Malicious code family classification method and system based on dual-channel bidirectional LSTM

Abstract

The present invention relates to a method and system for classifying malicious code families based on a dual-channel bidirectional LSTM, and specifically to the technical field of malicious code family classification. The method comprises: obtaining a malicious code binary file to be classified; processing the malicious code binary file using an API call sequence extraction algorithm and a backward slicing algorithm to obtain API call sequence text and API-associated basic block sequence text for the malicious code binary file to be classified; and inputting the API call sequence text and API-associated basic block sequence text of the malicious code binary file to be classified into a trained malicious code classification model based on a dual-channel bidirectional LSTM to obtain a classification category for the malicious code binary file to be classified. The present invention can improve the accuracy of malicious code family classification results.

Description

Technical Field

[0001] The present invention relates to the technical field of malicious code family classification, and in particular to a malicious code family classification method and system based on a dual-channel bidirectional LSTM. Background Art

[0002] Malicious code often performs its malicious operations by executing code instructions and calling API functions. Therefore, existing malicious code family classification methods often analyze the semantics of malicious code behavior based on Application Program Interface (API) sequences and opcode sequences. However, research on API sequences focuses primarily on API functions, with less attention paid to their parameter information. This is because the same API function may be called in both malicious and benign files, but the parameter information may not be the same. Therefore, determining whether a file is malicious by focusing solely on API functions may result in partial loss of the malicious code's semantics, so parameter information should also be considered. Furthermore, while opcode sequences can represent the behavior of malicious code to a certain extent, an instruction includes not only opcodes but also operands. Considering only opcodes and discarding operands will also render the semantics of the malicious code incomplete. Therefore, existing classification methods can result in the loss of some malicious code semantic information, leading to inaccurate malicious code semantic analysis and ultimately inaccurate malicious code family classification results. Summary of the Invention

[0003] The purpose of the present invention is to provide a malicious code family classification method and system based on a dual-channel bidirectional LSTM, which can improve the accuracy of malicious code family classification results.

[0004] To achieve the above object, the present invention provides the following solutions:

[0005] A malicious code family classification method based on dual-channel bidirectional LSTM, including:

[0006] Obtain the binary file of the malicious code to be classified;

[0007] Using an API call sequence extraction algorithm and a backward slicing algorithm to process the malicious code binary file to be classified, respectively, to obtain an API call sequence text and an API-associated basic block sequence text of the malicious code binary file to be classified;

[0008] The API call sequence text and API associated basic block sequence text of the malicious code binary file to be classified are input into a trained malicious code classification model based on a dual-channel bidirectional LSTM to obtain a classification category of the malicious code binary file to be classified.

[0009] A malicious code family classification system based on a dual-channel bidirectional LSTM, including:

[0010] The acquisition module is used to obtain the binary file of the malicious code to be classified;

[0011] A sequence text determination module is used to process the malicious code binary file to be classified using an API call sequence extraction algorithm and a backward slicing algorithm to obtain an API call sequence text and an API-associated basic block sequence text of the malicious code binary file to be classified;

[0012] The classification module is used to input the API call sequence text and API associated basic block sequence text of the malicious code binary file to be classified into a trained dual-channel bidirectional LSTM-based malicious code classification model to obtain the classification category of the malicious code binary file to be classified.

[0013] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects: based on the API call sequence text and the API-associated basic block sequence text, the present invention makes the malicious code semantic information richer and more three-dimensional, and adopts a malicious code classification model based on a dual-channel bidirectional LSTM to determine the classification results, thereby improving the accuracy of the malicious code family classification results. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0015] Figure 1 A flowchart of a malicious code family classification method based on a dual-channel bidirectional LSTM provided by an embodiment of the present invention;

[0016] Figure 2 Control flow graph of the malicious code binary file;

[0017] Figure 3 It is a schematic diagram of sequence text;

[0018] Figure 4 This is a diagram of the normalized API basic block sequence text;

[0019] Figure 5 It is a schematic diagram of the vectorized model structure;

[0020] Figure 6 Schematic diagram of the internal structure of a single LSTM neural unit;

[0021] Figure 7 Schematic diagram of Bi-LSTM structure;

[0022] Figure 8 Flowchart for the classification of malicious code using a single-channel Bi-LSTM model;

[0023] Figure 9 The present invention provides a flowchart for classifying a malicious code classification model based on a dual-channel bidirectional LSTM. DETAILED DESCRIPTION

[0024] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0025] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0026] In order to utilize more semantic information and reduce the precision loss and error of semantic representation, the malicious code family classification method based on dual-channel bidirectional LSTM proposed in the embodiment of the present invention is based on API sequence (API call sequence) and API sequence basic block (API association basic block), so that the malicious code semantic information is richer and more three-dimensional, including not only API function and parameter information, but also instruction control flow information including operands, enriching the malicious code semantic information under static analysis and effectively improving the effectiveness of malicious code family classification. The malicious code family classification method based on dual-channel bidirectional LSTM is as follows: Figure 1 As shown, specifically including:

[0027] Step 101: Obtain a binary file of malicious code to be classified.

[0028] Step 102: respectively using an API call sequence extraction algorithm and a backward slicing algorithm to process the malicious code binary file to be classified to obtain an API call sequence text and an API-associated basic block sequence text of the malicious code binary file to be classified.

[0029] Step 103: Input the API call sequence text and API associated basic block sequence text of the malicious code binary file to be classified into a trained dual-channel bidirectional LSTM-based malicious code classification model to obtain a classification category of the malicious code binary file to be classified.

