Methods, devices, servers, and computer storage media used to trace malicious attacks

Abstract

This application provides a method, apparatus, server, and computer storage medium for tracing the source of malicious attacks. The method involves inputting source code information into a deanonymization model, which generates a set of suspicious users. Each suspicious user set includes at least one suspicious user. The deanonymization model is trained on a deep learning network using training samples of multiple source code information and corresponding real user information. Then, the user information of each suspicious user, as well as the repository information and content of the code repositories held by the suspicious user, are crawled. The code repositories held by the suspicious user contain the source code of projects in which the suspicious user participated. Finally, the user information, repository information, and code content of each suspicious user are processed to obtain a profile of each suspicious user. This achieves the goal of accurately tracing the source of malicious attacks.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, server, and computer storage medium for tracing the source of malicious attacks. Background Technology

[0002] In the face of increasingly complex and frequent cyberattacks, simply being able to detect and defend against cyberattacks is no longer sufficient to meet current needs; it is also necessary to be able to trace and identify the attackers.

[0003] Currently, IP location technology is commonly used to obtain the attacker's IP address from intrusion logs, attack traffic, and other sources, and then pinpoint the attacker's physical address based on the IP. However, some experienced hackers can consciously circumvent IP location technology, for example, by using IP proxy technology to hide their attack address, thus rendering IP location technology ineffective and greatly increasing the difficulty of tracing the source. Summary of the Invention

[0004] In view of this, this application provides a method, apparatus, server, and computer storage medium for tracing the source of malicious attacks, for accurately tracing the source of malicious attacks.

[0005] The first aspect of this application provides a method for tracing the source of malicious attacks, including:

[0006] Obtain the source code information that leads to malicious attacks;

[0007] The source code information is input into the deanonymization model, and the deanonymization model obtains a set of suspicious users; wherein, the set of suspicious users includes at least one suspicious user; the deanonymization model is obtained by training a deep learning network with training samples of multiple source code information and real user information corresponding to the training samples of the source code information.

[0008] The user information of each suspicious user, as well as the repository information and code repository content of the code repository held by the suspicious user, are crawled separately; wherein, the code repository held by the suspicious user stores the source code of the project in which the suspicious user participated;

[0009] The user information, code repository information, and code repository content of each suspicious user are processed to obtain a profile of each suspicious user.

[0010] Optionally, obtaining the source code information that forms the malicious attack includes:

[0011] Obtain the binary file that forms the malicious attack;

[0012] Parse the binary file to obtain pseudocode information;

[0013] Obtain the source code information corresponding to the pseudocode information.

[0014] Optionally, before inputting the source code information into the deanonymization model and obtaining the set of suspicious users from the deanonymization model, the method further includes:

[0015] Extract the inverse frequency features of the terms from the source code information;

[0016] The step of inputting the source code information into the deanonymization model and obtaining a set of suspicious users from the deanonymization model includes:

[0017] The inverse frequency features of the word frequency are input into the deanonymization model, and the set of suspicious users is obtained by the deanonymization model.

[0018] Optionally, the step of crawling the user information of each suspicious user, as well as the repository information and code repository content held by the suspicious user, includes:

[0019] Using a user information crawler, the personal information of each suspicious user, the organizational information of the organization the suspicious user participates in, and the member information within the organization are crawled; and the personal information of each suspicious user, the organizational information of the organization the suspicious user participates in, and the member information within the organization are saved in a file of a predetermined format to obtain the user information of each suspicious user;

[0020] Using a repository information crawler, basic information and repository commit information of each code repository held by the suspected user are crawled; the basic information of each code repository held by the suspected user is saved as a first file in a predetermined format, and the repository commit information is saved as a second file in a predetermined format; wherein, the first file and the second file are the repository information of the code repository held by the suspected user; the repository commit information of the code repository held by the suspected user is the description information of the source code information of the user-submitted project;

[0021] Using a repository download crawler, the code repository content of each code repository held by the suspected user is crawled, and the crawled code repository content of each code repository held by the suspected user is classified according to programming language.

[0022] Optionally, the process of processing the user information, code repository information, and code repository content of each suspicious user to obtain a profile of each suspicious user includes:

[0023] From the user information, code repository information, and code repository content of each suspicious user, data for each suspicious user under the profile description dimension is filtered out; wherein, there are multiple profile description dimensions, and the data under each profile description dimension describes the suspicious user in one aspect;

[0024] For each suspicious user, the filtered data of the suspicious user under the profile description dimension is mapped to the corresponding profile description dimension to obtain the profile of each suspicious user.

