Malicious code detection model processing method, detection method and device

Abstract

The present application relates to a detection model processing method, detection method and device for malicious code. The method comprises: referring to a target behavior type feature set, generating a sample behavior feature group of code training samples based on the code behavior type of the sample code behavior recorded by the sample behavior record set; training a detection model based on the sample behavior feature group and the sample label. Since malicious code behavior of an attack nature is usually only generated during the execution process of malicious code, that is, whether the code behavior is malicious can directly reflect whether the code that generates the code behavior is malicious, detection based on the code behavior through the detection model will not be bypassed like the file characteristics of the code, thereby improving the training effect of the detection model, and then improving the accuracy of subsequent malicious code detection. In addition, the iterative training process of the detection model and the storage of the detection data as increments in the sample database are both automatically deployed, thereby improving efficiency and saving labor costs.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a malicious code detection model processing method, detection method, device, computer equipment, storage medium and computer program product. Background Art

[0002] With the rapid development of computer technology, computer technology has penetrated into all aspects of life. As a result, computer security has also become an important issue. Among them, malicious code running on computer devices has posed a great challenge to computer security. Therefore, it is necessary to detect malicious code running on computer devices.

[0003] In the related art, malicious code detection is mainly achieved through file feature detection. When performing file feature detection, the structural features of the code file to be tested are determined, so as to detect whether the structural features exist in a pre-established malicious code feature library. If so, it is determined that the code file to be tested contains malicious code. However, malicious code inspection through file feature detection is prone to missed detection, and the accuracy of malicious code detection is low. Summary of the invention

[0004] Based on this, it is necessary to provide a malicious code detection model processing method, detection method, device, computer equipment, storage medium and computer program product with high malicious code detection accuracy in response to the above technical problems.

[0005] On the one hand, the present application provides a malicious code detection model processing method, the method comprising:

[0006] Obtaining a sample behavior record set of a code training sample, where the sample behavior record set records sample code behaviors generated after the corresponding code training sample is run;

[0007] Obtain a target behavior type feature set, where the target behavior type feature set includes code behavior types used to train a detection model;

[0008] Referring to the target behavior type feature set, based on the code behavior type of the sample code behavior recorded in the sample behavior record set, determine the sample behavior type belonging to the target behavior type feature set;

[0009] Based on the sample behavior types belonging to the target behavior type feature set, a sample behavior feature group of the code training sample is generated;

[0010] Obtain sample labels for characterizing malicious attributes of code training samples, and train a detection model based on the sample behavior feature group and sample labels.

[0011] In one of the embodiments, the update termination condition includes the presence of a behavior type feature set having a detection effect evaluation value greater than a preset threshold in the behavior type feature set population after the code behavior type update process.

[0012] In one of the embodiments, the update process includes at least one of: aggregating different code behavior types, deleting code behavior types, adding code behavior types, disassembling code behavior types, or changing code behavior types.

[0013] In one of the embodiments, the sample behavior feature group has feature bits that correspond one-to-one to the code behavior types in the target behavior type feature set; in the sample behavior feature group, the feature bits corresponding to the sample behavior types belonging to the target behavior type feature set are the first value, and the feature bits in the sample behavior feature group that remain after excluding the feature bits with the first value are the second value.

[0014] On the other hand, the present application also provides a malicious code detection model processing device, the device comprising:

[0015] A first acquisition module is used to acquire a sample behavior record set of a code training sample, where the sample behavior record set records sample code behaviors generated after the corresponding code training sample is run;

[0016] A second acquisition module is used to acquire a target behavior type feature set, where the target behavior type feature set includes a code behavior type used to train a detection model;

[0017] A determination module, for determining the sample behavior type belonging to the target behavior type feature set based on the code behavior type of the sample code behavior recorded in the sample behavior record set with reference to the target behavior type feature set;

[0018] A generation module, for generating a sample behavior feature group of a code training sample based on a sample behavior type belonging to a target behavior type feature set;

[0019] The training module is used to obtain sample labels for characterizing malicious attributes of code training samples, and train a detection model based on the sample behavior feature group and the sample labels.

[0020] In one of the embodiments, a first acquisition module is used to run a code training sample in a closed behavior-aware environment, and the behavior-aware environment is configured to record sample code behaviors generated after the code training sample is run; based on the sample code behaviors recorded by the behavior-aware environment, a sample behavior record set of the code training sample is constructed.

[0021] In one embodiment, the target behavior type feature set is obtained through a target behavior type feature set construction step; the apparatus further comprises:

[0022] The first construction module is used to obtain an initial behavior type feature set and a plurality of sample behavior record sets corresponding to a plurality of code samples; determine the occurrence probability of malicious code samples and non-malicious code samples in the plurality of code samples, and calculate the information entropy of the code samples according to their respective occurrence probabilities; determine the conditional entropy of each code behavior type in the initial behavior type feature set; determine the information gain value of each code behavior type according to the information entropy and the conditional entropy of each code behavior type; the information gain value is used to indicate the contribution of the corresponding code behavior type to malicious code detection; from the initial behavior type feature set, select the code behavior types corresponding to the first preset number of information gain values ​​when sorted in descending order by the information gain value, and construct the target behavior type feature set.

[0023] In one of the embodiments, the first construction module is also used to obtain, for the target code behavior corresponding to each code behavior type in the initial behavior type feature set, a first number of sample behavior record sets that record the target code behavior and a second number of sample behavior record sets that do not record the target code behavior in multiple sample behavior record sets; determine a third number of malicious code samples and a fourth number of non-malicious code samples in the code samples corresponding to the sample behavior record sets that record the target code behavior in the multiple sample behavior record sets; determine a fifth number of malicious code samples and a sixth number of non-malicious code samples in the code samples corresponding to the sample behavior record sets that do not record the target code behavior in the multiple sample behavior record sets; and calculate the conditional entropy of any code behavior type based on the first number, the second number, the third number, the fourth number, the fifth number, and the sixth number.

[0024] In one embodiment, the target behavior type feature set is obtained through a target behavior type feature set construction step; the apparatus further comprises:

[0025] The second construction module is used to obtain an initial behavior type feature set and multiple sample behavior record sets corresponding to multiple code samples; for the target code behavior corresponding to each code behavior type in the initial behavior type feature set, refer to the sample code behaviors recorded in each of the multiple sample behavior record sets, and determine, among the multiple code samples, the code sample in which the target code behavior is recorded in the sample behavior record set, and use it as the target code sample; calculate a first proportion of non-malicious code samples in the target code sample to non-malicious code samples in the multiple code samples; calculate a second proportion of malicious code samples in the target code sample to malicious code samples in the multiple code samples; obtain the contribution of each code behavior type to malicious code detection based on the first proportion and the second proportion; screen the initial behavior type feature set based on the contribution of each code behavior type to malicious code detection to obtain the target behavior type feature set.

[0026] In one embodiment, the target behavior type feature set is updated by a target behavior type feature set updating step; the apparatus further comprises:

[0027] An updating module is used to obtain a behavior type feature set population, the behavior type feature set population includes at least one behavior type feature set; iteratively update the behavior type feature sets in the behavior type feature set population according to the code behavior type until the update termination condition is reached to obtain the final updated behavior type feature set population; and screen out the target behavior type feature set in the final updated behavior type feature set population.

[0028] In one of the embodiments, the update module is also used to obtain an initial behavior type feature set and multiple sample behavior record sets of multiple code samples; for each code behavior type in the initial behavior type feature set, based on the distribution of code behaviors corresponding to each code behavior type in multiple sample behavior record sets, and the distribution of malicious code samples and non-malicious code samples in multiple code samples, calculate the contribution of each code behavior type to malicious code detection; based on the contribution of each code behavior type to malicious code detection, filter the initial behavior type feature set to obtain filtered code behavior types; and combine the filtered code behavior types to obtain a behavior type feature set population.

[0029] In one of the embodiments, the update module is also used to select at least part of the behavior type feature sets in the behavior type feature set population to be updated in this iteration; update at least part of the code behavior types in each selected behavior type feature set; based on the trained detection model, detect each behavior type feature set in the behavior type feature set population after the code behavior type update processing, and determine the behavior type feature set population after the update processing in this iteration according to the corresponding detection results.

[0030] In one of the embodiments, the update module is further used to obtain a sample behavior feature group set and a sample label set corresponding to each behavior type feature set in the behavior type feature set population after the code behavior type update processing, and each sample behavior feature group set is generated with reference to the corresponding behavior type feature set; input each sample behavior feature group in each sample behavior feature group set into a trained detection model to obtain a detection result set corresponding to each sample behavior feature group set; and screen out at least some behavior type feature sets in the behavior type feature set population after the code behavior type update processing according to the detection result set and the sample label set corresponding to each behavior type feature set.

[0031] In one of the embodiments, the update module is also used to obtain a detection effect evaluation value of each behavior type feature set when used for malicious code detection based on the detection result set and sample label set corresponding to each behavior type feature set; based on the detection effect evaluation value of each behavior type feature set, a preset number of behavior type feature sets are screened out when sorted in descending order by the detection effect evaluation value from the behavior type feature set population after the code behavior type update processing.

[0032] In one of the embodiments, the update termination condition includes the presence of a behavior type feature set having a detection effect evaluation value greater than a preset threshold in the behavior type feature set population after the code behavior type update process.

[0033] In one of the embodiments, the update process includes at least one of: aggregating different code behavior types, deleting code behavior types, adding code behavior types, disassembling code behavior types, or changing code behavior types.

[0034] In one of the embodiments, a determination module is used to reconstruct at least a portion of the sample code behaviors recorded in the sample behavior record set to obtain a reconstructed sample behavior type; and to determine, among the reconstructed sample behavior types, the sample behavior types that belong to the target behavior type feature set with reference to the target behavior type feature set.

[0035] In one of the embodiments, the determination module is also used to obtain a behavior reconstruction file, which is used to record the code behavior type and reconstruction processing method required for reconstruction when reconstructing the code behavior to the code behavior type included in the target behavior type feature set; when at least a part of the sample code behaviors recorded in the sample behavior record set belong to the code behavior type required for reconstruction in the behavior reconstruction file, at least a part of the sample code behaviors are reconstructed according to the corresponding reconstruction processing method recorded in the behavior reconstruction file.

[0036] In one of the embodiments, the sample behavior feature group has feature bits that correspond one-to-one to the code behavior types in the target behavior type feature set; in the sample behavior feature group, the feature bits corresponding to the sample behavior types belonging to the target behavior type feature set are the first value, and the feature bits in the sample behavior feature group that remain after excluding the feature bits with the first value are the second value.

[0037] In one of the embodiments, there are multiple detection models and target behavior type feature sets, and each detection model corresponds to a target behavior type feature set; the training module is also used to test each trained detection model through code samples to obtain a detection effect evaluation value of the corresponding target behavior type feature set; according to the detection effect evaluation value of each target behavior type feature set, the detection model used for malicious code detection is screened out from all trained detection models.

[0038] On the other hand, the present application also provides a computer device, including a memory and a processor, the memory stores a computer program, and the processor implements the steps in the above-mentioned malicious code detection model processing method when executing the computer program.

[0039] On the other hand, the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned malicious code detection model processing method are implemented.

[0040] On the other hand, the present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned malicious code detection model processing method when executed by a processor.

[0041] The above-mentioned malicious code detection model processing method, device, computer equipment, storage medium and computer program product obtain the sample behavior record set and target behavior type feature set of the code training sample, refer to the target behavior type feature set, and generate the sample behavior feature group of the code training sample based on the code behavior type of the sample code behavior recorded in the sample behavior record set, and train the detection model based on the sample behavior feature group and the sample label. Since malicious code behavior is usually only generated during the execution process of malicious code, that is, whether the code behavior is malicious can directly reflect whether the code that generates the code behavior is malicious, the code behavior generated during the operation of the code is used in the training process of the detection model, and the detection is performed through the detection model, which will not be bypassed like the file characteristics of the code, thereby improving the training effect of the detection model and further improving the accuracy of subsequent malicious code detection.

[0042] On the other hand, the present application provides a method for detecting malicious code, the method comprising:

[0043] Obtaining a behavior record set of the target code, where the behavior record set records the code behavior generated after the target code is run;

[0044] Obtaining a target behavior type feature set, where the target behavior type feature set includes code behavior types required by a trained detection model to detect malicious code;

[0045] Referring to the target behavior type feature set, based on the code behavior type of the code behavior recorded in the behavior record set, determine the target behavior type belonging to the target behavior type feature set;

[0046] generating a behavior feature group of a target code based on a target behavior type belonging to a target behavior type feature set;

[0047] Through the trained detection model, malicious code detection is performed based on the behavioral feature group to obtain the malicious attributes of the target code.

[0048] On the other hand, the present application provides a malicious code detection device, the device comprising:

[0049] A first acquisition module is used to acquire a behavior record set of the target code, where the behavior record set records the code behavior generated after the target code is run;

[0050] A second acquisition module is used to acquire a target behavior type feature set, where the target behavior type feature set includes code behavior types required by the trained detection model to detect malicious code;

[0051] A determination module, for determining a target behavior type belonging to the target behavior type feature set based on the code behavior type recorded in the behavior record set with reference to the target behavior type feature set;

[0052] A generating module, for generating a behavior feature group of a target code based on a target behavior type belonging to a target behavior type feature set;

[0053] The detection module is used to detect malicious code based on the behavioral feature group through the trained detection model to obtain the malicious attributes of the target code.

[0054] In one of the embodiments, a determination module is used to reconstruct at least a portion of the code behavior recorded in the behavior record set to obtain a reconstructed behavior type; and refer to a target behavior type feature set to determine a target behavior type belonging to the target behavior type feature set among the reconstructed behavior types.

[0055] In one of the embodiments, the detection module is also used to push out inspection request information for inspecting the malicious attributes of the target code; obtain the inspection result returned based on the inspection request information, and the inspection result is used to determine the sample label of the target code when it is used as a code training sample; and re-train the detection model based on the target code as a code training sample and the corresponding sample label.

[0056] On the other hand, the present application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the malicious code detection method provided above when executing the computer program.

[0057] On the other hand, the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the malicious code detection method provided above are implemented.

[0058] On the other hand, the present application also provides a computer program product, including a computer program, which implements the steps of the malicious code detection method provided above when executed by a processor.

[0059] The above-mentioned malicious code detection method, apparatus, computer equipment, storage medium and computer program product obtains a target code behavior record set, refers to a target behavior type feature set, generates a target code behavior feature group based on the code behavior type recorded in the behavior record set, and detects the target code through a detection model based on the behavior feature group. Since malicious code behavior is usually only generated during the execution process of malicious code, that is, whether the code behavior is malicious can directly reflect whether the code that generates the code behavior is malicious, the code behavior generated during the operation of the code is used in the training process of the detection model, and the detection is performed through the detection model, which will not be bypassed like the file characteristics of the code, thereby improving the training effect of the detection model and further improving the accuracy of subsequent malicious code detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A diagram of an application environment of a malicious code detection model processing method and a malicious code detection method in one embodiment;

[0061] Figure 2 A schematic diagram of a flow chart of a malicious code detection model processing method in one embodiment;

[0062] Figure 3 A schematic diagram of a flow chart of a method for detecting malicious code in one embodiment;

[0063] Figure 4 A schematic diagram of a flow chart of a malicious code detection model processing method in another embodiment;

[0064] Figure 5 is a schematic diagram of the architecture of a detection environment in one embodiment;

[0065] Figure 6 A schematic diagram of the deployment process of a detection model in an embodiment;

[0066] Figure 7 A schematic diagram of a framework flow of a test process and an iterative training process in one embodiment;

[0067] Figure 8 It is a structural block diagram of a malicious code detection model processing device in one embodiment;

[0068] Fig. 9 is a structural block diagram of a malicious code detection device in one embodiment;

[0069] Fig.10FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0071] First, the terms involved in the embodiments of the present application are briefly explained:

[0072] Malicious code: refers to code that has no effect but can bring danger. The safest definition is to regard all unnecessary code as malicious. Unnecessary code has a broader meaning than malicious code, including all software that may conflict with the security policy of an organization. The code (including malicious code) mentioned in the embodiments of the present application usually refers to executable programs in computer devices. Some malicious codes have all the functions that a complete program should have and can be propagated and run independently. Such malicious codes do not need to be hosted in another program and can be called independent malicious codes. Some malicious codes are just a piece of code that needs to be embedded in a complete program and propagated and run as a component of the program. Such malicious codes can be called non-independent malicious codes, which will cause their host programs to be malicious.

[0073] Malicious attribute: usually corresponds to two types of code evaluation results, namely malicious code and non-malicious code.

[0074] Honeypot technology: refers to a technology that deceives attackers by placing some hosts, network services or information as bait to induce attackers to attack them. In this way, the attack behavior can be captured and analyzed, the tools and methods used by the attackers can be understood, and the attack intentions and motives can be inferred. This allows defenders to clearly understand the security threats they face and enhance the security protection capabilities of the actual system through technical and management means.

[0075] Code behavior: refers to the behavior exhibited by the code after execution, specifically the behavior exhibited by the process or thread created after the code is executed.

[0076] Information entropy: used to describe the uncertainty of random variables. In the embodiment of the present application, information entropy is used to describe the uncertainty of whether the code is malicious code or non-malicious code.

[0077] Conditional entropy: refers to the uncertainty of a random variable under the condition of a known variable. In the embodiment of the present application, conditional entropy is used to describe the uncertainty of whether a certain code is malicious code or non-malicious code when a certain type of code behavior is generated.

[0078] In addition, in the embodiments of the present application, the training process of the detection model and the subsequent malicious code detection application process mainly involve artificial intelligence (AI), which is designed based on the machine learning (ML) technology in artificial intelligence. Artificial intelligence is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence.

[0079] Artificial intelligence is the study of the design principles and implementation methods of various intelligent machines, so that the machines have the functions of perception, reasoning and decision-making. Artificial intelligence technology mainly includes computer vision technology, natural language processing technology, and machine learning / deep learning. With the research and progress of artificial intelligence technology, artificial intelligence has been studied and applied in many fields, such as common smart homes, smart customer service, virtual assistants, smart speakers, smart marketing, unmanned driving, automatic driving, robots and smart medical care. It is believed that with the development of technology, artificial intelligence will be applied in more fields and play an increasingly important role.

