perform the above-mentioned vectorization processing.

[0126] The main idea of ​​N-Gram is to perform sliding collection of API call sequences with a window of size N to form word fragment sequences of length N, which are called gram. The frequency of all word fragment sequences is counted to form a gram list, that is, a vector space, and each gram is a dimension in the vector space. When N is 1, it is called a unigram, when N is 2, it is called a bigram, and when N is 3, it is called a trigram.

[0127] The model is based on an assumption: the appearance of the Nth word is only related to the N-1th word. Therefore, the probability of the entire API call sequence text appearing is equal to the product of the probability of each word appearing. If a sequence consists of n words, each word is denoted by w i , then the text probability calculation formula is as follows:

[0128] For unigrams:

[0129]

[0130] For bigram:

[0131]

[0132] For trigram:

[0133]

[0134] As can be seen from the above formula, N-Gram fully considers the temporal order between words. However, when N is larger, the gram list will be larger, that is, the vector space will be larger, and the sparsity problem in the data will also be aggravated, resulting in information loss. Therefore, in some embodiments, it is preferred to use bigram as a model for vector processing.

[0135] Specifically, the network behavior characteristics of the above-mentioned software can better characterize whether the software is malicious. Due to the development of the Internet and technology, more and more malware have certain network behaviors, and network behaviors can directly summarize the external performance characteristics of the program; malware can implement its functions through API calls. According to past experience, there are large differences in the accessed API sequences between benign application software and different types of malware, so API call behavior can comprehensively reflect the behavioral characteristics of the software from the bottom layer. Information mining from these two aspects of network behavior characteristics and API call behavior characteristics can make the characteristics of the software to be detected comprehensively and deeply detected, and improve the detection accuracy of the dynamic behavior detection model.

[0136] In other embodiments, the construction process of the above-mentioned dynamic behavior detection model may include: constructing the network behavior feature learner based on the Adaboost algorithm; constructing the API call behavior feature learner based on the bidirectional long short term memory (LSTM) algorithm; and constructing the strong learner based on the logistic regression algorithm. Correspondingly, after the network behavior feature is extracted, the Adaboost algorithm is used in the network behavior feature learner to calculate the network behavior feature, and finally output the first probability that the software to be detected is malware; after the API call behavior feature is extracted, the bidirectional LSTM algorithm is used in the API call behavior feature learner to calculate the API call behavior feature, and finally output the second probability that the software to be detected is malware; the logistic regression algorithm is used in the strong learner to calculate the first probability and the second probability, and finally output the detection result of whether the software to be detected is malware. This process can refer to Figure 3 .

[0137] The basic principle of the Adaboost algorithm is to reasonably combine multiple weak classifiers to make them a stronger classifier. Adaboost adopts the idea of ​​iteration. Only one weak classifier is trained in each iteration, and the trained weak classifier will be used in the next iteration. That is to say, in the Nth iteration, there are a total of N weak classifiers, of which N-1 are previously trained, and their various parameters are no longer changed. The Nth classifier is trained this time. The relationship between the weak classifiers is that the Nth weak classifier is more likely to classify the data that the first N-1 weak classifiers did not classify, and the final classification output depends on the comprehensive effect of these N classifiers. The Adaboost algorithm has superior performance in binary classification tasks, fast computing speed, and high accuracy. In other words, the above-mentioned network behavior feature learner can be a weak learner with a strong classification effect composed of several weak classifiers.

[0138] In the bidirectional LSTM model, the feedforward layer and the reverse layer jointly affect the output layer. As shown in formulas (4), (5), and (6), the feedforward layer performs forward calculations and saves the output of the forward hidden layer at each moment. The reverse layer performs reverse calculations and saves the output of the backward hidden layer at each moment. Finally, the output of the feedforward layer and the reverse layer at each moment is combined to obtain the final output.

[0139] h t =f(w1x t +w2h t-1 )(4)

[0140] h′ t =f(w3x t +w5h′ t+1 )(5)

[0141] o t =g(w4h t +w6h′ t )(6)

[0142] Among them, w1~w6 are shared weights, x t For each moment of input h t The final output at each moment, h′ t is the output of the backward hidden layer, o t Output information for a certain moment.