[0025] Optionally, the training method for the deanonymization model includes:

[0026] Construct a training sample set; wherein the training sample set includes multiple training samples and real user information corresponding to each training sample; the training samples are source code information;

[0027] The training samples are input into a deep learning network model, and the deep learning network model obtains predicted user information.

[0028] The cross-entropy between the predicted user information and the real user information is used as the loss function.

[0029] Determine whether the loss function satisfies the preset convergence condition;

[0030] If it is determined that the loss function does not meet the preset convergence condition, the parameters in the deep learning network model are adjusted until the loss function of the adjusted deep learning network model meets the preset convergence condition, and the adjusted deep learning network model is used as the deanonymization model.

[0031] Optionally, constructing the training sample set includes:

[0032] The system crawls user information for each user accessing the network interface; wherein, the user information includes information about the user's followers and information about the people the user follows.

[0033] Construct a user recursion tree corresponding to the user based on the information of the user's followers and the information of the people the user follows;

[0034] The repository information of the code repositories held by each user in the user recursion tree is crawled respectively; wherein, the repository information of the code repository includes: the basic information of the code repository held by the user, the repository commit information, and the download address of the repository content; the project commit information of the code repository held by the user is the description information of the source code information of the project submitted by the user;

[0035] Download the repository content of the user-held code repository in the user recursion tree from the download address of the repository content; wherein, the downloaded repository content of the user-held code repository in the user recursion tree is used as the training sample.

[0036] Optionally, before inputting the training samples into the deep learning network model and obtaining the predicted user information from the deep learning network model, the method further includes:

[0037] Extract the inverse frequency features of the word frequency from the training samples;

[0038] The training samples are input into a deep learning network model, and the predicted user information is obtained from the deep learning network model, including:

[0039] The inverse frequency features of the word frequency are input into a deep learning network model, and the predicted user information is obtained by the deep learning network model.

[0040] Optionally, the deep learning network model is constructed using a fully connected layer with leak-corrected linear units as activation functions, a batch normalization layer, and a softmax function; or, the deep learning network model is constructed using a fully connected layer with leak-corrected linear units as activation functions, a batch normalization layer, and a random forest algorithm.

[0041] The deep learning network model is trained using an adaptive moment estimation optimizer.

[0042] A second aspect of this application provides a malicious attack tracing device, comprising:

[0043] The first acquisition unit is used to acquire source code information that forms the malicious attack;

[0044] The first input unit is used to input the source code information into the deanonymization model, and the deanonymization model obtains a set of suspicious users; wherein, the set of suspicious users includes at least one suspicious user; the deanonymization model is obtained by training a deep learning network model with training samples of multiple source code information and real user information corresponding to the training samples of the source code information.

[0045] The first crawling unit is used to crawl the user information of each of the suspicious users, as well as the repository information and code repository content of the code repository held by the suspicious user; wherein, the code repository held by the suspicious user stores the source code of the project in which the suspicious user participated;

[0046] The processing unit is used to process the user information, code repository information, and code repository content of each of the suspected users to obtain a profile of each of the suspected users.

[0047] Optionally, the first acquisition unit includes:

[0048] A binary file acquisition unit is used to acquire the binary file that forms the malicious attack.

[0049] A parsing unit is used to parse the binary file to obtain pseudocode information;

[0050] The first acquisition subunit is used to acquire the source code information corresponding to the pseudocode information.

[0051] Optionally, the malicious attack tracing device further includes:

[0052] The first extraction unit is used to extract the inverse frequency features of word frequencies from the source code information;

[0053] The first input unit is used for:

[0054] The inverse frequency features of the word frequency are input into the deanonymization model, and the set of suspicious users is obtained by the deanonymization model.

[0055] Optionally, the first crawling unit includes:

[0056] The user information crawling unit is used to crawl the personal information of each suspicious user, the organizational information of the organization in which the suspicious user participates, and the member information within the organization using a user information crawler; and save the crawled personal information of each suspicious user, the organizational information of the organization in which the suspicious user participates, and the member information within the organization in a file of a predetermined format to obtain the user information of each suspicious user.

[0057] The repository information crawling unit is used to crawl the basic information and repository submission information of each code repository held by the suspected user using a repository information crawler; and to save the basic information of each code repository held by the suspected user as a first file in a predetermined format, and to save the crawled repository submission information as a second file in a predetermined format; wherein, the first file and the second file are the repository information of the code repository held by the suspected user; and the repository submission information of the code repository held by the suspected user is the description information of the source code information of the user-submitted project;

[0058] The repository content crawling unit is used to crawl the code repository content of each code repository held by the suspected user using a repository download crawler, and to classify the crawled code repository content of each code repository held by the suspected user according to programming language.