[0080] Machine learning is a multi-disciplinary subject involving probability theory, statistics, approximation theory, convex analysis, and algorithmic complexity theory. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Compared with data mining, which seeks mutual characteristics between big data, machine learning focuses more on algorithm design, allowing computers to automatically "learn" rules from data and use the rules to predict unknown data.

[0081] Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all areas of artificial intelligence. Machine learning and deep learning usually include technologies such as artificial neural networks, belief networks, reinforcement learning, transfer learning, and inductive learning. Reinforcement learning (RL), also known as reinforcement learning, evaluation learning, or enhanced learning, is one of the paradigms and methodologies of machine learning. It is used to describe and solve the problem of how an agent can maximize its rewards or achieve specific goals through learning strategies during its interaction with the environment.

[0082] In some embodiments, the malicious code detection model processing method or malicious code detection method provided in the embodiments of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 can communicate with the server 104 directly or indirectly through a wired or wireless network, and the embodiment of the present application does not specifically limit this. In addition, the terminal 102 or the server 104 can be used separately to execute the detection model processing method of the malicious code in the embodiment of the present application, or can be used separately to execute the detection method of the malicious code in the embodiment of the present application; it can also be that the two are used in collaboration to execute the detection model processing method of the malicious code in the embodiment of the present application, or it can be that the two are used in collaboration to execute the detection method of the malicious code in the embodiment of the present application.

[0083] For separate execution, one of the implementation processes of the detection model processing method when the server 104 executes malicious code separately is taken as an example. Specifically, the server 104 can obtain and store the sample behavior record set of the code training sample in advance, refer to the target behavior type feature set stored locally, and determine the sample behavior type belonging to the target behavior type feature set based on the code behavior type of the sample code behavior recorded in the sample behavior record set, and thus generate a sample behavior feature group. The sample behavior feature group can be used as an input item of the detection model stored locally, and the sample label of the code training sample can be used as a supervision item. The detection model can be trained through supervised learning.

[0084] Similarly, for separate execution, one of the implementation processes of the detection method for malicious code when the terminal 102 executes it separately is taken as an example. Specifically, the terminal 102 can obtain a set of behavior records of the target code and obtain a target behavior type feature set. The terminal 102 refers to the target behavior type feature set, determines the target behavior type belonging to the target behavior type feature set among the code behavior types recorded in the behavior record set, and generates a behavior feature group of the target code based on this. The terminal 102 inputs the behavior feature group into the detection model to obtain the malicious attributes of the target code.

[0085] For collaborative execution, taking one of the implementation processes of the detection model processing method for collaborative execution of malicious code by the two as an example, the terminal 102 can collect code training samples, and can obtain and store the target behavior type feature set issued by the server 104. After collecting new code training samples, the terminal 102 can refer to the locally stored target behavior type feature set, determine the sample behavior type belonging to the target behavior type feature set based on the code behavior type of the sample code behavior recorded in the sample behavior record set, and generate a sample behavior feature group based on this, and the terminal 102 uploads the sample behavior feature group to the server 104. The server 104 can use the sample behavior feature group as an input item of the locally stored detection model, and the sample label of the code training sample can be used as a supervision item, and the detection model can be trained through supervised learning. The data storage system can store the code training samples obtained by the server 104, and can also store the detection model, so as to train the detection model based on the code training samples later. The data storage system can be integrated on the server 104, or on the cloud or other servers.

[0086] Similarly, for collaborative execution, taking one of the implementation processes of the detection method of the collaborative execution of malicious code by the two as an example, the terminal 102 can obtain a behavior record set of the target code and upload the behavior record set to the server 104. The server 104 can obtain the target behavior type feature set from the local, and refer to the target behavior type feature set, determine the target behavior type belonging to the target behavior type feature set among the code behavior types recorded in the behavior record set, and generate a behavior feature group based on this. The server 104 inputs the behavior feature group into the locally stored detection model to obtain the malicious attributes of the target code.

[0087] It is understandable that for collaborative execution, the server 104 can be integrated in the cloud, that is, the malicious code detection model processing method and the malicious code detection method mentioned in the embodiment of the present application can be implemented through cloud technology. Cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software, and network in a wide area network or a local area network to realize data calculation, storage, processing, and sharing.

[0088] Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model. It can form a resource pool, which can be used on demand and is flexible and convenient. Cloud computing technology will become an important support. The backend services of the technical network system require a large amount of computing and storage resources, such as video websites, picture websites and more portal websites. With the rapid development and application of the Internet industry, in the future, each item may have its own identification mark, which needs to be transmitted to the backend system for logical processing. Data of different levels will be processed separately. All kinds of industry data need strong system backing support, which can only be achieved through cloud computing.

[0089] The embodiments of the present application may involve the field of cloud security applications in cloud technology, which is specifically reflected in the detection of malicious codes running in different computer devices in a wide area network or a local area network through cloud computing technology. Among them, cloud security refers to the general term for security software, hardware, users, institutions and security cloud platforms based on cloud computing business model applications. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior judgment. Through a large number of meshed clients, it monitors the abnormal behavior of software in the network, obtains the latest information of Trojan malicious programs on the Internet, and sends it to the server for automatic analysis and processing, and then distributes virus and Trojan solutions to each client.

[0090] The main research directions of cloud security include: 1. Cloud computing security, mainly studying how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection and compliance auditing, etc. 2. Cloudification of security infrastructure, mainly studying how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event, information collection and processing platform through cloud computing technology, realizing the collection and correlation analysis of massive information, and improving the control and risk control capabilities of the entire network security events. 3. Cloud security services, mainly studying various security services provided to users based on cloud computing platforms, such as antivirus services.

[0091] Among them, the terminal 102 can be, but is not limited to, various desktop computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. Applications can be run on the terminal, such as video applications, or audio applications, etc., for presenting code data. The server 104 can be a background server corresponding to software or web pages, applets, etc., or a server specifically used for detecting codes, which is not specifically limited in the embodiments of the present application. The server 104 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms.

[0092] In some embodiments, combined with the above-mentioned explanations of terms, technical explanations and implementation environment descriptions, such as Figure 2 As shown, a malicious code detection model processing method is provided, and the method is applied to a computer device (the computer device can be specifically Figure 1 The terminal or server in the example is used to illustrate, including the following steps:

[0093] Step 202: Obtain a sample behavior record set of the code training sample, where the sample behavior record set records sample code behaviors generated after the corresponding code training sample is run.

[0094] Combined with the relevant explanations of the above-mentioned glossary, the code training sample can be an executable program that serves as a training sample. It is understandable that after the program is run, it will naturally generate a series of code behaviors, such as command execution, code injection, memory retention, credential collection (mainly referring to user names and passwords) and information review, etc. Therefore, the computer device can record these code behaviors and summarize them into a behavior record set. It is understandable that since the code behaviors are recorded, the same type of sample code behaviors may exist in the sample behavior record set. For example, during the running of a certain code, the code behavior of "command execution" is first generated, followed by the code behavior of "code injection", and then the code behavior of "command execution". At this time, there will be two code behaviors of "command execution" in the behavior record set of the code.

[0095] It should be noted that a code may be in a running state for a long time, and thus a large number of code behaviors may be generated. At this time, when the computer device obtains the behavior record set of the code, it is unlikely to record all the code behaviors generated during the entire running process of the code. This is mainly because if all the code behaviors are recorded, it will take up a large storage space, and the subsequent processing of so many code behaviors will take up more system resources. Therefore, when the embodiment of the present application obtains the sample behavior record set, the computer device can obtain the sample code behavior of the code training sample in some time periods during the running process. For example, it can be a sample code behavior within a time period, or it can be a sample code behavior within multiple time periods, and the embodiment of the present application does not make specific restrictions on this. In addition, the same code training sample may generate multiple running processes. For a certain code training sample, the sample code behavior recorded in the sample behavior record set of the code training sample can be generated in the same running process, or it can be generated in multiple running processes, and the embodiment of the present application does not make specific restrictions on this.

[0096] It should also be noted that, since the running process of the program in the computer device is actually embodied by the process or thread as the basic execution entity, the code behavior mentioned in the embodiment of the present application can be the process or thread corresponding to the code generated during the running process. In addition, in order to record the code behavior, the sample code behavior in the sample behavior record set needs to be represented in a presentation form. In the actual implementation process, it can be represented by a string, and different code behavior types correspond to different strings; it can also be represented by encoding, and different code behavior types can be encoded in the same encoding method, such as binary encoding or hexadecimal encoding, etc. The embodiment of the present application does not specifically limit the presentation form of the code behavior in the behavior record set.

[0097] For ease of explanation, the embodiment of the present application takes the use of binary coding to represent code behavior as an example. For example, the code behavior type of "command execution" can be represented by the binary code "001", and the code behavior type of "code injection" can be represented by the binary code "010". Therefore, the sample behavior record set can actually be a set of a series of binary codes. It should be noted that in the examples mentioned above, the coding lengths of the binary codes corresponding to different code behavior types are the same. In the actual implementation process, the coding lengths of the binary codes corresponding to different code behavior types may also be different. For example, the code behavior type of "command execution" can use a three-bit binary code "001", and the code behavior type of "code injection" can use a four-bit binary code "0010". The embodiment of the present application does not make specific limitations on this.

[0098] From the above content, it can be seen that the computer device can "obtain sample code behaviors of code training samples in some time periods during operation", that is, by limiting the amount of data obtained, to limit the size of the sample behavior record set. In the actual implementation process, the computer device can also limit the size of the sample behavior record set by directly limiting the size of the sample behavior record set. Specifically, taking the code behavior represented by the binary code mentioned above, and each code behavior is encoded with 3 bits as an example, assuming that the size of the sample behavior record set is directly limited to recording 100 sample code behaviors, then combined with the relevant instructions that each code behavior is encoded with 3 bits, it can be seen that the sample behavior record set can be 100*3=300 bits. Therefore, the size of the sample behavior record set can be limited to 300 bits.

[0099] It should be noted that, since the above process is mainly to limit the size of the sample behavior record set by directly limiting the size of the sample behavior record set, when the computer device "acquires data", that is, when acquiring the sample code behavior generated by the code training sample after running, it is not necessary to limit the amount of data acquired, but to sort the acquired data based on the size of the sample behavior record set. Specifically, if the amount of data acquired during the actual implementation is relatively large, such as 200 sample code behaviors, the computer device can calculate that all sample code behaviors will occupy 200*3=600 bits when represented by binary coding, and the size of the sample behavior record set is 300 bits. Therefore, the computer device can delete all acquired code behaviors, such as retaining only 100 code behaviors.

[0100] The above process is one of the feasible ways to reduce the amount of data. Considering the combinability of binary codes as codes, if the binary codes of the 200 sample code behaviors obtained are connected by the first bit of the code to form a group of "code streams", the computer device can also reduce the amount of data by "code stream truncation". It should be noted that 200 sample code behaviors can form 600 bits. In theory, 300 bits are randomly truncated, and then the 300 bits are arranged in the order of the coding bits, with every 3 bits as a group of binary codes, 100 binary codes can be obtained, which just fits the limited size of the sample behavior record set.

[0101] However, due to random truncation, the integrity of the original three-bit binary code may be destroyed, resulting in the reorganization of adjacent binary codes formed after the end-to-end connection, so that the sample code behavior recorded in the sample behavior record set generated after truncation is too different from the original sample code behavior. This may be equivalent to randomly constructing a sample behavior record set, which makes the recorded sample code behavior meaningless and is not based on the actual situation of the code running. Based on the above description, in the actual implementation process, truncation can be performed in units of 3 bits. For example, in combination with the above example, if the "coding stream" is 600 bits, the computer device can truncate the bits from the 4th to the 303rd bit as the basis for constructing the sample behavior record set. At this time, the integrity of the original three-bit binary code will not be destroyed to maintain the original reference meaning of the binary code.

[0102] The above mainly describes how to organize the acquired data based on the size of the sample behavior record set to limit the size of the sample behavior record set when the amount of data acquired during the actual implementation is relatively large. In the actual implementation process, there may also be a situation where the amount of data acquired is relatively small, such as when 60 code behaviors are acquired. At this time, the computer device can calculate that all sample code behaviors will occupy 60*3=180 bits when represented by binary coding, and the size of the sample behavior record set is 300 bits. Obviously, at this time, the bits occupied by all sample code behaviors have not reached the limit size of the sample behavior record set.

[0103] At the same time, it is understandable that there are usually more than one code training sample. From this, it is extended to whether the actual size of the sample behavior record set of different code training samples needs to be completely consistent. Since the subsequent processing process may not be related to the size of the sample behavior record set, in the actual implementation process, it is possible not to set a limit size for the sample behavior record set, or to set a limit size and only use the limit size to reduce the amount of data when the amount of data obtained is relatively large. On this basis, try to retain the amount of data obtained as much as possible.

[0104] Of course, it is considered that sample behavior record sets of the same size may be convenient for unified processing due to the consistent data record format. Therefore, in the actual implementation process, for a certain code training sample, when all the sample code behaviors obtained have not reached the limit size of the sample behavior record set, the computer device can "supplement the data volume" of all the obtained code behaviors. It can be understood that the supplementary data can be content that does not have a referential meaning, otherwise the sample code behavior that has never been generated by the sample code training sample may be added to the sample behavior record set. Combined with the above description of the "coding stream", the way for the computer device to supplement the data volume can be to fill bits into the coding stream. Now let's explain in detail: if 60 code behaviors are obtained, it can be determined that a total of 180 bits are occupied, then supplementing 120 bits can reach the limit size of the sample behavior record set.

[0105] Since the sample code behavior corresponds to a binary code of 3 bits, if the bits are randomly filled, the integrity of the original binary code of 3 bits may be destroyed. Based on the same reason as above for not performing random truncation, the computer device can perform bit filling under the premise of maintaining the integrity of the original binary code of 3 bits. The specific filling method can be filling before the coding stream, filling after the coding stream, filling in the middle of the coding stream, or a combination of multiple methods. The embodiment of the present application does not specifically limit the filling method.

[0106] It should be noted that, in the above process, it is mentioned that "the supplementary data may be content that does not have a referential meaning", so the filling content here may not point to any code behavior type. In combination with the above content, the code behavior type of "command execution" is represented by the binary code "001", and the code behavior type of "code injection" is represented by the binary code "010", followed by "011" and so on. It can be seen that, at least in this example, the binary code "000" is not enabled for referring to the code behavior type. Therefore, in this example, all bits with a value of "0" can be filled. Of course, in the actual implementation process, the filling method can also be determined in combination with the specific binary code enabled when referring to the code behavior type to ensure that the filling content does not point to any code behavior type. The embodiment of the present application does not specifically limit the filling method.

[0107] In the above explanation about the representation of sample code behaviors through binary coding, it is mentioned that the sample behavior record set can be represented by binary coding through the end-to-end connection to form a "coding stream". Since it is end-to-end connection, there usually needs to be an order. The code behavior generated during the running process of the code will naturally form a time sequence of the generation of the code behavior. Therefore, in the actual implementation process, the sample behavior record set can be a sequence, in which the recorded sample code behaviors can be sorted according to the generation time sequence of the sample code behaviors.

[0108] It can be seen from the subsequent steps that when the computer device generates a sample behavior feature group, the feature bits in the sample behavior feature group actually correspond to the code behavior type. The sample behavior feature group is generated based on the sample behavior type belonging to the target behavior type feature set, and the sample behavior type belonging to the target behavior type feature set is determined based on the code behavior type of the sample code behavior recorded by the sample behavior record set. From the above process, it can be seen that the code behavior type corresponding to the feature bit in the sample behavior feature group is associated with the sample code behavior recorded by the sample behavior record set. Based on this association, the time sequence originally existing in the sample behavior record set can be transferred to the sample behavior feature group, so that the feature bit sorting is generated in the sample behavior feature group. Among them, the sorting of feature bits is actually the sorting between the corresponding code behavior types. The specific implementation process can refer to the description of the subsequent process.

[0109] It should be noted that, considering that when malicious code presents maliciousness during operation, there may indeed be a certain code behavior generation sequence, and this code behavior generation sequence may have a certain malicious logic. For example, the malicious behavior of a certain malicious code may be to first copy a large number of copies, and then generate multiple processes through a large number of copied malicious codes to reside in the memory for a long time, and finally continue to collect credentials through multiple processes that reside for a long time. It is obvious that this code behavior generation sequence can benefit the malicious code maker to the greatest extent. Therefore, the embodiment of the present application can introduce the sequence of generating sample code behaviors in the sample behavior record set, and use the sequence as one of the reference factors for training the detection model in the manner described in the above brief description, which may improve the detection accuracy of malicious code. However, considering the confusing nature of malicious code today and the randomness of the programming style of the malicious code maker, the code behavior generation sequence presented by the malicious code may no longer be associated with malicious logic, and the introduction of the code behavior generation sequence may have a counterproductive effect. Therefore, in actual implementation, it can be decided whether to introduce the code behavior generation sequence in the sample behavior record set based on actual conditions, and the embodiment of the present application does not make specific limitations on this.

[0110] Step 204: Obtain a target behavior type feature set, where the target behavior type feature set includes code behavior types used to train a detection model.

[0111] It is understandable that all code behaviors that the code can present can be collected in advance. Among all the collected code behaviors, usually only some of the code behaviors are malicious. For example, usually the code will not generate such behavior as checking information, which will affect information security and is usually a malicious code behavior. Therefore, which code behavior types of code behaviors may be malicious can be known in advance. Based on the above description, in this step, the computer device can first determine which code behavior types of code behaviors may be malicious, and then form a target behavior type feature set from these code behavior types.

[0112] Similar to the sample behavior record set, the code behavior type in the target behavior type feature set also needs to be represented in a presentation form. From the content in the above steps, it can be seen that the code behavior type can be represented by binary coding, and the sample code behavior in the sample behavior record set is also represented by binary coding. Every time there is a binary-coded record in the sample behavior record set, it represents that a code behavior of the corresponding code behavior type has been generated. Therefore, in this step, the code behavior type in the target behavior type feature set can be represented by binary coding. Of course, other presentation forms can also be used for representation, and the embodiments of the present application do not specifically limit this.

[0113] Step 206 : Referring to the target behavior type feature set, based on the code behavior type of the sample code behavior recorded in the sample behavior record set, determine the sample behavior type belonging to the target behavior type feature set.