[0143] The bidirectional LSTM model statistically analyzes the state information before and after each moment, which fully matches the situation of API call behavior. The processing of information at each moment depends on the LSTM module, which is mainly composed of cell state, forget gate, input gate and output gate. The cell state is used to save the memory information at time t; the forget gate is responsible for selectively discarding the information in the cell state, and the sigmoid function is used to process the h of the previous sequence. t-1 and x of this sequence t Activate and remove part of the information in the cell state of the previous layer; the input gate consists of two parts, as shown in formulas (7) and (8). The first part determines the information that needs to be updated to the cell state through the input gate containing the sigmoid layer, and the second part converts this information into a form that can be added to the cell state through the tanh function.

[0144] i t =σ(W i *[h t-1 ,x t ]+b i )(7)

[0145]

[0146] Among them, i tIndicates the information to be updated at a certain moment, W i is the weight matrix of some updated information, W C is the weight rejection matrix of a cell state, is the candidate cell state at a certain moment, b i is the bias value of the updated information, b C is the bias value of a cell state.

[0147] The output gate selectively outputs the contents of the cell state, which also consists of two parts. As shown in formulas (9) and (10), the first part selects the information to be output through the sigmoid function, and the second part formats this information through the tanh function.

[0148] O t =σ(W o *[h t-1 ,x t ]+b o )(9)

[0149] h t =o t *tanh(C t )(10)

[0150] Among them, O t Output information for a certain moment, W o is the weight matrix of some output information, b o is the bias value of a certain output information, C t is the cell state at a certain moment.

[0151] The implementation of each function in the program requires a series of API combinations. These APIs are interrelated. The call of each API is not only related to the previous API, but also to the subsequent API, and has a strong temporal feature. Similarly, the API call sequence data has a strong temporal feature. The bidirectional LSTM algorithm is suitable for processing sequence data and has an absolute advantage in processing the API call sequence data of this application.

[0152] In some embodiments, the dynamic behavior detection model training process includes: using the network behavior data and API call sequence data generated during the operation of the sample software as a sample data set, and extracting network behavior features and API call behavior features from the sample data set. According to the network behavior features of the extracted sample data set, the network behavior feature learner is trained, and the training is stopped and the first probability sample result is output after the preset first training stop condition is reached. According to the API call behavior features of the extracted sample data set, the API call behavior feature learner is trained, and the training is stopped and the second probability sample result is output after the preset second training stop condition is reached. According to the first probability sample result output by the network behavior feature learner and the second probability sample result output by the API call behavior feature learner, the strong learner is trained until the preset third training stop condition is reached and the result of whether the sample software is malware is finally output.

[0153] The above-mentioned preset first training stop condition, preset second training stop condition, and preset third training stop condition are stop conditions that may be used in the model training process, and the three can be the same conditions or different conditions. Specifically, it can be the number of iterations, or the training duration, or the learning rate, or the value of the loss function, etc. For example, the preset first training stop condition can be set to a certain number of iterations. When the training reaches the set number of iterations, the network behavior feature learner training is completed, and the final output result determines the first probability sample.

[0154] The training process of the dynamic behavior detection model is a layered model training process. First, the first layer learner is trained, and then the second layer learner is trained with the output of the first layer learner, thus completing the training process of the entire model. The model can be trained multiple times to continuously increase the accuracy of the dynamic behavior detection model in detecting malware.

[0155] In other embodiments, it is also possible to determine whether the sum of the number of network behavior features and the number of API call behavior features is less than a preset number; if the sum of the number of network behavior features and the number of API call behavior features extracted by the dynamic behavior detection model is less than the preset number, it can be determined that the number of network behavior features and API call behavior features is insufficient, and the detection effect of the dynamic behavior detection model may not be accurate. At this time, if the dynamic behavior detection model detects that the software to be detected is not malware, the pre-trained static detection model can be used to assist in detecting whether the software to be detected is malware.