[0059] Optionally, the processing unit includes:

[0060] The filtering unit is used to filter out the data of each suspicious user under the profile description dimension from the user information, the code repository information and the code repository content of each suspicious user; wherein, there are multiple profile description dimensions, and the data under each profile description dimension describes the suspicious user in one aspect;

[0061] The mapping unit is used to map the filtered suspicious user's data in the profile description dimension to the corresponding profile description dimension for each suspicious user, thereby obtaining a profile for each suspicious user.

[0062] Optionally, the training unit of the deanonymization model includes:

[0063] A construction unit is used to construct a training sample set; wherein, the training sample set includes multiple training samples and real user information corresponding to each training sample; the training samples are source code information;

[0064] The second input unit is used to input the training samples into the deep learning network model, and the deep learning network model obtains the predicted user information.

[0065] The calculation unit is used to use the cross-entropy of the predicted user information and the real user information as a loss function;

[0066] The judgment unit is used to determine whether the loss function satisfies the preset convergence condition;

[0067] A determining unit is configured to adjust the parameters in the deep learning network model if the determining unit determines that the loss function does not meet the preset convergence condition, until the loss function of the adjusted deep learning network model meets the preset convergence condition, and then use the adjusted deep learning network model as the deanonymized model.

[0068] Optionally, the building unit includes:

[0069] The second crawling unit is used to crawl user information for each user who accesses the network interface; wherein, the user information includes information about the user's followers and information about the people the user follows;

[0070] A construction unit is used to construct a user recursion tree corresponding to the user based on the information of the user's followers and the information of the people the user follows.

[0071] The third crawling unit is used to crawl the repository information of the code repository held by the user in each of the user recursion trees; wherein, the repository information of the code repository includes: the basic information of the code repository held by the user, the repository submission information, and the download address of the repository content; the project submission information of the code repository held by the user is the description information of the source code information of the project submitted by the user;

[0072] The download unit is used to download the repository content of the user-held code repository in the user recursion tree from the download address of the repository content; wherein the downloaded repository content of the user-held code repository in the user recursion tree is used as the training sample.

[0073] Optionally, the malicious attack tracing device further includes:

[0074] The second extraction unit is used to extract the inverse frequency features of word frequencies from the training samples;

[0075] The second input unit is used for:

[0076] The inverse frequency features of the word frequency are input into a deep learning network model, and the predicted user information is obtained by the deep learning network model.

[0077] Optionally, the deep learning network model is constructed using a fully connected layer with leak-corrected linear units as activation functions, a batch normalization layer, and a softmax function; or, the deep learning network model is constructed using a fully connected layer with leak-corrected linear units as activation functions, a batch normalization layer, and a random forest algorithm.

[0078] The deep learning network model is trained using an adaptive moment estimation optimizer.

[0079] A third aspect of this application provides a server, comprising:

[0080] One or more processors;

[0081] A storage device on which one or more programs are stored;

[0082] When the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method as described in any one of the first aspects.

[0083] The fourth aspect of this application provides a computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method as described in any one of the first aspects.

[0084] As can be seen from the above scheme, the malicious attack tracing method, apparatus, server, and computer storage medium provided in this application involve inputting source code information into a deanonymization model, which then generates a set of suspicious users. The set of suspicious users includes at least one suspicious user. The deanonymization model is trained on a deep learning network model using training samples of multiple source code information and the corresponding real user information. Then, the user information of each suspicious user, as well as the repository information and content of the code repository held by the suspicious user, are crawled. The code repository held by the suspicious user stores the source code of projects in which the suspicious user participated. Finally, the user information, repository information, and code repository content of each suspicious user are processed to obtain a profile of each suspicious user. This achieves the goal of accurately tracing the source of malicious attacks. Attached Figure Description

[0085] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0086] Figure 1 A flowchart illustrating a method for tracing the source of a malicious attack, as provided in an embodiment of this application.

[0087] Figure 2 A flowchart illustrating a method for converting a binary file into source code information, provided in an embodiment of this application;

[0088] Figure 3 The graph of ReLU in the prior art;

[0089] Figure 4 The image shows the loss function when training a deep learning network model using the Adam optimizer.