[0114] It should be noted that the sample behavior feature group in the subsequent steps is actually used as the input item of the detection model. The target behavior type feature set is mainly used as a guide for generating input items, that is, it is used to determine the code behavior type required for the input item of the detection model. Among them, the input items may not necessarily completely cover all the code behavior types included in the target behavior type feature set, but the code behavior types covered by the input items are subordinate to the target behavior type feature set. It should also be noted that the code behavior types included in the target behavior type feature set are not static. One code behavior type may be broken down into multiple code behavior subtypes, and multiple code behavior types can also be aggregated into a new code behavior type.

[0115] From the contents of the above steps, it can be seen that the code behavior types in the target behavior type feature set are actually determined based on those code behaviors that may be malicious, and the target behavior type feature set is mainly used as a guide for generating input items. It can be seen that for the detection model, it is more concerned about whether the code has generated the code behavior corresponding to the code behavior type in the target behavior type feature set, and thus determines whether it is malicious code. Therefore, the process of "determining the sample behavior type belonging to the target behavior type feature set" in this step can be understood, at a certain level, as "taking the intersection" of all the code behavior types included in the target behavior type feature set and all the code behavior types corresponding to the sample code behaviors recorded in the sample behavior record set.

[0116] However, it has been explained above that the code behavior types included in the target behavior type feature set are not static, and some of the code behavior types included in the target behavior type feature set may not be obtained only by recording the code behavior. For example, all code behavior types corresponding to the sample code behaviors recorded in the sample behavior record set include two code behavior types, A1 and A2, while the target behavior type feature set includes a code behavior type A. Among them, A is aggregated from A1 and A2. Obviously, there is no sample code behavior of code behavior type A in the sample behavior record set, but A1 and A2 are closely related to A. The code behavior types in the target behavior type feature set are determined based on those code behaviors that may be malicious. Since A is considered to be a malicious code behavior type, it is obviously not possible to ignore the maliciousness of the two code behavior types A1 and A2 just because there is no sample code behavior of code behavior type A in the sample behavior record set.

[0117] Therefore, the "reference target behavior type feature set" is mentioned in this step, where the word "reference" mainly refers to the code behavior type corresponding to the sample code behavior recorded in the sample behavior record set, which may undergo certain changes in the direction of fitting the code behavior type in the target behavior type feature set. In this change, some code behavior types that were not originally covered by the sample behavior record set may be generated. However, this change still requires "code behavior types based on sample code behaviors recorded in the sample behavior record set." It should be noted that the "sample behavior type" mentioned in this step is mainly an expression that distinguishes it from the code behavior type originally covered by the sample behavior record set, and is essentially still a code behavior type.

[0118] It is understandable that the "sample behavior types" all belong to the target behavior type feature set, that is, they are all code behavior types in the target behavior type feature set. However, some "sample behavior types" may be covered by the sample behavior record set, and are generated by the "intersection" of the code behavior types covered by the sample behavior record set and the code behavior types included in the target behavior type feature set, and have not undergone any changes. At the same time, some "sample behavior types" may not be covered by the sample behavior record set, and are generated by the "intersection" of at least some of the code behavior types covered by the sample behavior record set and the code behavior types included in the target behavior type feature set.

[0119] For ease of understanding, take the example that the code behavior types covered by the sample behavior record set include A1, A2, B, C and E, and the code behavior types included in the target behavior type feature set include A, B1, C and D. Among them, A is formed by the aggregation of A1 and A2, and B is formed by the aggregation of B1 and B2. Therefore, with reference to the target behavior type feature set, the code behavior types covered by the sample behavior record set can be changed in the direction of fitting the code behavior types in the target behavior type feature set. Specifically, the code behavior types covered by the changed sample behavior record set may include A, B1, B2, C and E. Therefore, by taking the intersection, it can be determined that the sample behavior types belonging to the target behavior type feature set are A, B1 and C. It should be noted that the above-mentioned change methods are mainly aggregation and disassembly, and there may be other change methods in the actual implementation process, which is not specifically limited in the embodiments of the present application.

[0120] Step 208: Generate a sample behavior feature group of code training samples based on the sample behavior types belonging to the target behavior type feature set.

[0121] From the explanation of the above steps, it can be seen that the sample behavior feature group is used as an input item of the detection model, and the target behavior type feature set is mainly used as a guide for generating input items. It can be seen that for the detection model, it is more concerned about whether the code has generated the code behavior corresponding to the code behavior type in the target behavior type feature set, and thus determines whether it is malicious code. The sample behavior feature group is mainly used to indicate which sample code behaviors belonging to the code behavior type in the target behavior type feature set are generated by the code training sample. Or further, after the sample code behavior generated by the code training sample changes, which sample code behaviors belonging to the code behavior type in the target behavior type feature set are generated.

[0122] Therefore, in order to be able to indicate which sample code behaviors of the code behavior types in the target behavior type feature set are ultimately generated by the code training sample. The sample behavior feature group may have multiple feature bits, the number of feature bits may be consistent with the number of code behavior types in the target behavior type feature set, each feature bit refers to a code behavior type in the target behavior type feature set, and the information on each feature bit is a sample behavior feature. Therefore, the information on the feature bit may be expressed as 1 or 0. Among them, if the information on a feature bit in the sample behavior feature group is 1, it can be indicated that the code training sample ultimately generates the sample code behavior corresponding to the code behavior type referred to by the feature bit; if the information on a feature bit in the sample behavior feature group is 0, it can be indicated that the code training sample ultimately does not generate the sample code behavior corresponding to the code behavior type referred to by the feature bit. Of course, in the actual implementation process, the meanings of 1 and 0 can also be reversed, and the embodiments of the present application do not specifically limit this.

[0123] It should be noted that when multiple code training samples are used to train the detection model in the same batch, the code behavior types referred to by the feature bits at the same position in their respective sample behavior feature groups are the same. For example, code training samples a and b are used in the same batch of training processes. If the first feature bit in the sample behavior feature group of a refers to code behavior type A, then the first feature bit in the sample behavior feature group of b refers to code behavior type A, that is, the code behavior types referred to by the feature bits at the same position are the same. The sample behavior feature group is regarded as a feature as a whole. The reason why it needs to be the same is mainly to ensure that the input items in the same batch of training processes are all the same type of features. At the same time, for a certain model, the type of features used for the input items in its final training process usually requires the same type of features to be used in its subsequent application process. Therefore, for the sample behavior feature group input in the final training process and the behavior feature group input in the subsequent application process, the code behavior types referred to by the feature bits at the same position are the same.

[0124] Step 210: Obtain sample labels for characterizing malicious attributes of code training samples, and train a detection model based on the sample behavior feature group and the sample labels.

[0125] The malicious attribute may correspond to two code evaluation results, namely malicious code and non-malicious code. The computer device may perform supervised training on the detection model based on the sample label by taking the sample behavior feature group as input. The detection model may be a neural network model that implements the classification function, such as a recurrent neural network or a convolutional neural network, etc. The condition for the end of training may be the convergence of the detection model, etc., which is not specifically limited in the embodiments of the present application.

[0126] It should be noted that, in the actual implementation process, all code training samples can be divided into two parts, one part of which is used for the training process, and the other part can be used to test the trained detection model. It should also be noted that all code training samples can come from a sample database. The sample database may include malicious code samples and non-malicious code samples. The sources of samples in the sample database may include three parts: the first is the code samples shared by the open source code party, the second is the code samples generated by computer security related personnel in attack drills, and the third is the code samples captured in the network (which may include a wide area network or a local area network). Of course, in the actual implementation process, the sample database may also have other sources of code samples, and the embodiments of the present application do not specifically limit this.

[0127] The above-mentioned malicious code detection model processing method obtains the sample behavior record set and the target behavior type feature set of the code training sample, refers to the target behavior type feature set, generates the sample behavior feature group of the code training sample based on the code behavior type of the sample code behavior recorded in the sample behavior record set, and trains the detection model based on the sample behavior feature group and the sample label. Since malicious code behavior is usually only generated during the execution process of malicious code, that is, whether the code behavior is malicious can directly reflect whether the code that generates the code behavior is malicious, the code behavior generated during the running process of the code is used in the training process of the detection model, and the detection is performed through the detection model, which will not be bypassed like the file characteristics of the code, thereby improving the training effect of the detection model and further improving the accuracy of subsequent malicious code detection.

[0128] In addition, since the sample behavior feature group is generated with reference to the target behavior type feature set and based on the sample behavior record set, and the target behavior type feature set is composed of code behavior types that may be malicious, the sample behavior feature group can reflect the degree of maliciousness of the code behavior of the sample behavior record set as much as possible, and then use the sample behavior feature group as the input item of the detection model, which can improve the training effect of the detection model and thus improve the detection accuracy of subsequent malicious code.

[0129] Finally, since the detection model is used to detect the code, there is no need to frequently update the malicious code feature library like file feature detection, which causes the storage resources to continue to grow. Instead, it only needs to update the sample to retrain the detection model, that is, the detection model itself does not need to occupy too much storage resources, thus saving storage resources. At the same time, the increasing size of the malicious code feature library will also lead to an increase in the number of searches in the subsequent detection process, which will affect the detection efficiency and affect the system performance due to occupying too many processing resources. When using the detection model, only the input and output process is required to obtain the prediction result, which can improve the detection efficiency and reduce the impact on system performance.

[0130] As can be seen from the naming of the sample behavior record set, the sample code behavior of the code training sample needs to be recorded. Therefore, in some embodiments, obtaining the sample behavior record set of the code training sample includes: running the code training sample in a closed behavior perception environment, the behavior perception environment is configured to record the sample code behavior generated after the code training sample is run; based on the sample code behavior recorded in the behavior perception environment, a sample behavior record set of the code training sample is formed.

[0131] Specifically, the behavior-aware environment mainly uses some hosts, network services or information as bait to induce the attacker to attack them, so that the attack behavior can be perceived and recorded. It can even analyze the attack behavior to understand the tools and methods used by the attacker, infer the attack intentions and motivations, and conduct reverse tracing. The behavior-aware environment allows the defender to clearly understand the security threats they face and enhance the system's security protection capabilities through technical and management means. In actual implementation, the behavior-aware environment can be configured based on honeypot technology.

[0132] In addition, the reason why the "closed" behavior-aware environment is emphasized in the embodiments of the present application is mainly because the behavior-aware environment is actually a security resource, and its value lies in being detected, attacked, and damaged, so as to collect evidence of intrusion. In the actual implementation process, the behavior-aware environment will also be configured to provide certain loopholes to facilitate intrusion. However, it is understandable that if the computer device configured with the behavior-aware environment is infiltrated as a whole, not only will the purpose not be achieved, but it may also cause the intruder to use the computer device configured with the behavior-aware environment as a springboard to invade other computer devices, causing more serious consequences. Therefore, in the embodiments of the present application, "closed" mainly emphasizes that when configuring the behavior-aware environment, the trap-setting technology for setting loopholes for intrusion needs to be sufficiently secure, otherwise the code behavior cannot be effectively recorded.

[0133] The computer device runs the code training sample in a closed behavior-aware environment, and the behavior-aware environment can record the generated sample code behavior. Among them, the recorded time period and the representation form of the sample code behavior can refer to the description of the above embodiment, which will not be repeated here. The composition form of the sample behavior record set can be related to the representation form of the sample code behavior, and the embodiments of the present application do not specifically limit the composition form of the sample behavior record set. For example, if the sample code behavior is represented by binary coding, the composition form of the sample behavior record set can be a binary coding set.

[0134] In the above embodiment, since the code behavior can be perceived and recorded through a behavior perception environment with sufficient security, the perception and recording of malicious code behavior can be achieved while ensuring that the computer device configured with the behavior perception environment is not infiltrated as a whole, thereby enhancing the security of the computer device and the computer device system composed of all computer devices.

[0135] In the above embodiment, it is mentioned that the target behavior type feature set is based on the code behavior types that may be malicious, and an implementation method based on empirical judgment to obtain the target behavior type feature set is also given. It can be understood that in the actual implementation process, some code behavior types can be screened out from many code behavior types based on some quantifiable judgment basis to construct the target behavior type feature set. It should be noted that the "obtaining the target behavior type feature set" mentioned in the above training process of the detection model can be temporarily constructed during the training process, or it can be constructed in advance before training, and directly obtained and used during the training process. The embodiments of the present application do not make specific limitations on this. Based on this description, in some embodiments, the target behavior type feature set is obtained through a target behavior type feature set construction step, and the target behavior type feature set construction step includes:

[0136] Obtain an initial behavior type feature set and a plurality of sample behavior record sets corresponding to the plurality of code samples; determine the occurrence probabilities of malicious code samples and non-malicious code samples in the plurality of code samples, and calculate the information entropy of the code samples according to their respective occurrence probabilities; determine the conditional entropy of each code behavior type in the initial behavior type feature set; determine the information gain value of each code behavior type according to the information entropy and the conditional entropy of each code behavior type; the information gain value is used to indicate the contribution of the corresponding code behavior type to malicious code detection; from the initial behavior type feature set, select the code behavior types corresponding to the first preset number of information gain values ​​when sorted in descending order by the information gain value, and construct a target behavior type feature set.

[0137] Specifically, the initial behavior type feature set also includes code behavior types. The initial behavior type feature set can be composed of all known code behavior types, or it can be composed of code behavior types that may be malicious based on empirical judgment, as stated in the previous embodiment. The embodiment of the present application does not specifically limit the composition of the initial behavior type feature set. The initial behavior type feature set is mainly used as the basis for constructing the target behavior type feature set. The code behavior types in the target behavior type feature set constructed subsequently are derived from the initial behavior type feature set.

[0138] In addition to obtaining the initial behavior type feature set, the computer device can also obtain multiple sample behavior record sets corresponding to multiple code samples. Among them, each code sample corresponds to a sample behavior record set. It should be noted that the "code sample" here is mainly distinguished from the "code training sample" mentioned in the above embodiment. In the above embodiment, the "code training sample" mainly refers to the code sample used to train the detection model. The two may be essentially the same, and may even be the same code sample. The embodiments of the present application do not make specific limitations on this.

[0139] Among multiple code samples, which code samples are malicious code samples and which code samples are non-malicious code samples can be known in advance. Therefore, the computer device can calculate the probability of occurrence of malicious code samples and non-malicious code samples in multiple code samples based on the distribution of malicious code samples and non-malicious code samples in multiple code samples. Combined with the definition of information entropy, whether a code sample is a malicious code sample can be set as a random variable, and the value of the random variable is a malicious code sample or a non-malicious code sample, and the calculation process of the information entropy of the code sample can refer to the following formula (1):

[0140]

[0141] In the above formula (1), X represents a random variable, x i represents the i-th value of the random variable, n represents the total number of n possible values ​​of the random variable, p(x i ) represents the probability of the random variable taking the ith value. Corresponding to the embodiment of the present application, the random variable X has two values, and the probability of the random variable taking the two values ​​is the probability of occurrence of malicious code samples and non-malicious code samples in multiple code samples.

[0142] After determining the information entropy of the code sample, the computer device can determine the uncertainty of whether the code sample is a malicious code sample or a non-malicious code sample under different code behavior types as known conditions, that is, determine the conditional entropy of each code behavior type in the initial behavior type feature set. The conditional entropy can be calculated by referring to relevant definitions and formulas.

[0143] For any code behavior type in the initial behavior type feature set, the computer device can obtain the information gain value of the code behavior type by subtracting the information entropy from the conditional entropy of the code behavior type. Among them, the information entropy is used to represent the original uncertainty of the random variable, and the conditional entropy is used to represent the uncertainty of the random variable under a certain known condition. The difference between the two indicates the degree to which the uncertainty of the random variable is reduced under the known condition, and the difference between the two is the information gain value. Combined with the principle explanation, it is obvious that the larger the value of the information gain value of a certain code behavior type, the greater the degree of reduction in the uncertainty of whether the code sample is a malicious code sample or a non-malicious code sample under the known condition of the code behavior type (actually refers to the code behavior of the code sample that has generated the code behavior type as a known condition). This shows that for the inference of whether the code sample is a malicious code sample or a non-malicious code sample, the code behavior type has a relatively large contribution to the result orientation of the inference process. That is, the code behavior type has a relatively large contribution to malicious code detection.

[0144] It can be seen from the above content that the larger the information gain value, the greater the contribution of the corresponding code behavior type to malicious code detection. Therefore, the computer device can sort the information gain values ​​of the code behavior types in the initial behavior type feature set in descending order from large to small, and select a preset number of information gain values ​​with the top order. Based on the code behavior types corresponding to these information gain values, a target behavior type feature set is constructed. It should be noted that the information gain value can also be obtained by reverse difference calculation, that is, the conditional entropy of the code behavior type is subtracted from the information entropy. At this time, the information gain value will be set to the reverse meaning, that is, the smaller the information gain value, the greater the contribution of the corresponding code behavior type to malicious code detection, and the target behavior type feature set can be constructed by reverse selection. Which method is specifically selected during the actual implementation process is not specifically limited in the embodiments of the present application.

[0145] In the above embodiment, since the information gain values ​​of different code behavior types can be calculated, the contribution of different code behavior types to malicious code detection can be effectively judged through the information gain values. Based on this, the code behavior types that contribute more to malicious code detection can be screened out as much as possible in the initial behavior type feature set, and these code behavior types are used in the training process of the detection model, thereby improving the training effect of the detection model and further improving the accuracy of subsequent malicious code detection.

[0146] In some embodiments, determining the conditional entropy of each code behavior type in the initial behavior type feature set includes:

[0147] For the target code behavior corresponding to each code behavior type in the initial behavior type feature set, obtain a first number of sample behavior record sets that record the target code behavior and a second number of sample behavior record sets that do not record the target code behavior in multiple sample behavior record sets; determine a third number of malicious code samples and a fourth number of non-malicious code samples in the code samples corresponding to the sample behavior record sets that record the target code behavior in the multiple sample behavior record sets; determine a fifth number of malicious code samples and a sixth number of non-malicious code samples in the code samples corresponding to the sample behavior record sets that do not record the target code behavior in the multiple sample behavior record sets; and calculate the conditional entropy of any code behavior type based on the first number, the second number, the third number, the fourth number, the fifth number, and the sixth number.