[0030] In practical applications, the API call sequence text and API associated basic block sequence text of the malicious code binary file to be classified are input into a trained dual-channel bidirectional LSTM-based malicious code classification model to obtain the classification category of the malicious code binary file to be classified, specifically including:

[0031] The API call sequence text and the API associated basic block sequence text are segmented to obtain an API sequence text and a basic block sequence text respectively.

[0032] The API sequence text and the basic block sequence text are input into a trained dual-channel bidirectional LSTM-based malicious code classification model to obtain the classification category of the malicious code binary file to be classified.

[0033] In practical applications, the process of determining the trained malicious code classification model based on dual-channel bidirectional LSTM includes:

[0034] A malicious code binary file sample set is obtained; the malicious code binary file sample set includes malicious code binary files of multiple known classification categories.

[0035] For any malicious code binary file, the malicious code binary file is processed by respectively adopting an API call sequence extraction algorithm and a backward slicing algorithm to obtain an API call sequence text and an API associated basic block sequence text of the malicious code binary file.

[0036] The API call sequence texts of all malicious code binary files and the API associated basic block sequence texts of all malicious code binary files are used as corpora for word vector training based on the word2vec algorithm to obtain the API function vector dictionary and the operation code vector dictionary.

[0037] The API function vector dictionary is used to map the API call sequence text to obtain a word vector corresponding to the API call sequence text.

[0038] The operation code vector dictionary is used to map the API-associated basic block sequence text to obtain a word vector corresponding to the API-associated basic block sequence text.

[0039] Taking the word vectors corresponding to the API call sequence text and the word vectors corresponding to the API-associated basic block sequence text of each malicious code binary file in the malicious code binary file sample set as input, and the classification category corresponding to each malicious code binary file as output, a malicious code classification model based on a dual-channel bidirectional LSTM is trained to obtain a trained malicious code classification model based on a dual-channel bidirectional LSTM.

[0040] In practical applications, an API call sequence extraction algorithm is used to process the malicious code binary file to be classified to obtain the API call sequence text of the malicious code binary file to be classified, specifically including:

[0041] Obtain a control flow graph and a function call graph of the malicious code binary file to be classified.

[0042] Based on the control flow graph, the calling relationship between the custom functions in the malicious code binary file to be classified, the jump address of the basic block of the control flow graph, the function of the basic block of the control flow graph and the address of the API function call in the basic block of the control flow graph are obtained.

[0043] Based on the function call graph, the API call sequence under the full path is obtained.

[0044] Based on the calling relationship between the custom functions in the malicious code binary file to be classified, the jump address of the basic block, the function of the basic block, the address of the API function call in the basic block and the API calling sequence under the full path, an API calling sequence text is obtained.

[0045] In practical applications, a backward slicing algorithm is used to process the malicious code binary file to be classified to obtain an API-associated basic block sequence text of the malicious code binary file to be classified, specifically including:

[0046] Obtain a control flow graph and a function call graph of the malicious code binary file to be classified.

[0047] Based on the control flow graph, the calling relationship between the custom functions in the malicious code binary file to be classified, the jump address of the basic block of the control flow graph, the function of the basic block of the control flow graph and the address of the API function call in the basic block of the control flow graph are obtained.

[0048] Based on the function call graph, the API call sequence under the full path is obtained.

[0049] Traverse the API call sequence under the full path to obtain all API functions in the API call sequence under the full path, and obtain the node where each API function is located according to the jump address of the basic block, the function of the basic block and the address of the API function call in the basic block.

[0050] For any API function, based on the control flow graph, the predecessor node, the first predecessor node and the second predecessor node of the node where the API function is located are obtained; the first predecessor node is the predecessor node of the predecessor node, and the second predecessor node is the predecessor node of the first predecessor node.

[0051] The assembly instructions in the memory addresses where the first predecessor node and the second predecessor node are located are read to obtain an assembly instruction sequence corresponding to the API function.

[0052] The assembly instruction sequences corresponding to the API functions are combined according to the API call sequence under the full path to obtain an API-associated basic block sequence text.

[0053] In practical applications, obtaining the control flow graph and function call graph of the malicious code binary file to be classified specifically includes: inputting the malicious code binary file to be classified into angr analysis system to obtain the control flow graph and function call graph.

[0054] In practical applications, the API call sequence texts of all malicious code binary files and the API associated basic block sequence texts of all malicious code binary files are used as corpora to perform word vector training based on the word2vec algorithm to obtain the API function vector dictionary and the operation code vector dictionary, specifically including:

[0055] The API call sequence texts of all malicious code binary files and the API associated basic block sequence texts of all malicious code binary files are segmented to obtain segmented API call sequence texts and segmented API associated basic block sequence texts.

[0056] The API call sequence text after word segmentation and the API associated basic block sequence text after word segmentation are respectively used as corpora to perform word vector training based on the word2vec algorithm to obtain an API function vector dictionary and an operation code vector dictionary.

[0057] In practical applications, the malicious code classification model includes:

[0058] The dual-channel bidirectional LSTM layer, Merge layer, Dropout layer and Softmax layer are connected in sequence.

[0059] The embodiment of the present invention provides a more specific malicious code family classification method based on a dual-channel bidirectional LSTM, which specifically includes:

[0060] Step 1: Obtain a sample set of malicious code binary files.

[0061] Step 2: Use the angr tool to extract semantic features from the malicious code binary file in step 1, extract the API call sequence and API-associated basic block sequence, and form the API call sequence text and API-associated basic block sequence text.

[0062] Step 3: Preprocess the two texts in step 2. Specifically, perform word segmentation on the API call sequence text and perform normalization and word segmentation on the API associated basic block sequence text.