[0090] Figure 5 Image showing the accuracy during the training process of a deep learning network model using the Adam optimizer;

[0091] Figure 6 A schematic diagram of the structure of a deep learning network model provided in an embodiment of this application;

[0092] Figure 7 A schematic diagram of a final deanonymization model provided in an embodiment of this application;

[0093] Figure 8 A schematic diagram illustrating the accuracy of random forest classification layers under different parameters;

[0094] Figure 9 A flowchart illustrating a training method for a deanonymization model provided in this application embodiment;

[0095] Figure 10 A flowchart illustrating the specific process of constructing a training sample set is provided in this application embodiment;

[0096] Figure 11 This application provides a schematic diagram of the overall structure for obtaining training samples in an embodiment.

[0097] Figure 12 A schematic diagram illustrating the impact of different numbers of TF-IDF features on classification accuracy;

[0098] Figure 13 A flowchart illustrating a method for crawling user information of each suspicious user, as well as repository information and code repository content held by the suspicious user, provided in an embodiment of this application;

[0099] Figure 14 A flowchart illustrating a method for generating a profile of a suspicious user, provided in an embodiment of this application;

[0100] Figure 15 A schematic diagram illustrating a profile of a suspicious user provided in an embodiment of this application;

[0101] Figure 16 A schematic diagram of a malicious attack tracing device provided in another embodiment of this application;

[0102] Figure 17 This is a schematic diagram of a server for implementing a method for tracing the source of malicious attacks, as provided in another embodiment of this application. Detailed Implementation

[0103] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0104] It should be noted that the concepts of "first," "second," etc., mentioned in this application are used only to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies. The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0105] This application provides a method for tracing the source of malicious attacks, such as... Figure 1 As shown, the specific steps include:

[0106] S101. Obtain source code information that leads to a malicious attack.

[0107] The source code information can be the source code information left over from the malicious attack obtained by the server; it can also be a portion of the source code information that was captured to form the malicious attack; it can also be the source code information left over from the malicious attack uploaded to the server by the forensic personnel; or it can be the portion of the source code information that formed the malicious attack uploaded to the server by the forensic personnel, etc. There are no restrictions here.

[0108] If only binary files capable of generating malicious attacks can be obtained, then one implementation of step S101 is as follows: Figure 2 As shown, it specifically includes:

[0109] S201. Obtain the binary file that forms the malicious attack.

[0110] The source code information can be the binary files left over from the malicious attack obtained by the server; it can also be a partial binary file that formed the malicious attack; it can be the binary files left over from the malicious attack uploaded to the server by the forensic personnel; or it can be the partial binary files that formed the malicious attack uploaded to the server by the forensic personnel, etc. There are no restrictions here.

[0111] S202. Parse the binary file to obtain pseudocode information.

[0112] Specifically, the obtained binary file is parsed to obtain pseudocode information that forms a binary file.

[0113] S203. Obtain the source code information corresponding to the pseudocode information.

[0114] The pseudocode information is converted into corresponding, implementable source code information.

[0115] S102. Input the source code information into the deanonymization model, and obtain the set of suspicious users from the deanonymization model.

[0116] The suspicious user set includes at least one suspicious user; the deanonymization model is obtained by training a deep learning network model with training samples of multiple source code information and the real user information corresponding to the training samples of source code information.

[0117] It should be noted that the deep learning network model used in this application may be, but is not limited to, a fully-connected layer, a batch normalization layer, and a softmax function constructed using leaky ReLU as the activation function; or a fully-connected layer, a batch normalization layer, and a random forest algorithm constructed using leaky ReLU as the activation function.

[0118] For example, a deep learning network model is built using a fully connected layer with 5 leak correction linear units as activation functions and 3 batch normalization layers. The fully connected layer has 1024 neurons, and a softmax function is added at the end.

[0119] The Tensorflow framework can be used, but is not limited to, when constructing the network layers of a deep degree network model.

[0120] Currently, the Corrected Linear Unit (ReLU) is the activation function used in deep learning, and its mathematical expression is:

[0121] ReLU(x) = max(0,x);

[0122] like Figure 3 The image shows the ReLU function graph. It can be seen that neurons only activate when the input exceeds a threshold. When using gradient descent for optimization, the convergence speed is faster than existing sigmoid and tanh functions. However, when the input is negative, the gradient will always be 0, and the neuron will stop training. Therefore, to solve this problem of the ReLU function, a leaky value is introduced in the negative half-interval of the ReLU function, resulting in the leaky corrected linear unit (leakyReLU) function:

[0123] ;

[0124] As can be seen, the output of LeakyReLU has a slight slope for negative inputs. Since the derivative is not always zero, this reduces the occurrence of silent neurons, allowing gradient-based learning. Therefore, this application chooses the LeakyReLU function as the activation function for every layer except the last one.