[0156] In this real-time example, the entire malware detection method uses a dynamic behavior detection model and a static detection model. For the convenience of description, it can be called a dynamic and static combined detection model. For the specific architecture and detection process, please refer to Figure 4 .

[0157] The preset number is pre-set. For example, the preset number may be thirty percent of the sum of the number of network behavior features and the number of API call behavior features; or, it may be a specific value. This is not limited here, and those skilled in the art may adjust the size of the preset number according to the detection accuracy requirements.

[0158] Some malware may use evasion techniques such as anti-virtual machine and anti-debugging for dynamic behavior detection, which will reduce the number of network behavior features and API call behavior features extracted by the dynamic behavior detection model of the malware, resulting in insufficient mining information, making dynamic behavior detection extremely difficult, and obtaining less feature data that can be used as evidence of malware. The dynamic behavior detection model has a low accuracy rate for detecting malware. Since static detection has the advantage of not being affected by the virtual machine detection mechanism, in this embodiment, the software to be detected can be detected using a pre-trained static detection model, which can effectively make up for the defects of the dynamic behavior detection model, thereby having a higher detection accuracy rate and a better overall detection effect. In some experiments, Table 3 shows the experimental results of the dynamic and static combined detection model. Although the accuracy rate is only 0.21% higher than that of the dynamic behavior detection model, the false negative rate is significantly reduced in the sample data set with virtual machine detection, which can prove that the dynamic and static combined detection model can effectively make up for the defects of the dynamic behavior detection model, thereby having a higher detection accuracy rate.

[0159] Table 3 Experimental results of dynamic and static combined detection model

[0160]

[0161] In some embodiments, the training process of the static detection model may include: determining that the source data of the software to be detected is a second original data set, extracting PE original features of the second original data set, determining the executable file PE original features, and judging whether the software to be detected is malware based on the PE original features. Wherein, the PE original features include: PE's own attributes, the number of section tables of the location of the program entry point relative to the entire program, whether the first 20 bytes of the function entry contain jump instructions, the number of sections for loading code, the number of sections for loading data, the ratio of the program's file size (FileSize) to the file size (VirtualSize) mapped to memory, the average entropy value of all sections, whether there are other sections with executable permissions except the code section, and at least one of the dynamic link library distribution features of the import table and export table.

[0162] Among them, the inherent attributes of PE are global features of the software to be detected.

[0163] Among them, whether to load the configuration table feature. In the early days, it was used to describe the PE header information. After XP, it was mainly used to store the SEH handle of the secure structured exception handler. When the SEH handle does not exist in the configuration table, the exception handler in the software will not be executed. In some embodiments, the loading configuration table feature can indicate that the software to be detected is malware.

[0164] Among them, whether to use the exception table feature. The exception table stores the starting position information of the SEH-related code. In some embodiments, the use of the exception table feature can characterize the software to be detected as malicious software.

[0165] Among them, whether to turn on the NX bit feature. That is, whether to turn on the Data Execution Prevention (DEP) function. The introduction of this security mechanism is to prevent malware programs from exploiting overflow vulnerabilities to damage the system. Generally, overflow refers to stack overflow or heap overflow. When the code uses some dangerous functions and there is no limit on the length of data input, the malware program sends a large amount of malicious data to the input point so that the data overflows into the data area, and then guides the program to execute the data. For example, the malware program causes the data to overflow into the stack area, and guides the program to execute the malicious code. In some embodiments, turning on the NX bit feature can characterize the software to be detected as malware.

[0166] Among them, whether to enable the relocation function feature. For malicious software programs such as worm viruses, one of their functions is to infect other benign programs, which means that the malicious program needs to inject malicious code into the benign program. In ordinary software development, there will be a base address when the program is loaded into the memory, and the positions of most variables in the program are actually based on the relative position of this base address. When the malicious code is injected into the host program, its base address will change, so the positions of these variables need to be relocated. In some embodiments, enabling the relocation function feature can characterize the software to be detected as malware.