[0063] Step 4: Use the preprocessed API call sequence text as the corpus, perform word vector training based on the word2vec algorithm, train the malicious code API function vectorization model, and obtain the API function vector dictionary W API .

[0064] Step 5: Use the API-associated basic block sequence text as the corpus, perform word vector training based on the word2vec algorithm, train the assembly code vectorization model, and obtain the operation code vector dictionary W ASM The trained word2vec model contains a dictionary. After training, a unique vector is generated for each function. This one-function-one-vector relationship is called a dictionary. The dictionary can be understood as the result of model training.

[0065] Step 6: Use the word vectors corresponding to the API sequence (API call sequence text is passed through W API The word vector obtained after mapping) and the word vector corresponding to the assembly code (the API associated basic block sequence text is mapped by W ASM The word vectors obtained by mapping are used as input data to train a single-channel Bi-LSTM malicious code classification model. Then, a dual-channel Bi-LSTM classification model is trained in a parallel single-channel manner. The mapping process is as follows: the vector corresponding to each word in the API call sequence text and the API-associated basic block sequence text is found according to the word vector dictionary.

[0066] Step 7: When performing malicious code family classification analysis, the sample to be tested is processed according to steps 2-3 to obtain two feature texts of the new malicious code (API sequence text and basic block sequence text). These are used as inputs for the single-channel BI-LSTM classification model and the dual-channel Bi-LSTM model to perform malicious code family analysis and finally obtain the classified malicious code.

[0067] For the semantic analysis of malicious code, the calculation of the program control flow graph (CFG) is a very basic and important step, and the acquisition of API sequence and opcode sequence also needs to be based on CFG. Therefore, the present invention uses the Angr binary analysis tool to calculate CFG. In Angr, there are mainly two types of CFG: static CFG (CFGFast) and dynamic CFG (CFGEmulated). The difference between the two is that the former uses static analysis to calculate less things and the generation speed is very fast, while the latter uses symbolic execution to obtain CFG, which is theoretically more accurate, but relatively slow, and the simulation execution accuracy is not very good. Therefore, the semantic analysis of malicious code in the present invention is based on CFGFast. By analyzing CFGFast, the semantic features of the malicious code (API sequence features and API sequence basic block features) are extracted, so step 2 specifically includes:

[0068] Step 2.1.1: Extract API sequence features (API call sequence text):

[0069] Malicious code needs to call API function interfaces to complete a series of actions, such as modifying the registry, controlling processes, and tampering with files, in order to implement its attack behavior. Therefore, the API call sequence can be regarded as the behavior sequence of the malicious code. By analyzing the API call sequence, the malicious code can be analyzed and interpreted from the behavioral level. Generally, there are two methods for obtaining API call sequences: static acquisition and dynamic acquisition. Dynamic acquisition is to track and capture the dynamic behavior of malicious code in a controlled environment such as a sandbox or virtual machine, and extract the malicious code API call sequence. However, due to the existence of anti-virtualization mechanisms in some malicious codes, self-protection measures will be adopted during the sandbox automated analysis process. In this case, the extracted API call sequence will be incomplete. Therefore, the present invention adopts a static analysis method to obtain the API call sequence.

[0070] Based on the angr tool, an API call sequence extraction algorithm is proposed. The algorithm is as follows:

[0071] Step 1: Load the malicious code binary file into the angr analysis system.

[0072] Step 2: Perform dependency analysis and program segmentation to generate a control flow graph (CFG) and a function call graph (CG).

[0073] Step 3: Based on CFG, linearly scan the entire file starting from the CFG root node to store the calling relationship between custom functions, the jump address of the basic block, and the address of the API function call in the function and basic block.

[0074] Step 4: Based on CG, traverse CG, ignore the user-defined functions in it, and obtain the API call sequence under the full path.

[0075] Step 5: Obtain API sequence features (API call sequence text) based on the calling relationship between the custom functions, the jump address and function of the basic block, the address of the API function call in the basic block, and the API call sequence under the full path.

[0076] The CFG is drawn using the angr visualization tool angr-utils, which looks more intuitive. Figure 2 A small portion of the CFG is shown. It shows two API functions being called: InitializeCriticalSection and EnterCriticalSection. For each piece of malware, the extracted API call sequence is saved as text. This text is then used as the corpus for subsequent semantic model training.

[0077] Step 2.1.2: Extract API sequence basic block features (API associated basic block sequence text):

[0078] Since the call of an API function is implemented by executing a certain code snippet, this code snippet may contain the parameter information of the API function and may also carry common information of the malicious code family, such as the coding habits of the code author. By deeply analyzing this snippet, the behavioral semantic information of the malicious code can be enriched. Therefore, the present invention proposes a backward slicing algorithm based on API relevance. By deleting redundant nodes in the malicious code control flow graph that are not related to the API call, the complexity of program analysis is reduced, and function slicing is performed in basic blocks, effectively extracting the entire instruction sequence of the API-associated basic block. In order to ensure that the extracted program slice carries API parameter information, a program slice consists of four basic blocks, namely the basic block where the API is located and its three backward basic blocks.

[0079] exist Figure 2As can be seen, there are two API function nodes, namely basic block 0x500084 and basic block 0x500080. Here, we focus on the edges (0x401850->0x500084) and (0x40186b->0x500080), which are the edges in the source code that call the API functions and are also the desired program slices. Backward slicing is performed on the basic blocks containing the APIs. For basic block 0x0x500084, basic blocks 0x4011a4 and 0x401850 are both included in the slice result, but only basic block 0x401850 is actually the desired slice. Similarly, for basic block 0x500080, basic blocks 0x4011ac, 0x401874, and 0x40186b are all included in the slice result, but only basic block 0x401874 is actually the desired slice. Therefore, in order to retain the desired slices, a backward slicing algorithm is designed (the results obtained from steps 1 to 4 of this part are the same as those from steps 1 to 4 of step 2.2.1), as follows:

[0080] Step 1: Load the malicious code binary file into the angr analysis system.