[0125] When training deep learning network models, standardizing the input can improve training speed. A common method is to normalize the training set, which involves subtracting the mean μ from the original data and then dividing by the variance. However, standardized input only processes the input. As the depth of the deep learning network model increases, the input distribution of the hidden layers gradually shifts, thus disrupting the feature distribution learned by each layer and ultimately slowing down training convergence. To address this issue, this application adds a Batch Normalization layer after each fully connected layer.

[0126] The Batch Normalization layer introduces learnable reconstruction parameters γ and β, allowing the network to learn and recover the feature distribution that the original network intended to learn. The forward pass formula for the Batch Normalization layer is as follows:

[0127]

[0128]

[0129]

[0130] ;

[0131] in, To prevent the introduction of extremely small quantities during division by zero, The value of mini-batch, .

[0132] Deep learning network models can be trained using, but are not limited to, the Adaptive Moment Estimation (Adam) optimizer. Adam uses less memory and converges faster than optimizers like SGD and RMSProp. An example is setting the Adam learning step size (lr) to 0.001, the batch size to 32, and the number of epochs to 1000. Figure 4 The image shown is a graph of the loss function when training a deep learning network model using the Adam optimizer. Figure 5 This image shows the accuracy during the training process of a deep learning network model using the Adam optimizer.

[0133] Meanwhile, in order to improve the accuracy of the deanonymization model in identifying suspicious user sets, the source code information can be preprocessed before it is input into the deanonymization model and the model obtains the suspicious user set. This preprocessing can be done by, but is not limited to, using the Term Frequency–Inverse Document Frequency (TF-IDF) algorithm to extract the inverse frequency features of the source code information. Then, the inverse frequency features are input into the deanonymization model to obtain the suspicious user set.

[0134] The TF-IDF algorithm is used to evaluate the importance of a word to a document within a document set or corpus. The importance of a word increases proportionally to the frequency of its occurrence in the document, but decreases inversely proportionally to its frequency of occurrence in the corpus.

[0135] like Figure 6 The diagram shows the structure of a deep learning network model. After building the deep learning network model, it is used to predict the training samples. The judgment results generated by the deep learning network model are used to determine whether the deep learning network model can be used as the final deanonymization model.

[0136] like Figure 7 The diagram illustrates the final deanonymization model. First, the code file (source code) undergoes TF-IDF preprocessing to extract inverse frequency features (IFs) from the source code information. Then, these IFs are input into a deep neural network to extract further features. Finally, the model can identify at least one possible author of the source code, i.e., a set of suspicious users, through methods including, but not limited to, softmax layers and random forest classification layers. The random forest classification layer is implemented using the scikit-learn framework.

[0137] It should be noted that, based on the results of multiple experiments, such as Figure 8 As shown, the classification accuracy reaches its highest level when the number of subtrees in the random forest is set to 200.

[0138] Optionally, in another embodiment of this application, one implementation of the training method for the deanonymization model is as follows: Figure 9 As shown, it includes:

[0139] S901. Construct a training sample set.

[0140] The training sample set includes multiple training samples and the real user information corresponding to each training sample; the training samples are source code information.

[0141] It should be noted that multiple training samples in the training sample set, as well as the real user information corresponding to each training sample, can be obtained by crawling websites, platforms, etc., through methods such as web scraping, but not limited to web scraping.

[0142] Optionally, in another embodiment of this application, one implementation of step S901 is as follows: Figure 10 As shown, it includes:

[0143] S1001, crawl user information for each user who accesses the network interface.

[0144] User information includes information about the user's followers and information about the people the user follows.

[0145] Taking scraping user information from GitHub as an example, a user information scraper can be used to scrape relevant information of a GitHub user in JSON dictionary form by requesting GitHub's REST API interface. This information includes username (login), bio, followers, and people being followed.

[0146] Understandably, each request to the GitHub API yields a user's information, and then useful entries from the GitHub API user information are formatted and saved to the database.

[0147] S1002. Based on the information of the user's followers and the information of the people the user follows, construct the user recursion tree corresponding to the user.

[0148] S1003. Crawl the repository information of the code repositories held by each user in the user recursion tree.

[0149] The repository information includes: basic information about the code repository held by the user, repository commit information, and download address of the repository content; the project commit information of the code repository held by the user is a description of the source code information of the project submitted by the user.

[0150] Continuing with the example of scraping information from GitHub, we use a repository information crawler to extract users whose number of code repositories is greater than 0 from the user information obtained by the user information crawler. Then, through GitHub's REST API interface, we request detailed information about the code repositories held by a specific GitHub user in a list format, including the repository name, project commit information (commits_url), download link (archive_url), etc.