[0167] Among them, whether to enable the resource loading function feature. Currently, malware programs widely use resource release technology. When the malware program needs to load additional dynamic link libraries, pictures, videos and other files, these files will be loaded into the program as resources and released during operation. In this way, the program can exist as a separate EXE, which is concise and not easy to be discovered by security software. In some embodiments, enabling the resource loading function feature can characterize the software to be detected as malware.

[0168] Among them, whether to enable the digital signature feature. Regular software generally uses a regular digital signature certificate for digital signature, while most malware programs are not digitally signed. A small number of malicious programs will steal the digital signature certificate of regular software, pretending to be the software's subsidiary software, and deceive the antivirus software. In some embodiments, enabling the digital signature feature can indicate that the software to be detected is malware.

[0169] Among them, whether to enable the thread local storage technology TLS feature. All threads in a process share the same address space. Then for global variables and static variables, all threads access the same resource, which will cause interference between multiple threads in accessing the variable. TLS can solve this problem better. It packs global variables and static variables into a section. When a new thread is created, this section will be copied to the free space of the process as a copy. The thread accesses the global variable similarly to the access to the local variable, and there will be no synchronization problem. Malicious programs use TLS callbacks for anti-debugging. Generally, debuggers start from the program entry point (Original Entry Point, OEP), but TLS can run code before OEP, which means that malicious programs can debug and detect the TLS callback function to determine whether the process is being debugged. In some embodiments, enabling the TLS feature can characterize the software to be detected as malware.

[0170] Specifically, for the common behavior of shelling in malware, this embodiment extracts five features: the position of the OEP of the program relative to the entire program, the number of section tables, whether the first 20 bytes of the function entry contain jump instructions, and the number of sections for loading code and sections for loading data. A large number of malware evade the detection of the original malicious code by security devices by shelling. When the program is shelled, the original application is generally encrypted, and then a new section is added to the end of the program for decryption. Therefore, the original OEP of the program will be modified to the function entry of the newly added section, and after the code of the newly added section is decrypted, it will jump to the original application for normal operation. This will cause the OEP of the program to be relatively backward relative to the entire program, and there will be a jump operation at the function entry, jumping to the source of the shelling code, and the encryption of the original code may cause the number of section tables to be reduced, and the number of sections for loading code and sections for loading data may change accordingly.

[0171] Specifically, for the compression behavior in malware shelling, the three features of the ratio of the FileSize and VirtualSize of the extracted program and the average entropy value of all sections in this embodiment are all Boolean data. During the shelling operation of the malware, part of the shell code will compress the original code. The compression operation will reduce the ratio of the FileSize and VirtualSize of the program, and the ratio of the FileSize and VirtualSize of some sections will also be reduced. In addition, as the amount of data in some segments decreases, their average entropy value may also decrease. In malicious detection, Shannon entropy is usually used to detect packaged or compressed malware. According to the selected threshold, binary files are classified as benign or malware.

[0172] Specifically, for the payload hiding behavior in malware, the static detection model extracts whether there are other sections with executable permissions in addition to the code section as a feature. Malware generally loads malicious code into data sections other than the code section as a hiding, and then guides the loading and running of the malicious code by pointing to the malicious code through a pointer. Therefore, there are other sections with executable permissions in addition to the code section.

[0173] Specifically, in order to fully reflect the behavior of benign and malicious samples from the bottom layer, the static detection model uses the distribution of the dynamic link library to which the imported functions in the import table belong as a feature, and a total of 150 dynamic link libraries are counted. Malware usually calls APIs in certain dynamic link libraries at a high frequency, and there are significant differences in the APIs called between normal software and malware, so the dynamic link library call situation is selected as a feature to appropriately improve the generalization ability of the model.

[0174] The final detection effect of the static detection model depends to a great extent on the extraction of PE original data features, so it is very necessary to extract effective features. The static detection model is improved on the basis of existing technologies, and effective feature extraction is performed from more aspects, so that the static detection model can mine sufficient information and increase the accuracy of the static detection model in detecting malware.