[0081] Step 2: Perform dependency analysis and program segmentation to generate the control flow graph CFG and function call graph CG.

[0082] Step 3: Based on the malicious code control flow graph CFG, the entire file is linearly scanned starting from the CFG root node to store the calling relationship between custom functions, the jump address of the basic block, and the address of the API function call in the function and basic block.

[0083] Step 4: Based on the function call graph CG, traverse the function call graph CG, ignore the user-defined functions in the function call graph, and obtain the API call sequence under the full path.

[0084] Step 5: Take out the API functions from the API call sequence one by one, and trace back to the node where they are located based on the jump address of the basic block obtained in steps 2 and 3 and the address of the API function call in the function and basic block (after obtaining the API function, find the basic block address that calls the API function from the API function call address in the basic block stored previously, that is, the address of the node).

[0085] Step 6: Based on the malicious code control flow graph CFG, use the jump relationship of the edge in CFG to obtain the predecessor node prenode1 of node node, the predecessor node prenode2 of prenode1, and the predecessor node prenode3 of prenode2 (the process of determining the predecessor node: in the angr tool, load a binary file, there is a module function that can automatically analyze the predecessor nodes and successor nodes of all basic blocks and save them to the basic block information. After determining the address of the node, use Figure 2 Take node 0x500080 in the example, which is the node of the API function EnterCriticalSEction. According to the jump address between the basic blocks stored previously, its predecessor node 1 (0x4011ac) is obtained. This is the basic block that only contains the API function jump, and the information value is not great. Therefore, the same method is used to continue tracing back to the predecessor node 2 layers up to ensure that the parameter information of the API function is as complete as possible.

[0086] Step 7: Find the memory address of prenode2 and prenode3, and read the assembly instruction sequence Instructions.

[0087] Step 8: Repeat steps 5, 6, and 7 until the API call sequence is complete.

[0088] Step 9: Combine the instructions read from each API function in the order of the API call sequence and write them in text form to obtain the API-associated basic block sequence text of the malicious code.

[0089] The malicious code binary file is analyzed by API call sequence extraction algorithm and backward slicing algorithm. Each malicious code corresponds to an API call sequence text and an API associated basic block sequence text. Partial fragments of the two texts are as follows: Figure 3 As shown, Figure 3 (a) is a diagram of the API call sequence text. Figure 3 (b) is a schematic diagram of the API basic block sequence text. After obtaining the API call sequence text and the API-associated basic block sequence text, the API sequence and basic block sequence need to be vectorized. The specific steps are to segment the obtained API call sequence text and the API-associated basic block sequence text and then use word2vec to vectorize them to form word vectors. That is, steps 3 to 5 specifically include:

[0090] Step 2.2.1: Semantic feature text segmentation:

[0091] Since assembly instruction operands have various representations and carry little semantic information, to reduce the impact of noise on malicious code behavior semantic analysis, the API-related basic block sequence text is normalized before word segmentation. The specific processing rules are:

[0092] 1) For operands of memory address type, replace it with "addr".

[0093] 2) For constant type operands, all operands greater than 5000 are replaced with "imme", and operands less than 5000 are retained. The standardized API-related basic block sequence text is as follows: Figure 4 shown.

[0094] The API call sequence text and the normalized API-associated basic block sequence text are segmented. For example, InitializeCriticalSection, EnterCriticalSection, LocalAlloc, and LeaveCritic each represent a word, and push, ebp, mov, ebp, and esp each represent a word. In this way, the API call sequence can be regarded as a text composed of several API function words, and the API-associated basic block sequence text can be regarded as a text composed of several opcode words.

[0095] Step 2.2.2: Malicious code feature vectorization model based on word2vec:

[0096] The simplest way to represent each word in a text is with one-hot encoding, where 0 and 1 represent the specific word. While this encoding method is simple and easy to use, it is not suitable for large corpora. Furthermore, this encoding method simply distinguishes different words with different symbols and does not capture the semantic information between words. Therefore, word vector embedding is currently used to reduce the dimensionality of words to a computable dimension. The most widely used word vector embedding model is word2vec.

[0097] Word2vec mainly includes two models: Skip-gram model and CBOW model. Skip-gram model predicts the context based on the current word, while CBOW model predicts the current word based on the context. Taking CBOW model as an example, the input layer passes through the hidden layer and the final output layer softmax to calculate the probability of all words, and then the back propagation and gradient descent methods are used to continuously iterate and update the model parameters. The present invention generates vectorized representations of API function words and operation code words based on the CBOW model, such as Figure 5 As shown, Figure 5 (a) is a schematic diagram of the API function vectorization model structure. Figure 5(b) is a schematic diagram of the assembly-coded vectorization model structure.