[0151] It should be noted that each request to the GitHub API will retrieve information on up to 100 repositories. The number of repositories returned each time can be controlled by the URL parameters `page` and `per_page`. The useful entries in the table above will then be formatted and saved to the database.

[0152] S1004. Download the repository content of the user-held code repository in the user recursion tree from the download address of the repository content.

[0153] The downloaded user recursion tree contains the contents of the code repositories held by the users, which are used as training samples.

[0154] It should be noted that the download method from the repository can be, but is not limited to, tarball, zipball, etc. There is no limitation here. When downloading using the tarball method, it is saved in tar.gz format, and when downloading using the zipball method, it is saved in zip format.

[0155] Understandably, downloading the code repository content held by a user from the user's recursive tree from the repository content download address is time-consuming. Therefore, an asynchronous approach can be adopted, while limiting the number of concurrent download threads to ensure that the remote code repository is downloaded to the local machine within the optimal time. After the code repository is downloaded, a zip file named after the repository is generated locally. Then, by decompressing and filtering the code files, other unnecessary files are deleted, retaining only the source code information with relatively small space occupation, thereby saving disk space on the crawler backend.

[0156] like Figure 11 As shown, to obtain the overall structure diagram of the training samples, firstly, user information of user A was obtained through a user information crawler via the GitHub API, including user A's Followers and Followers. Based on the information of the user's followers and the people the user follows, a user recursion tree was constructed. After deduplicating the users in the user recursion tree, a queue of user A's information was obtained. This queue of user A's information was asynchronously stored in a user table, and the users in the user table were filtered to obtain the final user queue. Next, a repository information crawler processed the repository information of each user's code repository in the final user queue. After deduplicating the repository information, a queue of repository information was obtained. This queue of repository information was asynchronously stored in a repository table, and the repository information in the queue of repository information was filtered to obtain the final repository information queue. The repository content of the code repositories held by the users in the user recursion tree, i.e., the training samples, was downloaded from the repository content download address. After filtering the training samples, a repository code queue was formed. Finally, the training samples were categorized by programming language and stored.

[0157] S902. Input the training samples into the deep learning network model, and the deep learning network model will obtain the predicted user information.

[0158] To improve the accuracy of the trained deep learning network model, before inputting the training samples into the deep learning network model and obtaining the predicted user information, the training samples can be preprocessed. This can be done, but is not limited to, using the Term Frequency–Inverse Document Frequency (TF-IDF) algorithm to preprocess the training samples and extract the inverse frequency features of the training samples.

[0159] The TF-IDF algorithm is used to evaluate the importance of a word to a document within a document set or corpus. The importance of a word increases proportionally to the frequency of its occurrence in the document, but decreases inversely proportionally to its frequency of occurrence in the corpus.

[0160] The training samples are input into the TF-IDF model, and the vector representation of each piece of code output is as follows:

[0161] [TF-IDF(t1,d i ,D), TF-IDF(t2,d i ,D),…, TF-IDF(t n ,d i ,D)];

[0162] Here, n is the total number of training samples in the training sample set D. However, if the training sample set contains thousands or even tens of thousands of code files, the dimensionality of the output feature vector will be too large. Therefore, the k most frequent words in the training sample set are used as the initial features. This module implements the TF-IDF model using the CountVectorizer and TfidfTransformer classes from the scikit-learn machine learning library.

[0163] It should be noted that the value of k should be adjusted according to the amount of code. For example, with 611 authors and each author contributing 9 pieces of C++ code, the value of k would be... Figure 12 As shown in the figure, experiments have demonstrated that the deep learning network model achieves the highest accuracy when k is set to 3000.

[0164] S903. Use the cross-entropy between predicted user information and real user information as the loss function.

[0165] S904. Determine whether the loss function meets the preset convergence conditions.

[0166] The preset convergence conditions are pre-set by technical personnel and can be adjusted according to actual application conditions and scenarios; no restrictions are imposed here.

[0167] Specifically, if it is determined that the loss function does not meet the preset convergence condition, then step S905 is executed; if it is determined that the loss function meets the preset convergence condition, then step S906 is executed.

[0168] S905. Adjust the parameters in the deep learning network model.

[0169] S906. Use deep learning network models as deanonymization models.

[0170] It is understood that, in the implementation of this embodiment, a maximum number of training rounds can be preset to continuously train the deep learning network model until the maximum number of training rounds is reached, and the deep learning network model that has reached the maximum number of training rounds can be used as the deanonymization model.