[0148] Specifically, for any code behavior type in the initial behavior type feature set, the code behavior corresponding to the code behavior type can be used as the target code behavior. It is understandable that some of the multiple code samples may generate the target code behavior during operation, and some of the code samples may not generate the target code behavior during operation. Therefore, among the multiple sample behavior record sets, some of the sample behavior record sets may have the target code behavior recorded in them, and some of the sample behavior record sets may not have the target code behavior recorded in them. Therefore, the computer device can first determine which sample behavior record sets among the multiple sample behavior record sets have the target code behavior recorded in them, and count the first number; it can also determine which sample behavior record sets do not record the target code behavior, and count the second number.

[0149] For the sample behavior record sets in which the target code behavior is recorded in the multiple sample behavior record sets, the computer device can also determine which code samples are malicious code samples among all code samples corresponding to these sample behavior record sets, and count the third number; it can also determine which code samples are non-malicious code samples, and count the fourth number. For the sample behavior record sets in which the target code behavior is not recorded in the multiple sample behavior record sets, the computer device can also determine which code samples are malicious code samples among all code samples corresponding to these sample behavior record sets, and count the fifth number; it can also determine which code samples are non-malicious code samples, and count the sixth number.

[0150] For any code behavior type, the process of a computer device calculating the conditional entropy of the code behavior type based on the first to sixth quantities mentioned above includes: calculating a first probability of the target code behavior appearing in a plurality of sample behavior record sets and a second probability of not appearing based on the first to second quantities; calculating a third probability that the code sample is a malicious code sample and a fourth probability that it is a non-malicious code sample under the premise that the target code behavior appears based on the third and fourth quantities; calculating a fifth probability that the code sample is a malicious code sample and a sixth probability that it is a non-malicious code sample under the premise that the target code behavior does not appear based on the fifth and sixth quantities; and calculating the conditional entropy of the code behavior type based on the first to sixth probabilities.

[0151] Among them, according to the first probability to the sixth probability, the process of calculating the conditional entropy of the code behavior type may include: according to the third probability and the fourth probability, calculating the first information entropy of the code sample under the premise that the target code behavior appears; according to the fifth probability and the sixth probability, calculating the second information entropy of the code sample under the premise that the target code behavior does not appear; calculating the product of the first information entropy and the first probability, calculating the product of the second information entropy and the second probability, and taking the sum of the two products as the conditional entropy of the code behavior type. Specifically, the calculation process of the above conditional entropy can refer to the following formula (2):

[0152]

[0153] In the above formula (2), Y in H(Y / X) represents a random variable, X represents a given condition of the random variable X, and the whole represents the uncertainty of the random variable Y under the given condition of the random variable X. x represents a specific given condition, x∈X represents that x belongs to one of all the given conditions of the random variable X, and p(x) represents the probability of occurrence of the specific given condition x. H(Y / X=x) represents the information entropy of the random variable Y under the specific given condition X=x.

[0154] For ease of understanding, the sample labels of malicious attributes of multiple code samples and the contents of the sample behavior record set are shown in Table 1 below as an example:

[0155] Table 1

[0156] Command Execution Code Injection Memory residency Is it a malicious code sample? have have have yes none have none yes have none none no

[0157] Among them, the second, third and fourth rows in the table correspond to a code sample, and the first row indicates that the sample behavior record set of the code sample records three types of sample code behaviors, namely "command execution", "code injection" and "memory residence", and the code sample is a malicious code sample.

[0158] Based on Table 1 and the above formula (1), the information entropy of the code sample can be calculated as: -(2 / 3)*log(2 / 3)-(1 / 3)*log(1 / 3)=0.2763. For the code behavior type of "command execution", the value of the random variable X in the above formula (2) is "yes" or "no", which respectively represents the specific given condition that "the sample behavior record set records the code behavior of command execution" and the specific given condition that "the sample behavior record set does not record the code behavior of command execution".

[0159] Since only two of the three sample behavior record sets corresponding to Table 2 record the target code behavior of the type "command execution", the first number is 2 and the second number is 1. Since only the sample behavior record sets corresponding to the second and fourth rows in Table 2 record the target code behavior of the type "command execution", and the code sample corresponding to the second row is a malicious code sample, while the code sample corresponding to the fourth row is a non-malicious code sample, the third number is 1 and the fourth number is 1. Since only the sample behavior record set corresponding to the third row in Table 2 does not record the target code behavior of the type "command execution", and the code sample corresponding to the third row is a malicious code sample, the fifth number is 1 and the sixth number is 0.

[0160] Based on the above quantities, the values ​​of different factors in the above formula (2) can be calculated. Among them, p(x = "yes") = first quantity / (first quantity+second quantity) = 2 / 3. p(x = "no") = second quantity / (first quantity+second quantity) = 1 / 3. H(Y / X = x) can refer to the calculation process of the above formula (1), H(Y / X = "yes") = -[third quantity / (third quantity+fourth quantity)]*log[third quantity / (third quantity+fourth quantity]-[fourth quantity / (third quantity+fourth quantity)]*log[fourth quantity / (third quantity+fourth quantity]=-(1 / 2)*log(1 / 2)-(1 / 2)*log(1 / 2)=0.301.

[0161] H(Y / X=“None”)=-[fifth number / (fifth number+sixth number)]*log[fifth number / (fifth number+sixth number)]-[sixth number / (fifth number+sixth number)]*log[sixth number / (fifth number+sixth number)]=-1*log(1)-0=0. Combining the above values, the conditional entropy of the code type “command execution” can be calculated to be (2 / 3)*0.301+(1 / 3)*0=0.2.

[0162] In the above embodiment, since the conditional entropy of different code behavior types can be calculated, and the information gain value of different code behavior types can be calculated according to the conditional entropy of different code behavior types, the contribution of different code behavior types to malicious code detection can be effectively judged through the information gain value. Based on this, the code behavior types that contribute more to malicious code detection can be screened out as much as possible in the initial behavior type feature set, and these code behavior types are used in the training process of the detection model, so as to improve the training effect of the detection model, and then improve the accuracy of subsequent malicious code detection.

[0163] The above content mainly calculates the information gain of each code behavior type, and based on this, screens out the code behavior types that contribute more to malicious code detection, and uses this to construct the target behavior type feature set. In the actual implementation process, there can also be other ways to construct the target behavior type feature set. Therefore, in some embodiments, the target behavior type feature set is obtained through the target behavior type feature set construction step, and the target behavior type feature set construction step includes:

[0164] An initial behavior type feature set and multiple sample behavior record sets corresponding to multiple code samples are obtained; for a target code behavior corresponding to each code behavior type in the initial behavior type feature set, the sample code behaviors recorded in each of the multiple sample behavior record sets are referred to, and among the multiple code samples, a code sample having the target code behavior recorded in the sample behavior record set is determined and used as the target code sample; a first proportion of non-malicious code samples in the target code sample to non-malicious code samples in the multiple code samples is calculated; a second proportion of malicious code samples in the target code sample to malicious code samples in the multiple code samples is calculated; based on the first proportion and the second proportion, a contribution degree of each code behavior type to malicious code detection is obtained; based on the contribution degree of each code behavior type to malicious code detection, the initial behavior type feature set is screened to obtain a target behavior type feature set.

[0165] Specifically, the relevant description of the initial behavior type feature set can refer to the content of the previous embodiment, which will not be repeated here. For the code behavior type of "command execution", combined with the above Table 1, the computer device can determine that the code samples with target code behaviors recorded in the sample behavior record set are the code samples corresponding to the second and fourth rows in Table 1, and can be used as target code samples. Among them, the process of calculating the first proportion can refer to the following formula (3):

[0166] R b =N b (t) / S b (t); (3)

[0167] In the above formula (3), Nb (t) represents the number of non-malicious code samples in the target code sample, S b (t) represents the number of non-malicious samples in multiple code samples, R b Indicates the first proportion. Combined with the above Table 1, N b (t) has a value of 1, and S b (t) is 1, so R b Also 1.

[0168] The process of calculating the first proportion can refer to the following formula (4):

[0169] R m =N m (t) / S m (t); (4)

[0170] In the above formula (4), N m (t) represents the number of malicious code samples in the target code sample, S m (t) represents the number of malicious samples in multiple code samples, R m Indicates the second proportion. Combined with the above Table 1, N m (t) has a value of 1, and S m The value of (t) is 2, so R m is 0.5.

[0171] Combined with the above calculation process, it can be known that the first proportion can reflect the proportion of non-malicious code samples with target code behavior in all non-malicious code samples, and the second proportion can reflect the proportion of malicious code samples with target code behavior in all malicious code samples. It can be understood that the larger the second proportion is relative to the first proportion, the closer the code behavior type corresponding to the target code behavior is to the malicious code, and the target code behavior is more likely to appear in the code behavior generated by the malicious code. Therefore, in the actual implementation process, the computer device can calculate the ratio between the second proportion and the first proportion, and use it as the contribution of the code behavior type corresponding to the target code behavior to the malicious code detection. Of course, in the actual implementation process, other methods can also be used to calculate the contribution, such as taking the negative logarithm of the second proportion and the first proportion respectively, and taking the difference between the negative logarithm values ​​between the two as the contribution of the code behavior type to the malicious code detection. The embodiment of the present application does not specifically limit the calculation method.

[0172] After calculating the contribution of each code behavior type to malicious code detection, the computer device can filter the code behavior types in the initial behavior type feature set. Among them, the screening method can be a threshold comparison method, which is not specifically limited in the embodiments of the present application. Taking the calculation of the ratio between the second proportion and the first proportion to calculate the contribution of the code behavior type to malicious code detection as an example, for any code behavior type, if the corresponding ratio is calculated to be 3 and the threshold is 2, then because the ratio is greater than the threshold, the code behavior type can be added to the target behavior type feature set.

[0173] In the above embodiment, since the contribution of different code behavior types to malicious code detection can be calculated, and based on the contribution of different code behavior types, code behavior types with a greater contribution to malicious code detection are screened out as much as possible in the initial behavior type feature set, and these code behavior types are used in the training process of the detection model, thereby improving the training effect of the detection model and further improving the detection accuracy of subsequent malicious codes.

[0174] As mentioned in the previous embodiments, the code behavior types included in the target behavior type feature set are not static. It is understandable that if the target behavior type feature set can be updated multiple times in a directional manner (towards the direction of producing code behavior types that contribute as much as possible to malicious code detection), the training effect of the detection model can be improved. Based on this description, in some embodiments, the target behavior type feature set is updated by a target behavior type feature set update step, and the target behavior type feature set update step includes:

[0175] Obtain a behavior type feature set population, the behavior type feature set population including at least one behavior type feature set; perform iterative update processing of the code behavior type on the behavior type feature sets in the behavior type feature set population until an update termination condition is reached to obtain a final updated behavior type feature set population; and select a target behavior type feature set from the final updated behavior type feature set population.

[0176] Among them, the behavior type feature set population can be formed based on any combination of known code behavior types, or it can be formed based on a combination of code behavior types that are judged based on experience and may be malicious. The embodiment of the present application does not specifically limit the formation method of the behavior type feature set population.

[0177] It is understandable that, in each iterative update process, the computer device may update the code behavior type of some behavior type feature sets in the behavior type feature set population, or may update the code behavior type of all behavior type feature sets, and the embodiments of the present application do not specifically limit this. In addition, the so-called "updating the code behavior type of the behavior type feature set" mainly refers to changing the code behavior type included in the behavior type feature set. Among them, the change method can be the aggregation and disassembly mentioned in the previous embodiment. The specific changes can refer to the content of the previous embodiment, which will not be repeated here.

[0178] In addition, the update termination condition can be set to produce as many code behavior types as possible that contribute to malicious code detection. Therefore, the update termination condition can be set in combination with the evaluation index associated with the contribution to malicious code detection, such as the update termination condition can be set in combination with the information gain value mentioned above, and the embodiment of the present application does not specifically limit this.

[0179] It can also be understood that the more times the iterative update process is performed, the more likely it is to produce new code behavior types. In the context of generating new code behavior types, the iterative update process is equivalent to an outward exploration process, which can make the code behavior types covered by the behavior type feature set population no longer limited to the existing code behavior types, but gradually expand the diversity of code behavior types, providing the possibility of finding a global optimal solution. Therefore, the update termination condition can also be set to enable the iterative update process to be performed a sufficient number of times, such as setting it to 2000 iterations.

[0180] Each time the computer device completes the iterative update process, it can obtain the behavior type feature set population after the iterative update process. The behavior type feature set population obtained from the last iterative update process can be used as the basis for the next iterative update process. After the update termination condition is reached, the behavior type feature set population obtained by the computer device for the last iterative update process is the behavior type feature set population after the final update. The computer device can arbitrarily filter out the target behavior type feature set from the behavior type feature set population after the final update. It can also be screened in accordance with the above-mentioned evaluation indicators associated with the degree of contribution to malicious code detection, and the embodiments of the present application do not specifically limit this.

[0181] In the above embodiment, based on the update termination condition, the behavior type feature set in the behavior type feature set population is iteratively updated for the code behavior type. Since the update termination condition can be set in combination with the evaluation index associated with the contribution degree to malicious code detection, the target behavior type feature set containing the code behavior type with a greater contribution degree to malicious code detection can be screened out as much as possible in the future, thereby improving the training effect of the detection model to improve the subsequent malicious code detection accuracy. At the same time, through multiple iterative update processes, the detection performance of the detection model can be continuously improved. In addition, since the update termination condition can also be set with the diversity of code behavior types as a consideration, the screened target behavior type feature set is no longer limited to the existing code behavior types, and provides the possibility of finding the global optimal solution, thereby improving the training effect of the detection model to improve the subsequent malicious code detection accuracy.

[0182] The above embodiments mention that the code behavior types that may be malicious may be combined based on empirical judgment. Therefore, in some embodiments, the behavior type feature set population is obtained through the behavior type feature set population construction step, and the behavior type feature set population construction step includes:

[0183] An initial behavior type feature set and multiple sample behavior record sets of multiple code samples are obtained; for each code behavior type in the initial behavior type feature set, the contribution of each code behavior type to malicious code detection is calculated based on the distribution of code behaviors corresponding to each code behavior type in multiple sample behavior record sets, and the distribution of malicious code samples and non-malicious code samples in multiple code samples; the initial behavior type feature set is screened based on the contribution of each code behavior type to malicious code detection to obtain screened code behavior types; the screened code behavior types are combined to obtain a behavior type feature set population.

[0184] Specifically, based on the distribution of code behaviors corresponding to each code behavior type in multiple sample behavior record sets, and the distribution of malicious code samples and non-malicious code samples in multiple code samples, the computer device can calculate the conditional entropy of each code behavior type. Therefore, combined with the relevant calculation instructions on the information gain value in the above embodiment, the information gain value of each code behavior type can be used as the contribution degree to malicious code detection.

[0185] In addition, based on the distribution of code behaviors corresponding to each code behavior type in multiple sample behavior record sets, and the distribution of malicious code samples and non-malicious code samples in multiple code samples, the computer device can also calculate the first proportion of non-malicious code samples with target code behaviors in all non-malicious code samples, and the second proportion of malicious code samples with target code behaviors in all malicious code samples. Therefore, combined with the relevant calculation instructions for the first proportion and the second proportion in the above embodiments, the computer device can calculate the contribution of each code behavior type to malicious code detection. Of course, in the actual implementation process, in addition to the above two methods, there can be other ways to calculate the contribution of each code behavior type to malicious code detection, and the embodiments of the present application do not specifically limit this.

[0186] For the subsequent screening process, the computer device can select the first preset number of code behavior types sorted from large to small according to the contribution degree as the screened code behavior types. In addition, the process of combining the screened code behavior types can be any combination or a combination according to certain rules, such as making the number of code behavior types included in each behavior type feature set in the behavior type feature set population the same, which is not specifically limited in the embodiments of the present application.

[0187] In the above embodiment, before the behavior type feature set population is iteratively updated, the code behavior type with the greatest contribution to malicious code detection can be screened out according to the contribution of the code behavior type to malicious code detection, and the behavior type feature set population is constructed based on this, so that when the behavior type feature set population is subsequently iteratively updated to screen out the target behavior type feature set, the target behavior type feature set containing the code behavior type with the greatest contribution can be screened out as much as possible, thereby improving the training effect of the detection model to improve the subsequent malicious code detection accuracy.

[0188] In some embodiments, performing iterative updating of code behavior types on behavior type feature sets in the behavior type feature set population includes:

[0189] Select at least some of the behavior type feature sets in the behavior type feature set population to be updated in this iteration; update at least some of the code behavior types in each selected behavior type feature set; based on the trained detection model, detect each behavior type feature set in the behavior type feature set population after the code behavior type update, and determine the behavior type feature set population after the update in this iteration according to the corresponding detection results.

[0190] It is understandable that the computer device may not iterate and update all the behavior type feature sets in the behavior type feature set population each time iteratively updating, but may select at least part of the behavior type feature sets as iterative update targets, so that before each iterative update, the behavior type feature set population can always retain some existing code behavior types, and the same is true for selecting at least part of the code behavior types for update. The update process can refer to the content of the previous embodiment, which will not be repeated here.

[0191] In addition, in the actual implementation process, after each iterative update process, the computer device can directly use the result of this iterative update process as the behavior type feature set population after this iterative update process. Of course, the computer device can also further process the result of this iterative update process, such as determining the behavior type feature set population after this iterative update process based on the detection result of each behavior type feature set in the behavior type feature set population.

[0192] Among them, "the detection result of each behavior type feature set in the behavior type feature set population" can actually be the detection result based on the code sample with reference to the behavior type feature set in the behavior type feature set population. The reason why the detection result can be used as the basis for further processing is that the sample label of the code sample is known, and by comparing it with the detection result, the contribution of the referenced behavior type feature set to malicious code detection can be evaluated. It should be noted that the reason why the "trained detection model" is used in the embodiments of the present application is mainly that the untrained detection model cannot provide relatively accurate detection results, and thus cannot be used as an objective basis for evaluating the contribution of the behavior type feature set to malicious code detection.

[0193] The computer device can calculate the correct detection ratio corresponding to each behavior type feature set referenced, and use this as a basis for further processing. Of course, in the actual implementation process, other bases and methods can also be used for further processing, and this embodiment of the application does not specifically limit this.