[0098] Figure 5 In this paper, taking the API function vectorization model as an example, the CBOW model infers the probability of the target word through the context information of the target word. The input layer window size of the model is 2a, which contains the semantic vectors of 2a API functions. The projection layer vector is the sum and average of the input layer word vectors. The output layer is to build a Huffman tree. All internal nodes in the tree act as neurons in the hidden layer of the neural network. Among them, the vector of the root node corresponds to the word vector of the previous projection layer, and the leaf node acts as a neuron in the softmax output layer of the neural network. Each leaf node represents a target word. The path from the root node to the leaf node where the target word is located represents the prediction process. The model training goal is to make the possibility of taking this path P(w|x i ) is the largest. Define the input corpus word vector dimension as M, the context size as 2c, the step size as a, x w is the vector after summing and averaging the input vector, x is the model parameter to be optimized, θ i w is the model parameter of the i-th node of the target word w, d i w is the Huffman value of the i-th node of the target word w, l w is the maximum number of nodes of the Huffman code of the target word w. The model training algorithm is as follows:

[0099] (1) Based on the input corpus, a Huffman tree is built according to word frequency

[0100] (2) Randomly initialize each tree node parameter and initialize the word vector

[0101] (3) For 2c x i , the goal is to optimize P(w|x i ), so for each sample (w, 2c) gradient descent training each sample w:

[0102] 1) Solve the context average vector

[0103]

[0104] 2) for i = 1 to 2c:

[0105] Sum=0;

[0106] for j=2 to l w :

[0107]

[0108]

[0109]

[0110] sum=sum+Grad x

[0111] Among them, i refers to the sequence number of the 2c context words, j refers to the node sequence number of the target word w, is the model parameter of the j-th node of the target word w, is the Huffman value of the jth node of the target word w, Grad θ is P(w|x i ) Gradient in the θ direction, Grad x is P(w|x i ) is the gradient in the x direction, sum is a variable name, and its initial value is set to 0.

[0112] 3) For each x in the context, update: x i =x i +sum.

[0113] 4) The gradient converges to this vector, otherwise the iteration is repeated until convergence to obtain the API function vectorized model.

[0114] The assembly code vectorization model method is basically the same as the API function vectorization model method. Figure 5 It can be seen that the preprocessed API call sequence text (word segmentation) is input into the API function vectorization model to obtain the API function vector dictionary W API (word vector), the pre-processed API-associated basic block sequence text (word segmentation) is input into the assembly code vectorization model to obtain the assembly code vector dictionary W ASM (word vector).

[0115] After completing the semantic vector representation of malicious code API function features and API basic block features, it is necessary to fully and effectively utilize these two feature information of the malicious code to complete the malicious code classification task. The present invention adopts a long short-term memory neural network (Long Short-Term Memory, LSTM), and uses these two types of information as the input of the LSTM model respectively, and then supplements and improves the extracted features through dual-channel fusion technology, thereby achieving full and effective utilization of malicious code feature information. Since the traditional LSTM model only learns the context information of the feature and ignores the context information of the feature, the present invention uses a bidirectional LSTM (Bi-directional Long Short-Term Memory, Bi-LSTM) model to simultaneously learn the context information of the feature, which greatly improves the model's time series feature learning ability.

[0116] The internal structure of a single LSTM neural unit is as follows Figure 6 As shown in the figure, i(t) represents the input threshold, o(t) represents the output threshold, f(t) represents the forget threshold, x(t) represents the input, h(t) represents the unit output, which acts as short-term memory, c(t) represents the memory unit, which acts as long-term memory, and σ represents the sigmoid activation function. An LSTM network consists of four feed-forward layers. The input layer, output layer, and forget gate use the sigmoid function as activation functions, while the memory unit and output use the tanh function as activation functions.

[0117] The forget gate is used to control whether the information of the previous moment is accumulated to the current moment. The calculation formula is as follows:

[0118] f(t)=σ(W f ·[h(t-1),x(t)]+b f )

[0119] Among them, W f represents the forget gate weight, b f Represents the bias value of the forget gate, and [h(t-1),x(t)] represents the vector of the concatenation of the previous unit output h(t-1) and the next unit input x(t).

[0120] The input gate is used to control whether the current input information flows into the memory unit and update the cell state according to the information selection. The calculation formula is:

[0121] i(t)=σ(W i ·[h(t-1),x(t)]+b i )

[0122]

[0123] Among them, W i represents the input gate weight, b i represents the input gate bias value, is the candidate value, W c represents the memory unit weight, b c Represents the memory unit bias value, selects and discards information, and the formula for updating the cell state is:

[0124]

[0125] Among them, c(t-1) represents the cell state at the previous moment, f(t)·c(t-1) represents the information that needs to be discarded, Indicates that new information needs to be added.

[0126] The output gate is used to control whether the information of the current memory unit flows into the current hidden state h(t). The calculation formula is:

[0127] O(t)=σ(W o ·[h(t-1),x(t)]+b o )

[0128] h(t)=O(t)·tanh(c(t))

[0129] Among them, W o represents the output gate weight, b o Represents the output gate bias value.

[0130] Generally speaking, LSTM can only perform one-way learning. In order to fully consider context information, this paper adopts a bidirectional LSTM network, which consists of two LSTMs in opposite directions. The forward LSTM layer starts inputting from the first word of the text, and the backward LSTM layer starts inputting from the last word of the text, thereby effectively utilizing all the information in the forward and backward directions of the sequence. The Bi-LSTM (bidirectional LSTM) structure is shown in the figure. Figure 7 As shown, where A represents an LSTM unit. At time t, the forward latent vector h(t) and the backward latent vector h'(t) are:

[0131] h(t)=LSTM(h(t-1),x(t),c(t-1)),t∈[1,n]

[0132] h'(t)=LSTM(h'(t+1),x(t),c'(t+1)),t∈[n,1]

[0133] The calculated Bi-LSTM output vector, that is, the forward and backward output vectors are concatenated:

[0134] y(t)=[h(t),h'(t)]

[0135] In practical applications, step 6 specifically includes:

[0136] Malicious code classification method based on dual-channel Bi-LSTM:

[0137] In order to effectively distinguish API sequence features (API call sequence text) and basic block sequence features (API associated basic block sequence text), the present invention conducts combined learning. A dual channel is formed by connecting single channels in parallel, and the input is input separately in the input layer, and then fused in the hidden layer. The process of the malicious code classification method based on single channel Bi-LSTM is as follows: Figure 8As shown, the single-channel bidirectional LSTM model maps the malicious code feature text with Word2vector (word vector dictionary), and then passes it through the Bi-LSTM layer to obtain a high-dimensional vector. The output is used as the input of the Dense layer, and the Dense layer weights it through the commonly used "relu" activation function and passes it to the next layer. The Dropout layer makes the weights of some hidden layer nodes in the network inactive to avoid overfitting. Finally, because the present invention is a multi-classification task, the softmax layer is selected to predict the category of each sample. The present invention proposes two different fusion methods: the first is to combine the two vectors in a serial splicing manner in the fusion layer for information input, and the other is to combine the two vectors in an additive manner in the fusion layer for information input.

[0138] Figure 9 A dual-channel Bi-LSTM model framework is given, such as Figure 9 As shown in the figure, the mapped API call sequence text and the mapped API-associated basic block sequence text are each passed through a single-channel Bi-LSTM to obtain a new textual representation. The Merge layer fuses the output features of the two single-channel BI-LSTM models, and backpropagation updates the network parameters. The Dropout layer's input comes from the Merge layer, and the specific operations are the same as those based on the single-channel Bi-LSTM. The output layer uses a softmax function to classify malicious code, selecting the most likely category as the predicted label.

[0139] During the training process, the minimization of the cross entropy function is selected as the loss function. The specific formula is as follows:

[0140]

[0141] Among them, t i Represents the actual label (actual classification result) encoded with "one-hot", y i Represents the probability of each category output by the model softmax layer, n c Represents the number of sample categories, λ represents the parameter specifying the penalty weight, i represents the category number, ε represents the specific category of the weight matrix, and W εi , U εi , V εi represents the weight matrix, |||| F represents the Frobeniu norm, w = {i,f,o,c}, μ = {i,f,o,c} and ν = {i,f,o} represent sets of different gates (W,U,V respectively).

[0142] The present invention also provides a malicious code family classification system based on a dual-channel bidirectional LSTM corresponding to the above method, comprising:

[0143] The acquisition module is used to obtain the binary file of the malicious code to be classified.

[0144] The sequence text determination module is used to process the malicious code binary file to be classified using an API call sequence extraction algorithm and a backward slicing algorithm to obtain the API call sequence text and API associated basic block sequence text of the malicious code binary file to be classified.

[0145] The classification module is used to input the API call sequence text and API associated basic block sequence text of the malicious code binary file to be classified into a trained dual-channel bidirectional LSTM-based malicious code classification model to obtain the classification category of the malicious code binary file to be classified.

[0146] As an optional implementation, the malicious code family classification system based on dual-channel bidirectional LSTM further includes:

[0147] The sample set acquisition module is used to acquire a malicious code binary file sample set; the malicious code binary file sample set includes malicious code binary files of multiple known classification categories.

[0148] The sample sequence text determination module is used to process any malicious code binary file using an API call sequence extraction algorithm and a backward slicing algorithm to obtain the API call sequence text and API associated basic block sequence text of the malicious code binary file.

[0149] The dictionary determination module is used to respectively use the API call sequence texts of all malicious code binary files and the API associated basic block sequence texts of all malicious code binary files as corpora to perform word vector training based on the word2vec algorithm to obtain an API function vector dictionary and an operation code vector dictionary.

[0150] The first mapping module is used to map the API call sequence text using the API function vector dictionary to obtain a word vector corresponding to the API call sequence text.

[0151] The second mapping module is used to use the operation code vector dictionary to map the API-associated basic block sequence text to obtain a word vector corresponding to the API-associated basic block sequence text.

[0152] The model determination module is used to take the word vectors corresponding to the API call sequence text and the word vectors corresponding to the API-associated basic block sequence text of each malicious code binary file in the malicious code binary file sample set as input, and take the classification category corresponding to each malicious code binary file as output, to train the malicious code classification model based on the dual-channel bidirectional LSTM, and obtain a trained malicious code classification model based on the dual-channel bidirectional LSTM.

[0153] As an optional implementation, the sequence text determination module includes: an API call sequence text determination submodule, and the API call sequence text determination submodule includes:

[0154] The first acquisition unit is used to acquire the control flow graph and function call graph of the malicious code binary file to be classified.

[0155] The first control flow graph processing unit is used to obtain, based on the control flow graph, the calling relationship between the custom functions in the malicious code binary file to be classified, the jump address of the basic block of the control flow graph, the function of the basic block of the control flow graph, and the address of the API function call in the basic block of the control flow graph.

[0156] The first function call graph processing unit is used to obtain an API call sequence under a full path based on the function call graph.

[0157] The API call sequence text determination unit is used to obtain the API call sequence text based on the calling relationship between the custom functions in the malicious code binary file to be classified, the jump address of the basic block, the function of the basic block, the address of the API function call in the basic block, and the API call sequence under the full path.

[0158] As an optional implementation, the sequence text determination module further includes: an API-associated basic block sequence text determination submodule, the API-associated basic block sequence text determination submodule including:

[0159] The second acquisition unit is used to obtain the control flow graph and function call graph of the malicious code binary file to be classified.

[0160] The second control flow graph processing unit is used to obtain, based on the control flow graph, the calling relationship between the custom functions in the malicious code binary file to be classified, the jump address of the basic block of the control flow graph, the function of the basic block of the control flow graph, and the address of the API function call in the basic block of the control flow graph.