[0171] S103. Crawl the user information of each suspicious user, as well as the repository information and code repository content of the code repository held by the suspicious user.

[0172] Among them, the code repositories held by suspicious users contain the source code of projects in which the suspicious users participated.

[0173] Optionally, in another embodiment of this application, one implementation of step S103 is as follows: Figure 13 As shown, it specifically includes:

[0174] S1301. Using a user information crawler, crawl the personal information of each suspicious user, the organizational information of the organization in which the suspicious user participates, and the member information within the organization; and save the crawled personal information of each suspicious user, the organizational information of the organization in which the suspicious user participates, and the member information within the organization in a file of a predetermined format to obtain the user information of each suspicious user.

[0175] The personal information of suspicious users includes at least the username, user ID, user avatar, user homepage, and user profile; the organizational information of organizations in which suspicious users participate includes at least the organization name, organization ID, organization avatar, organization homepage, and organization profile; and the member information within the organization includes at least the member name, member ID, member avatar, member homepage, and member profile.

[0176] Since some users may participate in organizations on GitHub and collaborate with members on projects, GitHub organization information can reveal deeper social relationships among target users. They may be friends or colleagues in real life, jointly maintaining several projects, and therefore may share similar programming habits.

[0177] It should be noted that, but is not limited to, formatting the personal information of each suspicious user, the organizational information of the organization the suspicious user participates in, and the member information within the organization into a JSON file, such as user.json, to obtain the user information of each suspicious user and save it locally for the front end to display to the user.

[0178] S1302. Using a repository information crawler, crawl the basic information of the code repository held by each suspicious user, as well as the repository commit information; and save the basic information of the code repository held by each suspicious user as a first file in a predetermined format, and save the crawled repository commit information as a second file in a predetermined format.

[0179] The first and second files contain repository information for the code repository held by the suspicious user, including at least the repository name, repository ID, repository description, repository homepage, and number of repository favorites; the repository commit information for the code repository held by the suspicious user is a description of the source code information of the project submitted by the user, including at least the submitter, commit time, and commit content.

[0180] Since a repository may have multiple contributors who jointly participate in the development and maintenance of the project, by crawling the contributor information of all repositories of a user, the user can be linked to other contributors, and combined with the user's organizational member information, the GitHub users most closely related to the user can be identified.

[0181] Understandably, in order to make more accurate statistics, for some large public projects, only the top 100 contributors who have contributed the most to the repository are included; the Git Hub API will also sort these contributors in descending order by the number of contributions by default, and according to the sort order, these top-ranked contributors are more likely to have a relationship with the target user.

[0182] It should be noted that, but is not limited to, formatting the basic information of each suspicious user's code repository obtained from the crawling into a JSON file, such as repos.json; formatting the crawled repository commit information into a JSON file, such as commits.json, and saving it locally for the front-end to display to the user.

[0183] S1303. Use a repository download crawler to crawl the code repository content of each suspicious user's code repository, and classify the crawled code repository content of each suspicious user's code repository according to programming language.

[0184] S104. Process the user information, code repository information, and code repository content of each suspicious user to obtain a profile of each suspicious user.

[0185] After obtaining a profile of each suspicious user, the user profile can be used to assist relevant departments in tracing and analyzing the source of hackers or organizations that use malicious code to carry out cyberattacks.

[0186] Optionally, in another embodiment of this application, one implementation of step S104 is as follows: Figure 14 As shown, it specifically includes:

[0187] S1401. From the user information, code repository information and code repository content of each suspicious user, filter out the data of each suspicious user under the profile description dimension.

[0188] The profile description has multiple dimensions, and the data under each profile description dimension describes a suspicious user from one aspect.

[0189] like Figure 15 The diagram illustrates the profile of a suspicious user, including GitHub user analysis statistics and the aforementioned profile of suspicious users. This includes basic user information, extracted GitHub Pages data, organizational information, repository information, functions, stakeholders, total number of commits, commit month statistics, commit week statistics, commit time statistics, function stats_blank, work time statistics, habitual work hours, programming language statistics, most frequently used languages, and programming style statistics. Specifically, data for each suspicious user is extracted from their user information, repository information, and repository content, focusing on the dimensions described in the profile.

[0190] S1402. For each suspicious user, map the data of the suspicious user in the profile description dimension to the corresponding profile description dimension to obtain the profile of each suspicious user.