[0194] In the above embodiment, after each iterative update process, the result of this iterative update process can be further processed based on the contribution of each behavior type feature set in the result of this iterative update process to malicious code detection to determine the behavior type feature set population after this iterative update process, so that the behavior type feature set with a greater contribution to malicious code detection can be screened out as much as possible, and the behavior type feature set population is constructed based on this, so that when the subsequent iterative update process is performed based on the behavior type feature set population to screen out the target behavior type feature set, the target behavior type feature set containing the code behavior type with a greater contribution can be screened out as much as possible, thereby improving the training effect of the detection model to improve the subsequent malicious code detection accuracy. At the same time, through multiple iterative update processes, the detection performance of the detection model can be continuously improved. In addition, due to the further processing process in each iterative update process, the amount of data for the next iterative update process can be reduced, thereby saving the processing resources of the computing device and improving the processing performance.

[0195] In some embodiments, based on the trained detection model, each behavior type feature set in the behavior type feature set population after the code behavior type update processing is detected, and the behavior type feature set population after the current iterative update processing is determined according to the corresponding detection results, including:

[0196] In the behavior type feature set population after the code behavior type update processing, obtain the sample behavior feature group set and the sample label set corresponding to each behavior type feature set, and each sample behavior feature group set is generated with reference to the corresponding behavior type feature set; input each sample behavior feature group in each sample behavior feature group set into the trained detection model to obtain the detection result set corresponding to each sample behavior feature group set; according to the detection result set and the sample label set corresponding to each behavior type feature set, screen out at least part of the behavior type feature sets in the behavior type feature set population after the code behavior type update processing.

[0197] Specifically, for any behavior type feature set, the sample behavior feature group set corresponding to the behavior type feature set can be generated by referring to the behavior type feature set and based on the code behavior type of the sample code behavior recorded by the sample behavior record set of the code sample. The specific implementation process can refer to the content of the previous embodiment, which will not be repeated here.

[0198] According to the detection result set and sample label set corresponding to each behavior type feature set, the computer device can calculate the loss function value corresponding to each behavior type feature set. According to the loss function value corresponding to each behavior type feature set, the behavior type feature set population after the code behavior type update processing can be screened. Among them, the loss function used to calculate the loss function value can be a regression loss function, a mean square error loss function, or a cross entropy loss function, etc., and the embodiment of the present application does not make specific limitations on this. Taking the example that the smaller the loss function value, the better the detection effect of the detection model, the loss function value corresponding to each behavior type feature set in the behavior type feature set population can be sorted from small to large, and the first preset number of behavior type feature sets are selected as at least part of the screened behavior type feature sets.

[0199] In the above embodiment, after each iterative update process, the result of this iterative update process can be further screened based on the contribution of each behavior type feature set in the result of this iterative update process to malicious code detection, so as to determine the behavior type feature set population after this iterative update process, so as to try to screen out the behavior type feature set with a greater contribution to malicious code detection, and build a behavior type feature set population based on this, so that when the subsequent iterative update process is performed based on the behavior type feature set population to screen out the target behavior type feature set, the target behavior type feature set containing the code behavior type with a greater contribution can be screened out as much as possible, thereby improving the training effect of the detection model to improve the subsequent malicious code detection accuracy. At the same time, through multiple iterative update processes, the detection performance of the detection model can be continuously improved. In addition, due to the further screening process in each iterative update process, the amount of data for the next iterative update process can be reduced, thereby saving the processing resources of the computing device and improving the processing performance.

[0200] The above embodiments mainly provide a process of calculating the loss function value corresponding to each behavior type feature set based on the loss function of the detection model, and using this to screen the population of behavior type feature sets. Of course, other methods can also be used for screening during the actual implementation process. Therefore, in some embodiments, based on the detection result set and sample label set corresponding to each behavior type feature set, at least part of the behavior type feature sets are screened out from the population of behavior type feature sets after the code behavior type is updated, including:

[0201] According to the detection result set and sample label set corresponding to each behavior type feature set, the detection effect evaluation value of each behavior type feature set when used for malicious code detection is obtained; according to the detection effect evaluation value of each behavior type feature set, in the behavior type feature set population after the code behavior type is updated, a preset number of behavior type feature sets are screened out when sorted in descending order by the detection effect evaluation value.

[0202] Specifically, for any behavior type feature set, based on the detection result set and sample label set corresponding to the behavior type feature set, it is actually possible to determine, under the premise of using the behavior type feature set as a reference, how many code samples are correctly detected when multiple code samples are detected through the detection model, how many code samples were originally malicious code samples but were mistakenly detected as non-malicious code samples, and how many code samples were originally non-malicious code samples but were mistakenly detected as malicious code samples.

[0203] Obviously, each of the above-mentioned quantities can be directly or indirectly used to evaluate the detection effect, and can serve as the basis for calculating the detection effect evaluation value. For ease of understanding, for any behavior type feature set, taking the detection result set corresponding to the behavior type feature set as an example, which is obtained based on multiple code samples, the detection effect evaluation value of the behavior type feature set can refer to the following calculation methods:

[0204] (1) Accuracy

[0205] The specific calculation process can be referred to the following formula (5):

[0206]

[0207] In the above formula (5), N TP N represents the number of code samples that are identified as malicious code samples and are actually malicious code samples among multiple code samples. FP It indicates the number of non-malicious code samples that are identified as malicious code samples among multiple code samples. Precision indicates the accuracy rate, which can be directly used as the evaluation value of the detection effect.

[0208] (2) Recall rate

[0209] The specific calculation process can be referred to the following formula (6):

[0210]

[0211] In the above formula (6), N TP Refer to the definition of formula (5) above, N FNIt indicates the number of code samples that are identified as non-malicious code samples but are actually malicious code samples. Recall indicates the accuracy rate and can be directly used as the evaluation value of the detection effect.

[0212] (3) F1 score

[0213] The specific calculation process can be referred to the following formula (7):

[0214]

[0215] In the above formula (7), F1-score represents the F1 score, which can be directly used as the evaluation value of the detection effect. The F1 score is an indicator used in statistics to measure the accuracy of a binary classification model. It can take into account both the precision and recall of the classification model and can be regarded as a harmonic average of the model's precision and recall.

[0216] (4) Probability of selection

[0217]

[0218] In the above formula (8), Fit i It represents the F1 score corresponding to the i-th behavior type feature set in the behavior type feature set population, n represents that there are n behavior type feature sets in the behavior type feature set population, and P(i) represents the probability of selection of the i-th behavior type feature set, which can be directly used as the detection effect evaluation value.

[0219] It should be noted that the above content is equivalent to providing four types of detection effect evaluation values, plus the loss function value provided in the previous embodiment, which is equivalent to providing five types of detection effect evaluation values. In the actual implementation process, one of them can be selected for screening. For the four types of detection effect evaluation values ​​provided above, generally the larger the value, the better the detection effect. Therefore, in an embodiment of the present application, the computer device can sort the detection effect evaluation values ​​in descending order from large to small, and select a preset number of behavior type feature sets from them.

[0220] Of course, in the actual implementation process, the computer device can also select multiple detection effect evaluation values ​​from the five types provided above for screening, and the embodiment of the present application does not specifically limit this. For example, five types can be selected at the same time, each detection effect evaluation value is normalized, and then the normalized results corresponding to each of the five detection effect evaluation values ​​are weighted summed, and the final summation result is used as the final detection effect evaluation value.

[0221] In the above embodiment, after each iterative update process, the result of this iterative update process can be further screened based on the detection effect evaluation value of each behavior type feature set in the result of this iterative update process when used for malicious code detection, so as to determine the behavior type feature set population after this iterative update process, so as to try to screen out the behavior type feature set with better detection effect for malicious code detection, and build the behavior type feature set population based on this, so that when the subsequent iterative update process is performed based on the behavior type feature set population to screen out the target behavior type feature set, the target behavior type feature set containing the code behavior type with better detection effect can be screened out as much as possible, thereby improving the training effect of the detection model and improving the subsequent malicious code detection accuracy. At the same time, through multiple iterative update processes, the detection performance of the detection model can be continuously improved. In addition, since the behavior type feature set can be screened based on the detection effect evaluation value to reduce the amount of data for the next iterative update process, the processing resources of the computing device can be saved and the processing performance can be improved.

[0222] As can be seen from the contents described in the previous embodiments, the update termination condition can be set by considering the diversity of code behavior types, and can also be set in combination with evaluation indicators associated with the contribution degree of malicious code detection. Based on this description, in some embodiments, the update termination condition includes the existence of a behavior type feature set whose detection effect evaluation value is greater than a preset threshold in the behavior type feature set population after the code behavior type update processing.

[0223] It is understandable that, as the iterative update process progresses, the detection effect corresponding to the behavior type feature set in the behavior type feature set population should be getting better and better, and the contribution to malicious code detection should also be getting higher and higher. Therefore, in an embodiment of the present application, the update termination condition can be set to the existence of a behavior type feature set in the updated behavior type feature set population with a detection effect evaluation value greater than a preset threshold. Of course, in the actual implementation process, the update termination condition can also be set to include multiple other contents with reference to the relevant instructions in the embodiment of the present application, and the embodiment of the present application does not specifically limit this.

[0224] In the above embodiment, based on the update termination condition, the behavior type feature set in the behavior type feature set population is iteratively updated for code behavior types. Since the update termination condition can be set in combination with the detection effect, the target behavior type feature set containing code behavior types with good detection effect for malicious code detection can be screened out as much as possible in the future, thereby improving the training effect of the detection model to improve the accuracy of subsequent malicious code detection.

[0225] In some embodiments, the update process includes at least one of: aggregation between different code behavior types, deletion of code behavior types, addition of code behavior types, disassembly of code behavior types, or change of code behavior types.

[0226] Specifically, how to aggregate different code behavior types and how to disassemble code behavior types can refer to the relevant descriptions in the previous embodiments, which will not be repeated here. Deleting code behavior types refers to directly deleting code behavior types in the behavior type feature set, and in the actual implementation process, they can be randomly deleted; adding code behavior types refers to directly adding code behavior types in the behavior type feature set, and in the actual implementation, they can be randomly selected and added from known code behavior types, and the embodiments of this application do not specifically limit this.

[0227] The change of code behavior type may refer to the replacement of code behavior type existing in the behavior type feature set. In combination with the previous embodiment, the code behavior type can be represented by binary coding. Therefore, when implementing the change of code behavior type, in addition to direct replacement, the embodiment of the present application may mutate the information on the feature bit in the binary code, thereby changing the original code behavior type. Among them, the mutation may be one of the feature bits or multiple feature bits, and the embodiment of the present application does not specifically limit this.

[0228] In addition, which characteristic bit is mutated can be completely random, and the roulette wheel selection method can be used for selection, which is not specifically limited in the embodiments of the present application. Finally, considering that random mutation may cause the binary code formed by the mutation to not have any known code behavior type corresponding to it, the mutation result does not have a referential meaning. For this reason, in the actual implementation process, mutation boundary restriction conditions can also be set, such as ensuring that the mutation result has a known code behavior type corresponding to it, which is not specifically limited in the embodiments of the present application.

[0229] For example, if the binary code of a certain code behavior type is "001", the information on two of the characteristic bits can be mutated, such as the information on the second characteristic bit from the left can be mutated from "0" to 1, and the information on the third characteristic bit from the left can be mutated from "1" to "0". Combined with the relevant description of the binary coding example in the previous embodiment, it can be seen that this mutation actually changes the code behavior type from "command execution" to "code injection".

[0230] In the above embodiment, by adopting different update processing methods to update the code behavior type, the diversity of the code behavior type can be expanded, so that the screened target behavior type feature set is no longer limited to the existing code behavior type, and provides the possibility of finding the global optimal solution, which can also improve the training effect of the detection model to improve the detection accuracy of subsequent malicious code.

[0231] As mentioned in the previous embodiments, the code behavior type corresponding to the sample code behavior recorded in the sample behavior record set may undergo some changes in the direction of being close to the code behavior type in the target behavior type feature set. Based on this description, in some embodiments, referring to the target behavior type feature set, based on the code behavior type of the sample code behavior recorded in the sample behavior record set, the sample behavior type belonging to the target behavior type feature set is determined, including:

[0232] Reconstruct at least a portion of the sample code behaviors recorded in the sample behavior record set to obtain a reconstructed sample behavior type; refer to the target behavior type feature set, and determine the sample behavior type belonging to the target behavior type feature set in the reconstructed sample behavior types.

[0233] Specifically, "reconstruction" mainly refers to the reconstruction of the code behavior type corresponding to at least a part of the sample code behaviors recorded in the sample behavior record set. Among them, the data before reconstruction is the code behavior type, and the result after reconstruction is the reconstructed sample behavior type. The data attributes are not changed before and after reconstruction, and both are code behavior types. In addition, the reconstruction method may include aggregation, disassembly and change of code behavior types, which is not specifically limited in the embodiments of the present application. Among them, the aggregation may not be limited to the aggregation of 2 code behavior types, and may be more types, which is not specifically limited in the embodiments of the present application.

[0234] It should be noted that in the "reconstructing at least a part of the sample code behaviors recorded in the behavior record set" mentioned in the embodiments of the present application, the reason why it is at least a part of the sample code behaviors is because some sample code behaviors in the sample behavior record set may not be "qualified" to be reconstructed. Combined with the examples in the previous embodiments, take the example that the code behavior types covered by the sample behavior record set include A1, A2, B, C and E, and the code behavior types included in the target behavior type feature set include A, B1, C and D. Among them, A is formed by the aggregation of A1 and A2, and B is formed by the aggregation of B1 and B2. Therefore, referring to the target behavior type feature set, only A1, A2 and B may be reconstructed, while C and E are not qualified to be reconstructed, mainly because referring to the target behavior type feature set, there is actually no reconstruction path for C and E.

[0235] In the above example, the reconstructed sample behavior types of the sample behavior record set are A, B1, B2, C and E, and the code behavior types included in the target behavior type feature set are A, B1, C and D, so that the computer device can determine that among all the reconstructed sample behavior types, the sample behavior types belonging to the target behavior type feature set are A, B1 and C, respectively.

[0236] In the above embodiment, in the process of obtaining the target behavior type feature set, different update processing methods are used to update the code behavior type. In order to ensure the consistency between the input item and the target behavior type feature set, it is necessary to reconstruct at least a part of the sample code behavior recorded in the sample behavior record set. The reason for updating the code behavior type is mainly to expand the diversity of code behavior types. Therefore, the reconstruction process can cooperate with the code behavior type update process, so that the target behavior type feature set obtained is no longer limited to the existing code behavior type, and provides the possibility of finding the global optimal solution, which can also improve the training effect of the detection model to improve the detection accuracy of subsequent malicious code.

[0237] In some embodiments, reconstructing at least a portion of the sample code behaviors recorded in the sample behavior record set includes:

[0238] Obtain a behavior reconstruction file, where the behavior reconstruction file is used to record the code behavior type and reconstruction processing method required for reconstruction when reconstructing the code behavior to the code behavior type included in the target behavior type feature set; when at least a part of the sample code behaviors recorded in the sample behavior record set belong to the code behavior type required for reconstruction in the behavior reconstruction file, reconstruct at least a part of the sample code behaviors according to the corresponding reconstruction processing method recorded in the behavior reconstruction file.

[0239] Among them, the behavior reconstruction file can be obtained together with the iterative update processing mentioned in the previous embodiment. Specifically, in the iterative update processing, the behavior type feature set in the behavior type feature set population will be iteratively updated as a code behavior type. Among them, the update processing can include deletion, addition, aggregation, disassembly and change. Obviously, the update processing methods of deletion and addition have nothing to do with reconstruction, and the main ones related are aggregation, disassembly and change.

[0240] During the iterative update process, which code behavior types are aggregated into a new code behavior type can be recorded. At the same time, the update processing method of "aggregation" can also be recorded. Conversely, if it is necessary to reconstruct a code behavior type included in the target behavior type feature set in the future, which code behavior types are required for the code behavior type can be known based on the previously recorded content. At the same time, what kind of reconstruction processing method (corresponding to the previously recorded update processing method) is required to reconstruct the code behavior type can also be known. Thus, the behavior reconstruction file can be formed by recording during the iterative update process, and each behavior type feature set formed during the iterative update process corresponds to a behavior reconstruction file. Therefore, the target behavior type feature set also corresponds to a behavior reconstruction file.

[0241] For ease of understanding, combined with the examples in the previous embodiments, the code behavior types covered by the sample behavior record set include A1, A2, B, C and E, and there are two reconstruction paths recorded in the behavior reconstruction file corresponding to the target behavior type feature set. The two reconstruction paths are:

[0242] "1. Reconstruction processing method: aggregation; the required code behavior types include A1 and A2, and the reconstruction result is code type A", and "2. Reconstruction processing method: disassembly; the required code behavior types include B, and the reconstruction results are code types B1 and B2". Among them, the content format of the behavior reconstruction file presented above is only one example. It can be set according to needs during actual implementation, and the embodiments of this application do not specifically limit this.

[0243] Therefore, after obtaining the behavior reconstruction file, the computer device can determine that the code behavior types recorded in the sample behavior record set and required for reconstruction in the behavior reconstruction file are A1, A2, and B. The computer device can aggregate A1 and A2 into A and disassemble B into B1 and B2 according to the corresponding reconstruction processing method recorded in the behavior reconstruction file.

[0244] In the above embodiment, since different update processing methods are used to update the code behavior type in the process of obtaining the target behavior type feature set, in order to ensure the consistency between the sample behavior feature group used as the input item and the target behavior type feature set, a reconstruction process needs to be performed. The reason for updating the code behavior type is mainly to expand the diversity of code behavior types, so that the reconstruction process can cooperate with the code behavior type update processing process, so that the target behavior type feature set obtained is no longer limited to the existing code behavior type, and provides the possibility of finding the global optimal solution, which can also improve the training effect of the detection model to improve the accuracy of subsequent malicious code detection.

[0245] In some embodiments, the sample behavior feature group has feature bits that correspond one-to-one to the code behavior types in the target behavior type feature set; in the sample behavior feature group, the feature bits corresponding to the sample behavior types belonging to the target behavior type feature set are the first value, and the feature bits in the sample behavior feature group that remain after excluding the feature bits with the first value are the second value.

[0246] Among them, the first value and the second value are mainly used to distinguish the two from each other. In the actual implementation process, the specific values ​​of the first value and the second value can be set according to needs, such as the first value is 1 and the second value is 0. The embodiment of the present application does not make specific limitations on this.