[0175] In the example of the present application, the malware detection model training method is used to train the above-mentioned dynamic behavior detection model, and the dynamic behavior detection model includes a weak learner and a strong learner, and the weak learner includes a network behavior feature learner and an API call behavior feature learner. The method includes: using the network behavior data and API call sequence data generated during the operation of the sample software as a sample data set; extracting features from the sample data set to determine the network behavior features and API call behavior features of the sample data set; training the network behavior feature learner based on the network behavior features of the sample data set; training the API call behavior feature learner based on the API call behavior features of the sample data set; after reaching the preset first training stop condition, determining the first probability sample based on the final output result of the network behavior feature learner; after reaching the preset second training stop condition, determining the second probability sample based on the final output result of the API call behavior feature learner; based on the first probability sample and the second probability sample, training the strong learner until reaching the preset third training stop condition.

[0176] The model training method of this embodiment is consistent with the training process of the dynamic behavior detection model in the above-mentioned malware detection method. Its specific implementation method and the beneficial effects produced can be referred to the above-mentioned embodiment and will not be repeated here.

[0177] Figure 5 A schematic diagram of the structure of a malware detection device provided in an embodiment of the present application is shown in FIG. Figure 5 As shown, the malware detection device 500 of this embodiment includes: a data set determination module 501 and a malware detection module 502 .

[0178] The data set determination module 501 is used to use the network behavior data and API call sequence data generated during the operation of the software to be detected as the first original data set;

[0179] The malware detection module 502 is used to use a pre-trained dynamic behavior detection model to extract features from the first original data set, determine network behavior features and API call behavior features, and determine whether the software to be detected is malware based on the network behavior features and the API call behavior features.

[0180] Optionally, the dynamic behavior detection model includes a feature extraction module, a weak learner and a strong learner; the weak learner includes a network behavior feature learner and an API call behavior feature learner;

[0181] The feature extraction module 503 is specifically used to extract features from the first original data set using the feature extraction module to determine network behavior features and API call behavior features;

[0182] The network behavior feature learner module 504 is specifically used to use the network behavior feature learner to determine a first probability that the software to be detected is malware based on the network behavior feature;

[0183] The API calling behavior feature learner module 505 is specifically used to use the API calling behavior feature learner to determine the second probability that the software to be detected is malware based on the API calling behavior feature;

[0184] The strong learner module 506 is specifically configured to use the strong learner to determine whether the to-be-detected software is malware based on the first probability and the second probability.

[0185] Optionally, the network behavior feature includes at least one of: a file operation related feature, a registry operation related feature, a network connection request related feature, a domain name related feature in an external network connection, and an intranet detection information related feature;

[0186] The API call behavior feature includes at least one of an API call sequence order feature and an API call sequence content feature.

[0187] Optionally, the device further comprises a learner construction module 507, which is used to:

[0188] Based on the Adaboost algorithm, construct the network behavior feature learner;

[0189] Based on the bidirectional LSTM algorithm, the API call behavior feature learner is constructed;

[0190] The strong learner is constructed based on a logistic regression algorithm.

[0191] Optionally, the device further includes a model training module 508, which is used to:

[0192] The network behavior data and API call sequence data generated during the running of the sample software are used as sample data sets;

[0193] Extracting features from the sample data set to determine network behavior features and API call behavior features of the sample data set;

[0194] Based on the network behavior characteristics of the sample data set, training the network behavior feature learner;

[0195] Based on the API call behavior features of the sample data set, training the API call behavior feature learner;

[0196] After reaching a preset first training stop condition, determining a first probability sample based on a final output result of the network behavior feature learner;

[0197] After reaching a preset second training stop condition, determining a second probability sample based on a final output result of the API calling behavior feature learner;

[0198] Based on the first probability sample and the second probability sample, the strong learner is trained until a preset third training stop condition is reached.

[0199] Optionally, the device further includes a static detection module 509, which is used to:

[0200] Determine whether the sum of the number of the network behavior features and the number of the API call behavior features is less than a preset number;

[0201] If it is determined that the software to be detected is not malware based on the network behavior characteristics and the API call behavior characteristics, and it is determined that the sum of the number of the network behavior characteristics and the number of the API call behavior characteristics is less than a preset number, a pre-trained static detection model is used to detect whether the software to be detected is malware.