[0161] The second function call graph processing unit is used to obtain the API call sequence under the full path based on the function call graph.

[0162] A node determination unit is used to traverse the API call sequence under the full path, obtain all API functions in the API call sequence under the full path, and obtain the node where each API function is located based on the jump address of the basic block, the function of the basic block and the address of the API function call in the basic block.

[0163] A predecessor node determination unit is used to obtain, for any API function, a predecessor node, a first predecessor node and a second predecessor node of the node where the API function is located based on the control flow graph; the first predecessor node is the predecessor node of the predecessor node, and the second predecessor node is the predecessor node of the first predecessor node.

[0164] The assembly instruction sequence determining unit is configured to read the assembly instructions in the memory addresses where the first predecessor node and the second predecessor node are located, and obtain the assembly instruction sequence corresponding to the API function.

[0165] The API-associated basic block sequence text determination unit is used to combine the assembly instruction sequence corresponding to each of the API functions according to the API call sequence under the full path to obtain the API-associated basic block sequence text.

[0166] As an optional implementation manner, the first acquiring unit specifically includes:

[0167] The graph determination subunit is used to input the malicious code binary file to be classified into the angr analysis system to obtain a control flow graph and a function call graph.

[0168] As an optional implementation, the dictionary determination module specifically includes:

[0169] The word segmentation unit is used to segment the API call sequence text of all malicious code binary files and the API associated basic block sequence text of all malicious code binary files respectively to obtain the segmented API call sequence text and the segmented API associated basic block sequence text.

[0170] The dictionary determination unit is used to use the API call sequence text after word segmentation and the API associated basic block sequence text after word segmentation as corpora to perform word vector training based on the word2vec algorithm to obtain an API function vector dictionary and an operation code vector dictionary.

[0171] As an optional implementation, the malicious code classification model includes:

[0172] The dual-channel bidirectional LSTM layer, Merge layer, Dropout layer and Softmax layer are connected in sequence.

[0173] The present invention analyzes malicious code through two semantic features of different granularities, namely API sequence features (API call sequence text) and basic block sequence features (API-associated basic block sequence text), and generates semantic vectors of these two features based on the word2vec algorithm. This can fully and effectively utilize the semantic information of malicious code of two different granularities, provide more information for the classifier, and make the final classification result more accurate.

[0174] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0175] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The above examples are only intended to help understand the method and core concept of the present invention. At the same time, those skilled in the art will find that the specific implementation methods and application scopes may vary based on the concept of the present invention. In summary, the contents of this specification should not be construed as limiting the present invention.

Claims

1. A malicious code family classification method based on dual-channel bidirectional LSTM, characterized by: include: Obtain the binary file of the malicious code to be classified; Using an API call sequence extraction algorithm and a backward slicing algorithm to process the malicious code binary file to be classified, respectively, to obtain an API call sequence text and an API-associated basic block sequence text of the malicious code binary file to be classified; Inputting the API call sequence text and API associated basic block sequence text of the malicious code binary file to be classified into a trained dual-channel bidirectional LSTM-based malicious code classification model to obtain a classification category of the malicious code binary file to be classified; The API call sequence extraction algorithm and the backward slicing algorithm are respectively used to process the malicious code binary file to be classified to obtain the API call sequence text and the API associated basic block sequence text of the malicious code binary file to be classified, specifically including: Obtaining a control flow graph and a function call graph of the malicious code binary file to be classified; Based on the control flow graph, obtaining the calling relationship between the custom functions in the malicious code binary file to be classified, the jump address of the basic block of the control flow graph, the function of the basic block of the control flow graph, and the address of the API function call in the basic block of the control flow graph; Based on the function call graph, obtain the API call sequence under the full path; Obtaining an API call sequence text based on the calling relationship between the custom functions in the malicious code binary file to be classified, the jump address of the basic block, the function of the basic block, the address of the API function call in the basic block, and the API call sequence under the full path; Traversing the API call sequence under the full path, obtaining all API functions in the API call sequence under the full path, and obtaining the node where each API function is located according to the jump address of the basic block, the function of the basic block, and the address of the API function call in the basic block; For any API function, based on the control flow graph, obtain a predecessor node, a first predecessor node, and a second predecessor node of the node where the API function is located; the first predecessor node is the predecessor node of the predecessor node, and the second predecessor node is the predecessor node of the first predecessor node; Reading assembly instructions in the memory addresses where the first predecessor node and the second predecessor node are located to obtain an assembly instruction sequence corresponding to the API function; The assembly instruction sequences corresponding to the API functions are combined according to the API call sequence under the full path to obtain an API-associated basic block sequence text.

2. A malicious code family classification method based on dual-channel bidirectional LSTM according to claim 1, characterized in that: The process of determining the trained malicious code classification model based on dual-channel bidirectional LSTM includes: Obtaining a malicious code binary file sample set; the malicious code binary file sample set includes malicious code binary files of multiple known classification categories; For any malicious code binary file, the API call sequence extraction algorithm and the backward slicing algorithm are used to process the malicious code binary file to obtain the API call sequence text and API associated basic block sequence text of the malicious code binary file; Using the API call sequence texts of all malicious code binary files and the API associated basic block sequence texts of all malicious code binary files as corpora, word vector training is performed based on the word2vec algorithm to obtain the API function vector dictionary and the operation code vector dictionary; Mapping the API call sequence text using the API function vector dictionary to obtain a word vector corresponding to the API call sequence text; Mapping the API-associated basic block sequence text using the opcode vector dictionary to obtain a word vector corresponding to the API-associated basic block sequence text; Taking the word vectors corresponding to the API call sequence text and the word vectors corresponding to the API-associated basic block sequence text of each malicious code binary file in the malicious code binary file sample set as input, and the classification category corresponding to each malicious code binary file as output, a malicious code classification model based on a dual-channel bidirectional LSTM is trained to obtain a trained malicious code classification model based on a dual-channel bidirectional LSTM.