[0247] For ease of understanding, let's take the sample behavior feature group as an example, where there are 4 feature bits, and the information on the feature bits is represented by 1 and 0. Among them, the first feature bit in the target behavior type feature set corresponds to the code behavior type "command execution", the second feature bit corresponds to the code behavior type "code injection", the third feature bit corresponds to the code behavior type "memory residency", and the fourth feature bit corresponds to the code behavior type "credential collection".

[0248] If, based on the code behavior type of the sample code behavior recorded in the sample behavior record set, the sample behavior types belonging to the target behavior type feature set are determined to be "command execution" and "credential collection", then the computer device can determine that the feature bit corresponding to "command execution", that is, the value of the first feature bit, is 1; and can determine that the feature bit corresponding to "credential collection", that is, the value of the fourth feature bit, is 1; and can also determine that the values ​​of the remaining feature bits are 0. Therefore, the final sample behavior feature group formed is "1001".

[0249] In the above embodiment, by including the sample behavior feature group of feature bits, it is possible to effectively indicate which sample code behaviors belonging to the code behavior type in the target behavior type feature set are ultimately generated by the code training sample. Since the sample behavior feature group itself only occupies a plurality of bits of storage space, the storage resources occupied can be minimized. At the same time, since only occupying a plurality of bits of storage space results in a smaller amount of data, the amount of data to be subsequently processed can be reduced, saving processing resources of computer equipment.

[0250] The above embodiments mainly mention the process of training a detection model. In the actual implementation process, multiple detection models can also be trained at the same time, and then a detection model with better detection effect is selected from all the trained detection models. Based on this description, in some embodiments, the number of detection models and target behavior type feature sets are both multiple, and each detection model corresponds to a target behavior type feature set; based on the sample behavior feature group and the sample label, after training the detection model, it also includes:

[0251] Through code samples, each trained detection model is tested to obtain the detection effect evaluation value of the corresponding target behavior type feature set; according to the detection effect evaluation value of each target behavior type feature set, the detection model used for malicious code detection is screened out from all trained detection models.

[0252] Among them, the "code sample" mentioned in the embodiment of the present application and the "code sample" mentioned in the previous embodiment may be the same code sample or a different code sample, and the embodiment of the present application does not specifically limit this. It can be seen from the content of the above embodiment that each trained detection model corresponds to a target behavior type feature set. Thus, the computer device can calculate the detection effect evaluation value of each target behavior type feature set. Regarding the calculation process of the detection effect evaluation value, you can refer to the calculation process of "the detection effect evaluation value of the behavior type feature set when used for malicious code detection" in the above embodiment, which will not be repeated here. By comparing the detection effect evaluation value of each target behavior type feature set, the computer device can determine the target behavior type feature set with the best detection effect, and the trained detection model corresponding to the target behavior type feature set is the screened detection model for malicious code detection.

[0253] It should be noted that the code training samples used by each of the above-mentioned trained detection models in the previous training process may be the same samples from the same batch or different samples. In addition, the code samples used in the test process mentioned in the embodiment of the present application may be the same code samples or different code samples used by each trained detection model, and the embodiment of the present application does not specifically limit this. Since the code training samples may be continuously generated, the detection model may be iteratively trained periodically during the actual implementation process.

[0254] In the above embodiment, since multiple detection models can be trained at the same time, and based on the detection effect evaluation value corresponding to each trained detection model, the detection model used for malicious code detection can be screened out from all the trained detection models, so that the detection model with better detection effect can be screened out as much as possible for use in the subsequent malicious code detection process, thereby improving the subsequent malicious code detection accuracy.

[0255] The above embodiment mainly involves the process of training a detection model for malicious code. In the actual implementation process, the detection model can also be used to detect malicious code. Figure 3 As shown, a method for detecting malicious code is provided, and the method is applied to a computer device (the computer device may be specifically Figure 1The terminal or server in the example is used to illustrate, including the following steps:

[0256] 302. Obtain a behavior record set of the target code, where the behavior record set records code behaviors generated after the target code is run.

[0257] Specifically, the computer device can run the target code in a closed behavior-aware environment. The behavior-aware environment is configured to record sample code behaviors generated after the target code runs. The computer device can form a behavior record set of the target code based on the code behaviors recorded in the behavior-aware environment.

[0258] 304. Obtain a target behavior type feature set, where the target behavior type feature set includes code behavior types required by the trained detection model to detect malicious code.

[0259] It can be seen from the contents of the relevant embodiments of the above training process that each trained detection model corresponds to a target behavior type feature set. Therefore, when the computer device obtains the trained detection model, it can also obtain the corresponding target behavior type feature set. Among them, how the target behavior type feature set is generated can refer to the contents of the relevant embodiments of the above training process, which will not be repeated here.

[0260] 306. Referring to the target behavior type feature set, based on the code behavior type of the code behavior recorded in the behavior record set, determine the target behavior type belonging to the target behavior type feature set.

[0261] 308. Generate a behavior feature group of a target code based on the target behavior type belonging to the target behavior type feature set.

[0262] Specifically, the implementation process of step 306 can refer to Figure 2 The implementation process of step 206 and step 308 in the corresponding embodiment can be referred to Figure 2 The implementation process of step 208 in the corresponding embodiment will not be repeated here.

[0263] 310. Through the trained detection model, malicious code detection is performed based on the behavioral feature group to obtain the malicious attributes of the target code.

[0264] Specifically, the computer device inputs the behavior feature group into the trained detection model, and then outputs the malicious attribute of the target code. The malicious attribute can have two results, namely malicious code and non-malicious code.

[0265] The above-mentioned malicious code detection method obtains a set of target code behavior records, refers to a target behavior type feature set, generates a target code behavior feature group based on the code behavior type recorded in the behavior record set, and detects the target code through a detection model based on the behavior feature group. Since malicious code behavior is usually only generated during the execution process of malicious code, that is, whether the code behavior is malicious can directly reflect whether the code that generates the code behavior is malicious, the code behavior generated during the running process of the code is used in the training process of the detection model, and the detection is performed through the detection model, which will not be bypassed like the file characteristics of the code, thereby improving the training effect of the detection model, and then improving the accuracy of subsequent malicious code detection.

[0266] In addition, since the behavior feature group is generated with reference to the target behavior type feature set and based on the behavior record set, and the target behavior type feature set is composed of code behavior types that may be malicious, the behavior feature group can reflect the maliciousness of the code behavior in the behavior record set as much as possible, and then use the behavior feature group as the input item of the detection model to improve the detection accuracy of malicious code.

[0267] Finally, since the detection model is used to detect the code, there is no need to frequently update the malicious code feature library like file feature detection, which causes the storage resources to continue to grow. Instead, it only needs to update the sample to retrain the detection model, that is, the detection model itself does not need to occupy too much storage resources, thus saving storage resources. At the same time, the increasing size of the malicious code feature library will also lead to an increase in the number of searches in the subsequent detection process, which will affect the detection efficiency and affect the system performance due to occupying too many processing resources. When using the detection model, only the input and output process is required to obtain the prediction result, which can improve the detection efficiency and reduce the impact on system performance.

[0268] In some embodiments, referring to the target behavior type feature set and based on the code behavior type of the code behavior recorded in the behavior record set, determining the target behavior type belonging to the target behavior type feature set includes:

[0269] Reconstruct at least a portion of the code behaviors recorded in the behavior record set to obtain a reconstructed behavior type; refer to a target behavior type feature set, and determine a target behavior type belonging to the target behavior type feature set in the reconstructed behavior types.

[0270] Specifically, when a computer device reconstructs at least a portion of the code behaviors recorded in a behavior record set, it can be achieved through the following process: obtaining a behavior reconstruction file, the behavior reconstruction file is used to record the code behavior type and reconstruction processing method required for reconstruction when reconstructing the code behavior to the code behavior type included in the target behavior type feature set; when at least a portion of the code behaviors recorded in the behavior record set belong to the code behavior type required for reconstruction in the behavior reconstruction file, at least a portion of the code behaviors are reconstructed according to the corresponding reconstruction processing method recorded in the behavior reconstruction file. Among them, the specific reconstruction process can refer to the content of the relevant embodiments of the above-mentioned training process, which will not be repeated here.

[0271] In the above embodiment, since different update processing methods are used to update the code behavior type in the process of obtaining the target behavior type feature set, in order to ensure the consistency between the subsequent behavior feature group used as input items and the target behavior type feature set, a reconstruction process needs to be performed. The reason for updating the code behavior type is mainly to expand the diversity of code behavior types, so that the reconstruction process can cooperate with the code behavior type update processing process, so that the target behavior type feature set obtained is no longer limited to the existing code behavior type, and provides the possibility of finding the global optimal solution, which can also improve the training effect of the detection model to improve the subsequent malicious code detection accuracy.

[0272] In some embodiments, the behavior feature group has feature bits that correspond one-to-one to the code behavior types in the target behavior type feature set; in the behavior feature group, the feature bits corresponding to the target behavior types belonging to the target behavior type feature set are the first value, and the feature bits in the behavior feature group excluding the feature bits with the first value are the second value.

[0273] Specifically, the method of obtaining information on the feature bits in the behavior feature group, the distribution and reference meaning of the feature bits in the behavior feature group, and the method of taking the first value and the second value and the reference meaning can all be referred to the contents in the relevant embodiments of the above-mentioned training process, and will not be repeated here.

[0274] In the above embodiment, by including the behavior feature group of feature bits, it is possible to effectively indicate which code behaviors that are ultimately generated by the target code and belong to the code behavior types in the target behavior type feature set. Since the behavior feature group itself only occupies a plurality of bits of storage space, the storage resources occupied can be minimized. At the same time, since only occupying a plurality of bits of storage space brings a smaller amount of data, the amount of data to be subsequently processed can be reduced, saving processing resources of computer equipment.

[0275] Considering that the data generated in actual applications can also continue to be used as code training samples to train the detection model. Therefore, in some embodiments, after obtaining the malicious attributes of the target code through malicious code detection based on the behavioral feature group through the trained detection model, it also includes:

[0276] Push out inspection request information for inspecting malicious properties of target code; obtain inspection results returned based on the inspection request information, and use the inspection results to determine sample labels when the target code is used as a code training sample; and retrain the detection model based on the target code as a code training sample and the corresponding sample labels.

[0277] Among them, the computer device pushes the inspection request information externally, which can be pushed to other computer devices, such as to other mobile terminals. At the same time, the push method can be text messages, emails, or application notifications, etc. The embodiment of the present application does not specifically limit the type of push object and the push method. The main function of the inspection request information can be: the recipient of the request information confirms the previous detection results of the target code. Therefore, the inspection request information can carry at least the previous detection results of the target code through the detection model, that is, the malicious attributes of the target code.

[0278] After receiving the inspection request information, the information receiver can inspect the inspection request information and return the inspection result to the computer device. If the information receiver finds that the previous inspection result is wrong after inspecting the inspection result carried in the inspection request information, the previous inspection result can be corrected, and the inspection result carries the correction information and returns it to the computer device. Conversely, the information receiver can reply with confirmation information of the previous inspection result, and the inspection result carries the confirmation information and returns it to the computer device.

[0279] After obtaining the inspection result, the computer device can determine the sample label of the target code when it is used as a code training sample based on the inspection result. Specifically, if the inspection result carries confirmation information, the previous inspection result can be directly used as the sample label of the target code. If the inspection result carries correction information, the correct inspection result pointed to by the correction information can be used as the sample label of the target code. After obtaining the code training sample and the corresponding sample label of the target code, the computer device can use the incremental storage method to add both to the sample database, and then use them for training when needed, such as periodically training on a daily, weekly or monthly basis; or directly use a supervised training method to retrain the detection model. Among them, the process of retraining can refer to the content of the relevant embodiments of the above-mentioned training process, which will not be repeated here.

[0280] It should be noted that in addition to using the target code obtained during the actual detection process as a code training sample, in the actual implementation process, the target code used as a code training sample can also be obtained through manual reverse analysis or honeypot detonation, and the target code can be pushed outward through a computer device to obtain the sample label when the target code is used as a code training sample, so that the target code obtained as a code training sample and the corresponding sample label are added to the sample database in an incremental manner.

[0281] It should also be noted that the target behavior type feature set can be updated in real time, and the update method may include expanding it. Since the target behavior type feature set determines the input items of the detection model, and the code behavior type set in the target behavior type feature set is usually considered to be malicious code behavior, it can be understood that when setting the code behavior type in the target behavior type feature set, the severity of setting the code behavior type is related to the number and frequency of alarms when the code is detected by the detection model with reference to the target behavior type feature set.

[0282] If the code behavior type is set more strictly, some code behaviors that have a minor impact on the security of computer equipment may also trigger alarms, resulting in a large number of alarms and a high alarm frequency. In fact, an increase in the number of alarms may lead to an increase in false alarms. Therefore, in the actual implementation process, the code behavior type in the target behavior type feature set can be set based on the degree of acceptance of false alarms.

[0283] In the above embodiment, since the inspection request information for inspecting the malicious attributes of the target code can be pushed outward, the false detection can be optimized. At the same time, the optimization results of the false detection and the confirmation results of the correct detection can be used as code training samples to automatically train the detection model, so that the detection performance of the detection model can be continuously improved in the attack and defense confrontation.

[0284] For ease of understanding, Figure 4 As shown, a malicious code detection model processing method is provided, and the method is applied to a computer device (the computer device can be specifically Figure 1 The terminal or server in the example is used to illustrate, including the following steps:

[0285] Step 402: Obtain a sample behavior record set of the code training sample, where the sample behavior record set records sample code behaviors generated after the corresponding code training sample is run.

[0286] Step 404: Acquire a behavior type feature set population, where the behavior type feature set population includes at least one behavior type feature set.

[0287] Step 406: Perform iterative update processing of the code behavior type on the behavior type feature sets in the behavior type feature set population until the update termination condition is reached, thereby obtaining the behavior type feature set population after the final update.

[0288] Step 408: Filter out a target behavior type feature set from the finally updated behavior type feature set population, where the target behavior type feature set includes code behavior types used to train a detection model.

[0289] Step 410: reconstruct at least a portion of the sample code behaviors recorded in the sample behavior record set to obtain reconstructed sample behavior types, refer to the target behavior type feature set, and determine the sample behavior types belonging to the target behavior type feature set among the reconstructed sample behavior types.

[0290] Step 412: Generate a sample behavior feature group of code training samples based on the sample behavior types belonging to the target behavior type feature set.

[0291] Step 414: Obtain sample labels for characterizing malicious attributes of code training samples, and train a detection model based on the sample behavior feature group and the sample labels.

[0292] In the above embodiment, by obtaining a sample behavior record set and a target behavior type feature set of the code training sample, referring to the target behavior type feature set, based on the code behavior type of the sample code behavior recorded in the sample behavior record set, a sample behavior feature group of the code training sample is generated, and based on the sample behavior feature group and the sample label, the detection model is trained. Since malicious code behavior is usually only generated during the execution process of malicious code, that is, whether the code behavior is malicious can directly reflect whether the code that generates the code behavior is malicious, the code behavior generated during the running process of the code is used in the training process of the detection model, and the detection is performed through the detection model, which will not be bypassed like the file characteristics of the code, thereby improving the training effect of the detection model, and then improving the accuracy of subsequent malicious code detection.

[0293] Secondly, based on the update termination condition, the behavior type feature set in the behavior type feature set population is iteratively updated for the code behavior type. Since the update termination condition can be set in combination with the evaluation index associated with the contribution degree to malicious code detection, the target behavior type feature set containing the code behavior type with a greater contribution degree to malicious code detection can be screened out as much as possible in the future, thereby improving the training effect of the detection model to improve the subsequent malicious code detection accuracy. At the same time, through multiple iterative update processes, the detection performance of the detection model can be continuously improved. At the same time, since the update termination condition can also be set with the diversity of code behavior types as a consideration, the screened target behavior type feature set is no longer limited to the existing code behavior types, and provides the possibility of finding the global optimal solution, thereby improving the training effect of the detection model to improve the subsequent malicious code detection accuracy.

[0294] In addition, since the sample behavior feature group is generated with reference to the target behavior type feature set and based on the sample behavior record set, and the target behavior type feature set is composed of code behavior types that may be malicious, the sample behavior feature group can reflect the degree of maliciousness of the code behavior of the sample behavior record set as much as possible, and then use the sample behavior feature group as the input item of the detection model, which can improve the training effect of the detection model and thus improve the detection accuracy of subsequent malicious code.

[0295] Finally, since the detection model is used to detect the code, there is no need to frequently update the malicious code feature library like file feature detection, which causes the storage resources to continue to grow. Instead, it only needs to update the sample to retrain the detection model, that is, the detection model itself does not need to occupy too much storage resources, thus saving storage resources. At the same time, the increasing size of the malicious code feature library will also lead to an increase in the number of searches in the subsequent detection process, which will affect the detection efficiency and affect the system performance due to occupying too many processing resources. When using the detection model, only the input and output process is required to obtain the prediction result, which can improve the detection efficiency and reduce the impact on system performance.

[0296] The embodiment of the present application also provides an application scenario, which applies the above-mentioned malicious code detection model processing method, and takes the computer device involving the server as an example for explanation. Specifically, the application of the malicious code detection model processing method in the application scenario is as follows:

[0297] Before executing this method, a terminal malicious code detection environment can be jointly constructed on the terminal side and the server side. The detection environment can include a log collection client, a data storage platform, and a machine learning platform. The specific architecture of the detection environment can be referenced. Figure 5 ,exist Figure 5In the figure, "Host 1", "Host 2", "Host 3" and "Host 4" all represent terminals with log collection clients installed. The terminals collect process operation logs through the log collection clients installed on them, and import the collected process behavior logs into the data storage platform in the server. The data storage platform can clean, integrate and label the process behavior logs to generate code samples. The machine learning platform in the server can be used to store detection models and obtain code samples from the data storage platform for training the detection models. At the same time, the machine learning platform in the server can obtain the target code to be detected to realize the detection of the target code. It should be noted that in order to overcome the problem that it is difficult to automatically iterate and update the above-mentioned detection environment after deployment, the target code in the actual application can be used as a code sample again to continuously iterate, update and optimize the detection model to improve the detection performance of the model.

[0298] Based on the above description of the detection environment, the process of the malicious code detection model processing method may include: the server stores the process behavior logs imported by the terminal through the data storage platform, cleans, integrates and labels the process behavior logs, and generates various data required for the training process.

[0299] The server obtains a sample behavior record set of the code training sample from the data storage platform, and obtains a target behavior type feature set.