[0202] Optionally, when the static detection module 509 uses a pre-trained static detection model to detect whether the software to be detected is malware, it is specifically used to:

[0203] Using the source data of the software to be detected as a second original data set;

[0204] Using a pre-trained static detection model, extracting features from the second original data set, determining the original features of the executable file PE, and judging whether the software to be detected is malware according to the original features of the PE;

[0205] The PE original features include: PE's own attributes, the number of section tables of the location of the program entry point relative to the entire program, whether the first 20 bytes of the function entry contain jump instructions, the number of sections for loading code, the number of sections for loading data, the ratio of the program's FileSize to VirtualSize, the average entropy value of all sections, whether there are other sections with executable permissions except the code section, and at least one of the dynamic link library distribution features of the import table and export table.

[0206] The device of this embodiment can be used to execute the method of any of the above embodiments. Its implementation principle and technical effects are similar and will not be described in detail here.

[0207] Figure 6 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application is shown in FIG. Figure 6As shown, the electronic device 600 of this embodiment may include: a memory 601 and a processor 602 .

[0208] The memory 601 stores a computer program that can be loaded by the processor 602 and execute the method in the above embodiment.

[0209] The processor 602 and the memory 601 are connected, for example, via a bus.

[0210] Optionally, the electronic device 600 may further include a transceiver. It should be noted that in actual applications, the number of transceivers is not limited to one, and the structure of the electronic device 600 does not constitute a limitation on the embodiments of the present application.

[0211] The processor 602 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor 602 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0212] The bus may include a path to transmit information between the above components. The bus may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0213] The memory 601 can be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0214] The memory 601 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 602. The processor 602 is used to execute the application code stored in the memory 601 to implement the contents shown in the above method embodiment.

[0215] The electronic devices include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs, desktop computers, etc. It can also be a server, etc. Figure 6 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0216] The electronic device of this embodiment can be used to execute the method of any of the above embodiments, and its implementation principle and technical effect are similar, which will not be described in detail here.

[0217] The present application also provides a computer-readable storage medium storing a computer program that can be loaded by a processor and execute the method in the above embodiment.

[0218] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

Claims

1. A malware detection method, characterized in that: include: The network behavior data and API call sequence data generated during the operation of the software to be detected are used as the first original data set; Using a pre-trained dynamic behavior detection model, feature extraction is performed on the first original data set to determine network behavior features and API call behavior features, and whether the software to be detected is malware is judged based on the network behavior features and the API call behavior features; the dynamic behavior detection model includes a feature extraction module, a weak learner and a strong learner; the weak learner includes a network behavior feature learner and an API call behavior feature learner; The training process of the dynamic behavior detection model includes: The network behavior data and API call sequence data generated during the running of the sample software are used as sample data sets; Extracting features from the sample data set to determine network behavior features and API call behavior features of the sample data set; Based on the network behavior characteristics of the sample data set, training the network behavior feature learner; Based on the API call behavior features of the sample data set, training the API call behavior feature learner; After reaching a preset first training stop condition, determining a first probability sample based on a final output result of the network behavior feature learner; After reaching a preset second training stop condition, determining a second probability sample based on a final output result of the API calling behavior feature learner; Based on the first probability sample and the second probability sample, the strong learner is trained until a preset third training stop condition is reached.

2. The method according to claim 1, characterized in that The method of using the pre-trained dynamic behavior detection model to extract features from the first original data set, determining network behavior features and API call behavior features, and judging whether the software to be detected is malware based on the network behavior features and the API call behavior features includes: Using a feature extraction module to extract features from the first original data set, and determine network behavior features and API call behavior features; Using the network behavior feature learner, based on the network behavior feature, determine a first probability that the software to be detected is malware; Using the API call behavior feature learner, determining a second probability that the software to be detected is malware based on the API call behavior feature; Using the strong learner, it is determined whether the software to be detected is malware based on the first probability and the second probability.