3. A malicious code family classification method based on dual-channel bidirectional LSTM according to claim 2, characterized in that: The method uses the API call sequence texts of all malicious code binary files and the API associated basic block sequence texts of all malicious code binary files as corpora to perform word vector training based on the word2vec algorithm to obtain an API function vector dictionary and an operation code vector dictionary, specifically including: Performing word segmentation on the API call sequence texts of all malicious code binary files and the API associated basic block sequence texts of all malicious code binary files respectively to obtain the segmented API call sequence texts and the segmented API associated basic block sequence texts; The API call sequence text after word segmentation and the API associated basic block sequence text after word segmentation are respectively used as corpora to perform word vector training based on the word2vec algorithm to obtain an API function vector dictionary and an operation code vector dictionary.

4. A malicious code family classification method based on dual-channel bidirectional LSTM according to claim 1, characterized in that: The malicious code classification model based on dual-channel bidirectional LSTM includes: The dual-channel bidirectional LSTM layer, Merge layer, Dropout layer and Softmax layer are connected in sequence.

5. A malicious code family classification system based on dual-channel bidirectional LSTM, characterized by: include: The acquisition module is used to obtain the binary file of the malicious code to be classified; A sequence text determination module is used to process the malicious code binary file to be classified using an API call sequence extraction algorithm and a backward slicing algorithm to obtain an API call sequence text and an API-associated basic block sequence text of the malicious code binary file to be classified; A classification module is configured to input the API call sequence text and API associated basic block sequence text of the malicious code binary file to be classified into a trained dual-channel bidirectional LSTM-based malicious code classification model to obtain a classification category of the malicious code binary file to be classified; The sequence text determination module includes: an API call sequence text determination submodule and an API associated basic block sequence text determination submodule; The API call sequence text determination submodule includes: A first acquiring unit is configured to acquire a control flow graph and a function call graph of the malicious code binary file to be classified; A first control flow graph processing unit is configured to obtain, based on the control flow graph, a call relationship between custom functions in the malicious code binary file to be classified, jump addresses of basic blocks of the control flow graph, functions of basic blocks of the control flow graph, and addresses of API function calls in basic blocks of the control flow graph; A first function call graph processing unit is used to obtain an API call sequence under a full path based on the function call graph; An API call sequence text determination unit is configured to obtain an API call sequence text based on a call relationship between custom functions in the malicious code binary file to be classified, a jump address of the basic block, a function of the basic block, an address of an API function call in the basic block, and an API call sequence under the full path; The API-associated basic block sequence text determination submodule includes: A second acquiring unit is configured to acquire a control flow graph and a function call graph of the malicious code binary file to be classified; A second control flow graph processing unit is configured to obtain, based on the control flow graph, a call relationship between custom functions in the malicious code binary file to be classified, jump addresses of basic blocks of the control flow graph, functions of basic blocks of the control flow graph, and addresses of API function calls in basic blocks of the control flow graph; A second function call graph processing unit is used to obtain an API call sequence under a full path based on the function call graph; a node determination unit, configured to traverse the API call sequence under the full path, obtain all API functions in the API call sequence under the full path, and obtain the node where each API function is located based on the jump address of the basic block, the function of the basic block, and the address of the API function call in the basic block; a predecessor node determination unit configured to obtain, for any API function, a predecessor node, a first predecessor node, and a second predecessor node of a node where the API function is located based on the control flow graph; the first predecessor node is a predecessor node of the predecessor node, and the second predecessor node is a predecessor node of the first predecessor node; an assembly instruction sequence determining unit, configured to read assembly instructions in the memory addresses where the first predecessor node and the second predecessor node are located, and obtain an assembly instruction sequence corresponding to the API function; The API-associated basic block sequence text determination unit is used to combine the assembly instruction sequence corresponding to each of the API functions according to the API call sequence under the full path to obtain the API-associated basic block sequence text.

6. A malicious code family classification system based on dual-channel bidirectional LSTM according to claim 5, characterized in that: Also includes: A sample set acquisition module is used to obtain a sample set of malicious code binary files; The malicious code binary file sample set includes malicious code binary files of multiple known classification categories; A sample sequence text determination module is used to process any malicious code binary file using an API call sequence extraction algorithm and a backward slicing algorithm to obtain an API call sequence text and an API-associated basic block sequence text of the malicious code binary file; A dictionary determination module is used to perform word vector training based on the word2vec algorithm using the API call sequence texts of all malicious code binary files and the API associated basic block sequence texts of all malicious code binary files as corpora to obtain an API function vector dictionary and an operation code vector dictionary; A first mapping module is configured to map the API call sequence text using the API function vector dictionary to obtain a word vector corresponding to the API call sequence text; A second mapping module is configured to map the API-associated basic block sequence text using the operation code vector dictionary to obtain a word vector corresponding to the API-associated basic block sequence text; The model determination module is used to take the word vectors corresponding to the API call sequence text and the word vectors corresponding to the API-associated basic block sequence text of each malicious code binary file in the malicious code binary file sample set as input, and take the classification category corresponding to each malicious code binary file as output, to train the malicious code classification model based on the dual-channel bidirectional LSTM, and obtain a trained malicious code classification model based on the dual-channel bidirectional LSTM.

Images