[0300] The server refers to the target behavior type feature set and determines the sample behavior type belonging to the target behavior type feature set based on the code behavior type of the sample code behavior recorded in the sample behavior record set. The server generates a sample behavior feature group of the code training sample based on the sample behavior type belonging to the target behavior type feature set.

[0301] The machine learning platform in the server obtains sample labels for characterizing malicious attributes of code training samples from the data storage platform; the machine learning platform in the server trains a detection model based on the sample behavior feature group and the sample labels.

[0302] The embodiment of the present application also provides an application scenario, which applies the above-mentioned malicious code detection method, and takes the computer device involving the server as an example for explanation. Specifically, the application of the malicious code detection method in the application scenario is as follows:

[0303] Before executing the method, the target behavior type feature set and the trained detection model can be deployed to the detection environment. The detection environment can refer to the relevant description in the above application scenario embodiment. The deployment flow chart of the detection model can refer to Figure 6 .

[0304] The server obtains a set of target code behavior records from the terminal side; Figure 6 In , the conversation flow is the code behavior generated by the target code, and the conversation flow can be converted into a set of generated behavior records.

[0305] The server obtains the target behavior type feature set; Figure 6 In the process, the server can obtain the target behavior type feature set from the output of the iterative update processing flow of the code behavior type in the iterative process, and can obtain the detection model from the iterative training process of the detection model.

[0306] The server refers to the target behavior type feature set, determines the target behavior type belonging to the target behavior type feature set based on the code behavior type recorded in the behavior record set, and generates a behavior feature group of the target code based on the target behavior type belonging to the target behavior type feature set.

[0307] The server inputs the behavior feature group into the detection model, and performs malicious code detection based on the behavior feature group through the detection model to obtain the detection result of the target code. Among them, the detection result is mainly the malicious attribute of the target code. Among them, the detection results within a certain period of time can be referred to as follows Table 2:

[0308] Table 2

[0309] time Malicious behavior execution Detection October 25, 2021 Command Execution yes October 25, 2021 Injection + Command Execution yes October 25, 2021 Collecting Credentials + Command Execution yes October 25, 2021 Persistent Residency + Command Execution yes November 09, 2021 Injection + Collection of Credentials yes November 09, 2021 Injection + persistence yes November 09, 2021 Inject + check information yes

[0310] After completing the above detection process, you can consider testing the target code detection results and use both the target code detection results and the target code as samples for the iterative training process. The specific framework process of the inspection process and iterative training process can be referred to Figure 7 Now combined Figure 7 The following describes the inspection process and iterative training process:

[0311] The server pushes a test request message to the terminal side for testing the malicious attributes of the target code; the test request message may carry the test result of the target code. Figure 7 , the detection result can be recorded by the model file, and the detection result can be obtained from the model file; and the detection result is pushed to the terminal used by the security personnel through the alarm work order. Among them, the alarm work order can correspond to the inspection request information.

[0312] The server obtains the test result returned by the terminal side based on the test request information, which corresponds to Figure 7 The labeling results returned by the security personnel.

[0313] The server generates label samples based on the code training samples and corresponding sample labels of the target code, and adds them incrementally to the sample database. This can be used to iteratively train the detection model, or to iteratively update the code behavior type of the target behavior type feature set. After the new model training is completed, the newly trained model and the newly generated target behavior type feature set can be deployed to the detection environment.

[0314] It should be noted that the above application scenarios are illustrative application scenarios, which are used to help understand the solutions of the present application and are not used to limit the actual application scenarios of the present application.

[0315] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0316] Based on the same inventive concept, the embodiment of the present application also provides a malicious code detection model processing device for implementing the malicious code detection model processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more malicious code detection model processing devices provided below can refer to the limitations of the malicious code detection model processing method above, and will not be repeated here.

[0317] In some embodiments, Figure 8 As shown, a malicious code detection model processing device 800 is provided. The device can adopt a software module or a hardware module, or a combination of the two to become a part of a computer device. The device specifically includes: a first acquisition module 802, a second acquisition module 804, a determination module 806, a generation module 808 and a training module 810, wherein:

[0318] A first acquisition module 802 is used to acquire a sample behavior record set of a code training sample, where the sample behavior record set records sample code behaviors generated after the corresponding code training sample is run;

[0319] A second acquisition module 804 is used to acquire a target behavior type feature set, where the target behavior type feature set includes code behavior types used to train a detection model;

[0320] A determination module 806 is used to determine the sample behavior type belonging to the target behavior type feature set based on the code behavior type of the sample code behavior recorded in the sample behavior record set with reference to the target behavior type feature set;

[0321] A generating module 808, for generating a sample behavior feature group of a code training sample based on the sample behavior type belonging to the target behavior type feature set;

[0322] The training module 810 is used to obtain sample labels for characterizing malicious attributes of code training samples, and train a detection model based on the sample behavior feature group and the sample labels.

[0323] In some embodiments, the first acquisition module 802 is used to run the code training sample in a closed behavior-aware environment, and the behavior-aware environment is configured to record the sample code behavior generated after the code training sample is run; based on the sample code behavior recorded by the behavior-aware environment, a sample behavior record set of the code training sample is constructed.

[0324] In some embodiments, the target behavior type feature set is obtained through a target behavior type feature set construction step; the apparatus further comprises:

[0325] The first construction module is used to obtain an initial behavior type feature set and a plurality of sample behavior record sets corresponding to a plurality of code samples; determine the occurrence probability of malicious code samples and non-malicious code samples in the plurality of code samples, and calculate the information entropy of the code samples according to their respective occurrence probabilities; determine the conditional entropy of each code behavior type in the initial behavior type feature set; determine the information gain value of each code behavior type according to the information entropy and the conditional entropy of each code behavior type; the information gain value is used to indicate the contribution of the corresponding code behavior type to malicious code detection; from the initial behavior type feature set, select the code behavior types corresponding to the first preset number of information gain values ​​when sorted in descending order by the information gain value, and construct the target behavior type feature set.

[0326] In some embodiments, the first construction module is also used to obtain, for the target code behavior corresponding to each code behavior type in the initial behavior type feature set, a first number of sample behavior record sets that record the target code behavior and a second number of sample behavior record sets that do not record the target code behavior in multiple sample behavior record sets; determine a third number of malicious code samples and a fourth number of non-malicious code samples in the code samples corresponding to the sample behavior record sets that record the target code behavior in the multiple sample behavior record sets; determine a fifth number of malicious code samples and a sixth number of non-malicious code samples in the code samples corresponding to the sample behavior record sets that do not record the target code behavior in the multiple sample behavior record sets; and calculate the conditional entropy of any code behavior type based on the first number, the second number, the third number, the fourth number, the fifth number, and the sixth number.

[0327] In some embodiments, the target behavior type feature set is obtained through a target behavior type feature set construction step; the apparatus further comprises:

[0328] The second construction module is used to obtain an initial behavior type feature set and multiple sample behavior record sets corresponding to multiple code samples; for the target code behavior corresponding to each code behavior type in the initial behavior type feature set, refer to the sample code behaviors recorded in each of the multiple sample behavior record sets, and determine, among the multiple code samples, the code sample in which the target code behavior is recorded in the sample behavior record set, and use it as the target code sample; calculate a first proportion of non-malicious code samples in the target code sample to non-malicious code samples in the multiple code samples; calculate a second proportion of malicious code samples in the target code sample to malicious code samples in the multiple code samples; obtain the contribution of each code behavior type to malicious code detection based on the first proportion and the second proportion; screen the initial behavior type feature set based on the contribution of each code behavior type to malicious code detection to obtain the target behavior type feature set.

[0329] In some embodiments, the target behavior type feature set is updated by a target behavior type feature set updating step; the apparatus further comprises:

[0330] An updating module is used to obtain a behavior type feature set population, the behavior type feature set population includes at least one behavior type feature set; iteratively update the behavior type feature sets in the behavior type feature set population according to the code behavior type until the update termination condition is reached to obtain the final updated behavior type feature set population; and screen out the target behavior type feature set in the final updated behavior type feature set population.

[0331] In some embodiments, the update module is also used to obtain an initial behavior type feature set and multiple sample behavior record sets of multiple code samples; for each code behavior type in the initial behavior type feature set, based on the distribution of code behaviors corresponding to each code behavior type in multiple sample behavior record sets, and the distribution of malicious code samples and non-malicious code samples in multiple code samples, calculate the contribution of each code behavior type to malicious code detection; based on the contribution of each code behavior type to malicious code detection, filter the initial behavior type feature set to obtain filtered code behavior types; combine the filtered code behavior types to obtain a behavior type feature set population.

[0332] In some embodiments, the update module is also used to select at least part of the behavior type feature sets in the behavior type feature set population to be updated in this iteration; update at least part of the code behavior types in each selected behavior type feature set; based on the trained detection model, detect each behavior type feature set in the behavior type feature set population after the code behavior type update processing, and determine the behavior type feature set population after the update processing in this iteration according to the corresponding detection results.

[0333] In some embodiments, the update module is also used to obtain a sample behavior feature group set and a sample label set corresponding to each behavior type feature set in the behavior type feature set population after the code behavior type update processing, and each sample behavior feature group set is generated with reference to the corresponding behavior type feature set; each sample behavior feature group in each sample behavior feature group set is input into a trained detection model to obtain a detection result set corresponding to each sample behavior feature group set; according to the detection result set and the sample label set corresponding to each behavior type feature set, at least part of the behavior type feature sets are screened out in the behavior type feature set population after the code behavior type update processing.

[0334] In some embodiments, the update module is also used to obtain a detection effect evaluation value of each behavior type feature set when used for malicious code detection based on the detection result set and sample label set corresponding to each behavior type feature set; based on the detection effect evaluation value of each behavior type feature set, in the behavior type feature set population after the code behavior type update processing, a preset number of behavior type feature sets are screened out when sorted in descending order by the detection effect evaluation value.

[0335] In some embodiments, the update termination condition includes the presence of a behavior type feature set having a detection effect evaluation value greater than a preset threshold in the behavior type feature set population after the code behavior type update processing.

[0336] In some embodiments, the update process includes at least one of: aggregation between different code behavior types, deletion of code behavior types, addition of code behavior types, disassembly of code behavior types, or change of code behavior types.

[0337] In some embodiments, the determination module 806 is used to reconstruct at least a portion of the sample code behaviors recorded in the sample behavior record set to obtain a reconstructed sample behavior type; refer to the target behavior type feature set, and determine the sample behavior type belonging to the target behavior type feature set in the reconstructed sample behavior type.

[0338] In some embodiments, the determination module 806 is also used to obtain a behavior reconstruction file, which is used to record the code behavior type and reconstruction processing method required for reconstruction when reconstructing the code behavior to the code behavior type included in the target behavior type feature set; when at least a part of the sample code behaviors recorded in the sample behavior record set belong to the code behavior type required for reconstruction in the behavior reconstruction file, at least a part of the sample code behaviors are reconstructed according to the corresponding reconstruction processing method recorded in the behavior reconstruction file.

[0339] In some embodiments, the sample behavior feature group has feature bits that correspond one-to-one to the code behavior types in the target behavior type feature set; in the sample behavior feature group, the feature bits corresponding to the sample behavior types belonging to the target behavior type feature set are the first value, and the feature bits in the sample behavior feature group that remain after excluding the feature bits with the first value are the second value.

[0340] In some embodiments, there are multiple detection models and target behavior type feature sets, and each detection model corresponds to a target behavior type feature set; the training module 810 is also used to test each trained detection model through code samples to obtain the detection effect evaluation value of the corresponding target behavior type feature set; according to the detection effect evaluation value of each target behavior type feature set, the detection model used for malicious code detection is screened out from all trained detection models.

[0341] The above-mentioned malicious code detection model processing device obtains the sample behavior record set and the target behavior type feature set of the code training sample, refers to the target behavior type feature set, generates the sample behavior feature group of the code training sample based on the code behavior type of the sample code behavior recorded in the sample behavior record set, and trains the detection model based on the sample behavior feature group and the sample label. Since malicious code behavior is usually only generated during the execution process of malicious code, that is, whether the code behavior is malicious can directly reflect whether the code that generates the code behavior is malicious, the code behavior generated during the operation of the code is used in the training process of the detection model, and the detection is performed through the detection model, which will not be bypassed like the file characteristics of the code, thereby improving the training effect of the detection model and further improving the accuracy of subsequent malicious code detection.

[0342] In addition, since the sample behavior feature group is generated with reference to the target behavior type feature set and based on the sample behavior record set, and the target behavior type feature set is composed of code behavior types that may be malicious, the sample behavior feature group can reflect the degree of maliciousness of the code behavior of the sample behavior record set as much as possible, and then use the sample behavior feature group as the input item of the detection model, which can improve the training effect of the detection model and thus improve the detection accuracy of subsequent malicious code.

[0343] Finally, since the detection model is used to detect the code, there is no need to frequently update the malicious code feature library like file feature detection, which causes the storage resources to continue to grow. Instead, it only needs to update the sample to retrain the detection model, that is, the detection model itself does not need to occupy too much storage resources, thus saving storage resources. At the same time, the increasing size of the malicious code feature library will also lead to an increase in the number of searches in the subsequent detection process, which will affect the detection efficiency and affect the system performance due to occupying too many processing resources. When using the detection model, only the input and output process is required to obtain the prediction result, which can improve the detection efficiency and reduce the impact on system performance.

[0344] For the specific definition of the detection model processing device for malicious code, please refer to the definition of the detection model processing method for malicious code in the above text, which will not be repeated here. Each module in the above-mentioned detection model processing device for malicious code can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0345] Based on the same inventive concept, the embodiment of the present application also provides a malicious code detection device for implementing the malicious code detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more malicious code detection devices provided below can refer to the limitations of the malicious code detection method above, and will not be repeated here.

[0346] In some embodiments, Fig. 9 As shown, a malicious code detection device 900 is provided. The device can adopt a software module or a hardware module, or a combination of the two to become a part of a computer device. The device specifically includes: a first acquisition module 902, a second acquisition module 904, a determination module 906, a generation module 908 and a detection module 910, wherein:

[0347] A first acquisition module 902 is used to acquire a behavior record set of the target code, where the behavior record set records the code behavior generated after the target code is run;

[0348] A second acquisition module 904 is used to acquire a target behavior type feature set, where the target behavior type feature set includes code behavior types required by the trained detection model to detect malicious code;

[0349] A determination module 906 is used to determine a target behavior type belonging to the target behavior type feature set based on the code behavior type recorded in the behavior record set with reference to the target behavior type feature set;

[0350] A generating module 908, for generating a behavior feature group of a target code based on a target behavior type belonging to a target behavior type feature set;

[0351] The detection module 910 is used to detect malicious code based on the behavior feature group through the trained detection model to obtain the malicious attributes of the target code.

[0352] In some embodiments, the determination module 906 is used to reconstruct at least a portion of the code behavior recorded in the behavior record set to obtain a reconstructed behavior type; refer to the target behavior type feature set, and determine the target behavior type belonging to the target behavior type feature set in the reconstructed behavior type.

[0353] In some embodiments, the detection module 910 is also used to push out inspection request information for inspecting the malicious attributes of the target code; obtain the inspection result returned based on the inspection request information, and the inspection result is used to determine the sample label of the target code when it is used as a code training sample; and re-train the detection model based on the target code as a code training sample and the corresponding sample label.

[0354] The above-mentioned malicious code detection device obtains a behavior record set of the target code, refers to a target behavior type feature set, generates a behavior feature group of the target code based on the code behavior type of the code behavior recorded in the behavior record set, and detects the target code through a detection model based on the behavior feature group. Since malicious code behavior is usually only generated during the execution process of malicious code, that is, whether the code behavior is malicious can directly reflect whether the code that generates the code behavior is malicious, the code behavior generated during the operation of the code is used in the training process of the detection model, and the detection is performed through the detection model, which will not be bypassed like the file characteristics of the code, thereby improving the training effect of the detection model, and then improving the accuracy of subsequent malicious code detection.

[0355] In addition, since the behavior feature group is generated with reference to the target behavior type feature set and based on the behavior record set, and the target behavior type feature set is composed of code behavior types that may be malicious, the behavior feature group can reflect the maliciousness of the code behavior in the behavior record set as much as possible, and then use the behavior feature group as the input item of the detection model to improve the detection accuracy of malicious code.

[0356] Finally, since the detection model is used to detect the code, there is no need to frequently update the malicious code feature library like file feature detection, which causes the storage resources to continue to grow. Instead, it only needs to update the sample to retrain the detection model, that is, the detection model itself does not need to occupy too much storage resources, thus saving storage resources. At the same time, the increasing size of the malicious code feature library will also lead to an increase in the number of searches in the subsequent detection process, which will affect the detection efficiency and affect the system performance due to occupying too many processing resources. When using the detection model, only the input and output process is required to obtain the prediction result, which can improve the detection efficiency and reduce the impact on system performance.

[0357] For the specific definition of the malicious code detection device, please refer to the definition of the malicious code detection method above, which will not be repeated here. Each module in the above malicious code detection device can be implemented in whole or in part by software, hardware and a combination thereof. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0358] In one embodiment, a computer device is provided. The computer device may be a terminal or a server. The internal structure diagram thereof may be as follows: Fig.10As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store training data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a detection model processing method for malicious code or a detection method for malicious code is implemented.

[0359] Those skilled in the art will understand that Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0360] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0361] In one embodiment, a computer-readable storage medium is provided, storing a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0362] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0363] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited thereto. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0364] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A malicious code detection model processing method, characterized in that: The method comprises: Acquire a sample behavior record set of a code training sample, wherein the sample behavior record set records sample code behaviors generated after the corresponding code training sample is run; Obtaining a target behavior type feature set, the target behavior type feature set including code behavior types for training a detection model; the target behavior type feature set is obtained by screening the initial behavior type feature set according to the contribution of each code behavior type in the initial behavior type feature set to malicious code detection; the contribution of each code behavior type to malicious code detection is determined according to the information entropy of the code sample and the conditional entropy of the code behavior type, or according to the respective proportions of non-malicious code samples and malicious code samples in the target code sample; Referring to the target behavior type feature set, based on the code behavior type of the sample code behavior recorded in the sample behavior record set, determining the sample behavior type belonging to the target behavior type feature set; generating a sample behavior feature group of the code training sample based on the sample behavior type belonging to the target behavior type feature set; A sample label for characterizing the malicious attribute of the code training sample is obtained, and the detection model is trained based on the sample behavior feature group and the sample label.