3. The method according to claim 1 or 2, characterized in that: The network behavior characteristics include: at least one of file operation related characteristics, registry operation related characteristics, network connection request related characteristics, domain name related characteristics in network external connection, and intranet detection information related characteristics; The API call behavior feature includes at least one of an API call sequence order feature and an API call sequence content feature.

4. The method according to claim 2, characterized in that: Also includes: Based on the Adaboost algorithm, construct the network behavior feature learner; Based on the bidirectional long short-term memory algorithm, construct the API call behavior feature learner; The strong learner is constructed based on a logistic regression algorithm.

5. The method according to any one of claims 1, 2 and 4, characterized in that: Also includes: Determine whether the sum of the number of the network behavior features and the number of the API call behavior features is less than a preset number; If it is determined that the software to be detected is not malware based on the network behavior characteristics and the API call behavior characteristics, and it is determined that the sum of the number of the network behavior characteristics and the number of the API call behavior characteristics is less than a preset number, a pre-trained static detection model is used to detect whether the software to be detected is malware.

6. The method according to claim 5, characterized in that The using of a pre-trained static detection model to detect whether the software to be detected is malware includes: Using the source data of the software to be detected as a second original data set; Using a pre-trained static detection model, extracting features from the second original data set, determining the original features of the executable file PE, and judging whether the software to be detected is malware according to the original features of the PE; The PE original features include: PE's own attributes, the number of section tables of the location of the program entry point relative to the entire program, whether the first 20 bytes of the function entry contain jump instructions, the number of sections for loading code, the number of sections for loading data, the ratio of the file size of the program to the file size mapped to the memory, the average entropy value of all sections, whether there are other sections with executable permissions except the code section, and at least one of the dynamic link library distribution features of the import table and export table.

7. A model training method, characterized in that: Used to train a dynamic behavior detection model, the dynamic behavior detection model includes a weak learner and a strong learner; the weak learner includes a network behavior feature learner and an API call behavior feature learner; the method includes: The network behavior data and API call sequence data generated during the running of the sample software are used as sample data sets; Extracting features from the sample data set to determine network behavior features and API call behavior features of the sample data set; Based on the network behavior characteristics of the sample data set, training the network behavior feature learner; Based on the API call behavior features of the sample data set, training the API call behavior feature learner; After reaching a preset first training stop condition, determining a first probability sample based on a final output result of the network behavior feature learner; After reaching a preset second training stop condition, determining a second probability sample based on a final output result of the API calling behavior feature learner; Based on the first probability sample and the second probability sample, the strong learner is trained until a preset third training stop condition is reached.

8. A malware detection device, characterized in that: include: A data set determination module, used to use the network behavior data and API call sequence data generated during the operation of the software to be detected as the first original data set; A malware detection module, used to use a pre-trained dynamic behavior detection model to perform feature extraction on the first original data set, determine network behavior features and API call behavior features, and judge whether the software to be detected is malware based on the network behavior features and the API call behavior features; the dynamic behavior detection model includes a feature extraction module, a weak learner and a strong learner; the weak learner includes a network behavior feature learner and an API call behavior feature learner; The model training module is used to use the network behavior data and API call sequence data generated during the operation of the sample software as a sample data set; perform feature extraction on the sample data set to determine the network behavior features and API call behavior features of the sample data set; Based on the network behavior characteristics of the sample data set, training the network behavior feature learner; Based on the API call behavior features of the sample data set, training the API call behavior feature learner; After reaching a preset first training stop condition, determining a first probability sample based on a final output result of the network behavior feature learner; After reaching a preset second training stop condition, determining a second probability sample based on a final output result of the API calling behavior feature learner; Based on the first probability sample and the second probability sample, the strong learner is trained until a preset third training stop condition is reached.

9. An electronic device, characterized in that: include: Memory and processor; The memory is used to store program instructions; The processor is used to call and execute the program instructions in the memory to perform the method according to any one of claims 1-7.

Images