2. The method according to claim 1, characterized in that: The sample behavior record set of the acquired code training sample includes: Running the code training sample in a closed behavior-aware environment, wherein the behavior-aware environment is configured to record sample code behaviors generated after the code training sample is run; A sample behavior record set of the code training sample is formed based on the sample code behavior recorded in the behavior perception environment.

3. The method according to claim 1, characterized in that The target behavior type feature set is obtained through a target behavior type feature set construction step, and the target behavior type feature set construction step includes: Obtaining an initial behavior type feature set and a plurality of sample behavior record sets corresponding to the plurality of code samples; Determine the occurrence probability of malicious code samples and non-malicious code samples in the multiple code samples, and calculate the information entropy of the code samples according to the respective occurrence probabilities; Determine the conditional entropy of each code behavior type in the initial behavior type feature set; Determine the information gain value of each code behavior type according to the information entropy and the conditional entropy of each code behavior type; the information gain value is used to indicate the contribution degree of the corresponding code behavior type to malicious code detection; From the initial behavior type feature set, code behavior types corresponding to a preset number of information gain values ​​when sorted in descending order of information gain values ​​are selected to construct the target behavior type feature set.

4. The method according to claim 3, characterized in that The determining of the conditional entropy of each code behavior type in the initial behavior type feature set includes: For a target code behavior corresponding to each code behavior type in the initial behavior type feature set, obtaining a first number of sample behavior record sets having the target code behavior recorded therein and a second number of sample behavior record sets not having the target code behavior recorded therein from among the multiple sample behavior record sets; Determining a third number of malicious code samples and a fourth number of non-malicious code samples among code samples corresponding to the sample behavior record set in which the target code behavior is recorded in the plurality of sample behavior record sets; Determining a fifth number of malicious code samples and a sixth number of non-malicious code samples among code samples corresponding to sample behavior record sets that do not record the target code behavior in the multiple sample behavior record sets; The conditional entropy of any of the code behavior types is calculated based on the first number, the second number, the third number, the fourth number, the fifth number and the sixth number.

5. The method according to claim 1, characterized in that: The target behavior type feature set is obtained through a target behavior type feature set construction step, and the target behavior type feature set construction step includes: Obtaining an initial behavior type feature set and a plurality of sample behavior record sets corresponding to the plurality of code samples; For the target code behavior corresponding to each code behavior type in the initial behavior type feature set, refer to the sample code behaviors respectively recorded in the multiple sample behavior record sets, and determine, among the multiple code samples, a code sample having the target code behavior recorded in the sample behavior record set, and use it as the target code sample; Calculating a first proportion of non-malicious code samples in the target code sample among the non-malicious code samples in the plurality of code samples; Calculating a second proportion of malicious code samples in the target code sample to malicious code samples in the plurality of code samples; According to the first proportion and the second proportion, obtaining a contribution degree of each code behavior type to malicious code detection; According to the contribution of each code behavior type to malicious code detection, the initial behavior type feature set is screened to obtain the target behavior type feature set.

6. The method according to any one of claims 1 to 5, characterized in that: The target behavior type feature set is updated by a target behavior type feature set updating step, and the target behavior type feature set updating step includes: Acquire a behavior type feature set population, wherein the behavior type feature set population includes at least one behavior type feature set; Performing iterative updating of code behavior types on the behavior type feature sets in the behavior type feature set population until an update termination condition is reached, thereby obtaining a finally updated behavior type feature set population; In the finally updated population of behavior type feature sets, the target behavior type feature set is screened out.

7. The method according to claim 6, characterized in that The behavior type feature set population is obtained through a behavior type feature set population construction step, and the behavior type feature set population construction step includes: Obtaining an initial behavior type feature set and multiple sample behavior record sets of multiple code samples; For each code behavior type in the initial behavior type feature set, according to the distribution of the code behavior corresponding to each code behavior type in the multiple sample behavior record sets, and the distribution of malicious code samples and non-malicious code samples in the multiple code samples, calculate the contribution of each code behavior type to malicious code detection; According to the contribution of each code behavior type to malicious code detection, the initial behavior type feature set is screened to obtain the screened code behavior type; The screened code behavior types are combined to obtain a behavior type feature set population.

8. The method according to claim 6, characterized in that The iterative updating process of the code behavior type of the behavior type feature set in the behavior type feature set population includes: Selecting at least part of the behavior type feature sets in the population of behavior type feature sets to be updated in this iteration; Updating at least part of the code behavior types in each selected behavior type feature set; Based on the trained detection model, each behavior type feature set in the behavior type feature set population after the code behavior type update processing is detected, and the behavior type feature set population after this iterative update processing is determined according to the corresponding detection results.

9. The method according to claim 8, characterized in that The method of detecting each behavior type feature set in the behavior type feature set population after the code behavior type update processing based on the trained detection model, and determining the behavior type feature set population after the iterative update processing according to the corresponding detection results, includes: In the population of behavior type feature sets after the update processing of the code behavior type, a sample behavior feature group set and a sample label set corresponding to each behavior type feature set are obtained, and each sample behavior feature group set is generated by referring to the corresponding behavior type feature set; Inputting each sample behavior feature group in each sample behavior feature group set into the trained detection model to obtain a detection result set corresponding to each sample behavior feature group set; According to the detection result set and the sample label set corresponding to each behavior type feature set, at least part of the behavior type feature sets are screened out from the behavior type feature set population after the code behavior type update processing.

10. The method according to claim 9, characterized in that The step of selecting at least part of the behavior type feature sets from the population of behavior type feature sets after the code behavior type update process according to the detection result set and the sample label set corresponding to each behavior type feature set includes: According to the detection result set and sample label set corresponding to each behavior type feature set, the detection effect evaluation value of each behavior type feature set when used for malicious code detection is obtained; According to the detection effect evaluation value of each behavior type feature set, a preset number of behavior type feature sets are selected from the behavior type feature set population after the code behavior type update processing when sorted in descending order by the detection effect evaluation value.

11. The method according to any one of claims 1 to 5, characterized in that The step of referring to the target behavior type feature set and determining the sample behavior type belonging to the target behavior type feature set based on the code behavior type of the sample code behavior recorded in the sample behavior record set includes: Reconstructing at least a portion of the sample code behaviors recorded in the sample behavior record set to obtain a reconstructed sample behavior type; With reference to the target behavior type feature set, in the reconstructed sample behavior types, sample behavior types belonging to the target behavior type feature set are determined.

12. The method according to claim 11, characterized in that The reconstructing at least a portion of the sample code behaviors recorded in the sample behavior record set includes: Obtaining a behavior reconstruction file, wherein the behavior reconstruction file is used to record the code behavior type and reconstruction processing method required for reconstruction when reconstructing the code behavior to the code behavior type included in the target behavior type feature set; When at least a portion of the sample code behaviors recorded in the sample behavior record set belongs to the code behavior type required for reconstruction in the behavior reconstruction file, the at least a portion of the sample code behaviors are reconstructed according to the corresponding reconstruction processing mode recorded in the behavior reconstruction file.

13. The method according to any one of claims 1 to 5, characterized in that The number of the detection models and the target behavior type feature set are both multiple, and each detection model corresponds to a target behavior type feature set; after training the detection model based on the sample behavior feature group and the sample label, the method further includes: Through the code samples, each trained detection model is tested to obtain the detection effect evaluation value of the corresponding target behavior type feature set; According to the detection effect evaluation value of each target behavior type feature set, the detection model used for malicious code detection is screened out from all trained detection models.

14. A method for detecting malicious code, characterized in that: The method comprises: Obtaining a behavior record set of a target code, wherein the behavior record set records code behaviors generated after the target code is run; Obtaining a target behavior type feature set, the target behavior type feature set including code behavior types required by a trained detection model to detect malicious code; the target behavior type feature set is obtained by screening the initial behavior type feature set according to the contribution of each code behavior type in the initial behavior type feature set to malicious code detection; the contribution of each code behavior type to malicious code detection is determined according to the information entropy of the code sample and the conditional entropy of the code behavior type, or according to the respective proportions of non-malicious code samples and malicious code samples in the target code sample; Referring to the target behavior type feature set, based on the code behavior type of the code behavior recorded in the behavior record set, determining a target behavior type belonging to the target behavior type feature set; generating a behavior feature group of the target code based on the target behavior type belonging to the target behavior type feature set; Through the trained detection model, malicious code detection is performed based on the behavior feature group to obtain the malicious attributes of the target code.

15. The method according to claim 14, characterized in that The determining, referring to the target behavior type feature set and based on the code behavior type of the code behavior recorded in the behavior record set, a target behavior type belonging to the target behavior type feature set includes: Reconstructing at least a portion of the code behaviors recorded in the behavior record set to obtain a reconstructed behavior type; With reference to the target behavior type feature set, in the reconstructed behavior types, a target behavior type belonging to the target behavior type feature set is determined.

16. The method according to claim 15, characterized in that After the malicious code detection is performed based on the behavior feature group by the trained detection model to obtain the malicious attribute of the target code, the method further includes: Pushing externally a verification request information for verifying the malicious attributes of the target code; Acquire a test result returned based on the test request information, wherein the test result is used to determine a sample label when the target code is used as a code training sample; The detection model is retrained based on the target code as a code training sample and the corresponding sample label.

17. A malicious code detection model processing device, characterized in that: The device comprises: A first acquisition module is used to acquire a sample behavior record set of a code training sample, wherein the sample behavior record set records sample code behaviors generated after the corresponding code training sample is run; A second acquisition module is used to acquire a target behavior type feature set, wherein the target behavior type feature set includes code behavior types used to train a detection model; the target behavior type feature set is obtained by screening the initial behavior type feature set according to the contribution of each code behavior type in the initial behavior type feature set to malicious code detection; the contribution of each code behavior type to malicious code detection is determined according to the information entropy of the code sample and the conditional entropy of the code behavior type, or according to the respective proportions of non-malicious code samples and malicious code samples in the target code sample; A determination module, configured to determine the sample behavior type belonging to the target behavior type feature set based on the code behavior type of the sample code behavior recorded in the sample behavior record set with reference to the target behavior type feature set; A generating module, configured to generate a sample behavior feature group of the code training sample based on the sample behavior type belonging to the target behavior type feature set; The training module is used to obtain sample labels for characterizing the malicious attributes of the code training samples, and train the detection model based on the sample behavior feature group and the sample labels.

18. The device according to claim 17, characterized in that The first acquisition module is also used to run the code training sample in a closed behavior-aware environment, and the behavior-aware environment is configured to record the sample code behavior generated after the code training sample is run; based on the sample code behavior recorded by the behavior-aware environment, a sample behavior record set of the code training sample is constructed.

19. The device according to claim 17, characterized in that The device also includes: The first construction module is used to obtain an initial behavior type feature set and a plurality of sample behavior record sets corresponding to a plurality of code samples; determine the occurrence probability of malicious code samples and non-malicious code samples in the plurality of code samples, and calculate the information entropy of the code samples according to their respective occurrence probabilities; determine the conditional entropy of each code behavior type in the initial behavior type feature set; determine the information gain value of each code behavior type according to the information entropy and the conditional entropy of each code behavior type; the information gain value is used to indicate the contribution of the corresponding code behavior type to malicious code detection; from the initial behavior type feature set, select the code behavior types corresponding to the first preset number of information gain values ​​when sorted in descending order of information gain values, and construct the target behavior type feature set.

20. The device according to claim 19, characterized in that The first construction module is further used to obtain, for a target code behavior corresponding to each code behavior type in the initial behavior type feature set, a first number of sample behavior record sets that record the target code behavior in the multiple sample behavior record sets, and a second number of sample behavior record sets that do not record the target code behavior; determine a third number of malicious code samples and a fourth number of non-malicious code samples in code samples corresponding to the sample behavior record sets that record the target code behavior in the multiple sample behavior record sets; Among the code samples corresponding to the sample behavior record sets that do not record the target code behavior in the multiple sample behavior record sets, determine a fifth number of malicious code samples and a sixth number of non-malicious code samples; and calculate the conditional entropy of any of the code behavior types based on the first number, the second number, the third number, the fourth number, the fifth number and the sixth number.

21. The device according to claim 17, characterized in that The device also includes: The second construction module is used to obtain an initial behavior type feature set and multiple sample behavior record sets corresponding to multiple code samples; for the target code behavior corresponding to each code behavior type in the initial behavior type feature set, refer to the sample code behaviors recorded in each of the multiple sample behavior record sets, and determine, among the multiple code samples, a code sample in which the target code behavior is recorded in the sample behavior record set, and use it as the target code sample; calculate a first proportion of non-malicious code samples in the target code sample among the non-malicious code samples in the multiple code samples; calculate a second proportion of malicious code samples in the target code sample among the malicious code samples in the multiple code samples; obtain a contribution degree of each code behavior type to malicious code detection based on the first proportion and the second proportion; and screen the initial behavior type feature set based on the contribution degree of each code behavior type to malicious code detection to obtain the target behavior type feature set.

22. The device according to any one of claims 17 to 21, characterized in that The device also includes: An updating module is used to obtain a population of behavior type feature sets, wherein the population of behavior type feature sets includes at least one behavior type feature set; iteratively update the behavior type feature sets in the population of behavior type feature sets according to the code behavior type until an update termination condition is reached to obtain a finally updated population of behavior type feature sets; and select a target behavior type feature set from the finally updated population of behavior type feature sets.

23. The device according to claim 22, characterized in that The update module is further used to obtain an initial behavior type feature set and multiple sample behavior record sets of multiple code samples; for each code behavior type in the initial behavior type feature set, according to the distribution of code behaviors corresponding to each code behavior type in the multiple sample behavior record sets, and the distribution of malicious code samples and non-malicious code samples in the multiple code samples, calculate the contribution of each code behavior type to malicious code detection; According to the contribution of each code behavior type to malicious code detection, the initial behavior type feature set is screened to obtain the screened code behavior type; The screened code behavior types are combined to obtain a behavior type feature set population.

24. The device according to claim 22, characterized in that The update module is also used to select at least part of the behavior type feature sets in the behavior type feature set population to be updated in this iteration; update at least part of the code behavior types in each selected behavior type feature set; based on the trained detection model, detect each behavior type feature set in the behavior type feature set population after the code behavior type update processing, and determine the behavior type feature set population after the iteration update processing according to the corresponding detection results.

25. The device according to claim 24, characterized in that The update module is also used to obtain a sample behavior feature group set and a sample label set corresponding to each behavior type feature set in the behavior type feature set population after the update processing of the code behavior type, and each sample behavior feature group set is generated with reference to the corresponding behavior type feature set; input each sample behavior feature group in each sample behavior feature group set into the trained detection model to obtain a detection result set corresponding to each sample behavior feature group set; and screen out at least part of the behavior type feature sets in the behavior type feature set population after the update processing of the code behavior type according to the detection result set and the sample label set corresponding to each behavior type feature set.

26. The device according to claim 25, characterized in that The update module is also used to obtain a detection effect evaluation value of each behavior type feature set when used for malicious code detection based on the detection result set and sample label set corresponding to each behavior type feature set; based on the detection effect evaluation value of each behavior type feature set, a preset number of behavior type feature sets are screened out in the behavior type feature set population after the code behavior type update processing when sorted in descending order by the detection effect evaluation value.

27. The device according to any one of claims 17 to 21, characterized in that The determination module is also used to reconstruct at least a portion of the sample code behaviors recorded in the sample behavior record set to obtain a reconstructed sample behavior type; and to refer to the target behavior type feature set to determine, among the reconstructed sample behavior types, the sample behavior types belonging to the target behavior type feature set.

28. The device according to claim 27, characterized in that The determination module is further used to obtain a behavior reconstruction file, wherein the behavior reconstruction file is used to record the code behavior type and reconstruction processing method required for reconstruction when the code behavior is reconstructed to the code behavior type included in the target behavior type feature set; When at least a portion of the sample code behaviors recorded in the sample behavior record set belongs to the code behavior type required for reconstruction in the behavior reconstruction file, the at least a portion of the sample code behaviors are reconstructed according to the corresponding reconstruction processing mode recorded in the behavior reconstruction file.

29. The device according to any one of claims 17 to 21, characterized in that There are multiple detection models and target behavior type feature sets, and each detection model corresponds to a target behavior type feature set; the training module is also used to test each trained detection model through code samples to obtain a detection effect evaluation value of the corresponding target behavior type feature set; according to the detection effect evaluation value of each target behavior type feature set, the detection model used for malicious code detection is screened out from all trained detection models.

30. A malicious code detection device, characterized in that: The device comprises: A first acquisition module is used to acquire a behavior record set of a target code, wherein the behavior record set records code behaviors generated after the target code is run; A second acquisition module is used to acquire a target behavior type feature set, wherein the target behavior type feature set includes code behavior types required by a trained detection model to detect malicious code; the target behavior type feature set is obtained by screening the initial behavior type feature set according to the contribution of each code behavior type in the initial behavior type feature set to malicious code detection; the contribution of each code behavior type to malicious code detection is determined according to the information entropy of the code sample and the conditional entropy of the code behavior type, or is determined according to the respective proportions of non-malicious code samples and malicious code samples in the target code sample; A determination module, configured to determine a target behavior type belonging to the target behavior type feature set based on the code behavior type recorded in the behavior record set with reference to the target behavior type feature set; A generating module, configured to generate a behavior feature group of the target code based on the target behavior type belonging to the target behavior type feature set; The detection module is used to detect malicious code based on the behavioral feature group through the trained detection model to obtain the malicious attributes of the target code.

31. The device according to claim 30, characterized in that The determination module is also used to reconstruct at least a portion of the code behavior recorded in the behavior record set to obtain a reconstructed behavior type; refer to the target behavior type feature set, and determine the target behavior type belonging to the target behavior type feature set in the reconstructed behavior type.

32. The device according to claim 31, characterized in that The detection module is also used to push out inspection request information for inspecting the malicious attributes of the target code; obtain the inspection result returned based on the inspection request information, and the inspection result is used to determine the sample label of the target code when it is used as a code training sample; The detection model is retrained based on the target code as a code training sample and the corresponding sample label.

33. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 16 are implemented.

34. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 16 are implemented.

35. A computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 16.

Images