[0191] As shown in the above scheme, this application provides a method for tracing the source of malicious attacks. This involves inputting source code information into a deanonymization model, which then generates a set of suspicious users. Each suspicious user set includes at least one suspicious user. The deanonymization model is trained using training samples of multiple source code information and the corresponding real user information. Then, the user information of each suspicious user, as well as the repository information and content of the code repository held by the suspicious user, are crawled. The code repository held by the suspicious user contains the source code of projects in which the suspicious user participated. Finally, the user information, repository information, and code content of each suspicious user are processed to obtain a profile of each suspicious user. This achieves the goal of accurately tracing the source of malicious attacks.

[0192] Another embodiment of this application provides a malicious attack tracing device, such as... Figure 16 As shown, it specifically includes:

[0193] The first acquisition unit 1601 is used to acquire source code information that forms a malicious attack.

[0194] Optionally, in another embodiment of this application, one implementation of the first acquisition unit 1601 includes:

[0195] The binary file acquisition unit is used to acquire binary files that could be used to launch malicious attacks.

[0196] The parsing unit is used to parse binary files and obtain pseudocode information.

[0197] The first acquisition subunit is used to acquire the source code information corresponding to the pseudocode information.

[0198] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, such as... Figure 2 As shown, it will not be elaborated further here.

[0199] The first input unit 1602 is used to input source code information into the deanonymization model, and the deanonymization model obtains a set of suspicious users.

[0200] The suspicious user set includes at least one suspicious user; the deanonymization model is obtained by training a deep learning network model with training samples of multiple source code information and the real user information corresponding to the training samples of source code information.

[0201] The first crawling unit 1603 is used to crawl the user information of each of the suspicious users, as well as the repository information and code repository content of the code repository held by the suspicious users.

[0202] Among them, the code repositories held by suspicious users contain the source code of projects in which the suspicious users participated.

[0203] Optionally, in another embodiment of this application, one implementation of the first crawling unit 1603 includes:

[0204] The user information crawling unit is used to crawl the personal information of each suspicious user, the organizational information of the organization in which the suspicious user participates, and the member information within the organization using a user information crawler; and saves the crawled personal information of each suspicious user, the organizational information of the organization in which the suspicious user participates, and the member information within the organization in a file with a predetermined format to obtain the user information of each suspicious user.

[0205] The repository information crawling unit is used to crawl the basic information of the code repository held by each suspicious user and the repository commit information using a repository information crawler; and saves the basic information of the code repository held by each suspicious user as a first file in a predetermined format, and saves the crawled repository commit information as a second file in a predetermined format.

[0206] The first and second files contain repository information for code repositories held by suspicious users; the repository commit information for code repositories held by suspicious users is a description of the source code information of the projects submitted by the users.

[0207] The repository content crawling unit is used to crawl the code repository content of each suspicious user's code repository using a repository download crawler, and then classify the crawled code repository content of each suspicious user's code repository according to programming language.

[0208] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, such as... Figure 13 As shown, it will not be elaborated further here.

[0209] The processing unit 1604 is used to process the user information, the repository information of the code repository held by each suspicious user, and the content of the code repository to obtain a profile of each suspicious user.

[0210] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, such as... Figure 1 As shown, it will not be elaborated further here.

[0211] Optionally, in another embodiment of this application, one implementation of the processing unit 1604 includes:

[0212] The filtering unit is used to filter out the data of each suspicious user under the profile description dimension from the user information, the code repository information and code repository content of each suspicious user.

[0213] The profile description has multiple dimensions, and the data under each profile description dimension describes a suspicious user from one aspect.

[0214] The mapping unit is used to map the filtered suspicious user data under the profile description dimension to the corresponding profile description dimension to obtain a profile for each suspicious user.

[0215] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, such as... Figure 14 As shown, it will not be elaborated further here.

[0216] Optionally, in another embodiment of this application, one implementation of the training unit for the deanonymization model includes:

[0217] Building units are used to construct training sample sets.

[0218] The training sample set includes multiple training samples and the real user information corresponding to each training sample; the training samples are source code information.

[0219] The second input unit is used to input training samples into the deep learning network model, from which the deep learning network model obtains predicted user information.

[0220] The calculation unit is used to use the cross-entropy between predicted user information and real user information as the loss function.

[0221] The judgment unit is used to determine whether the loss function meets the preset convergence conditions.

[0222] The determining unit is used to adjust the parameters in the deep learning network model if the judgment unit determines that the loss function does not meet the preset convergence condition, until the loss function of the adjusted deep learning network model meets the preset convergence condition, and the adjusted deep learning network model is used as the deanonymized model.

[0223] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, such as... Figure 9 As shown, it will not be elaborated further here.

[0224] Optionally, in another embodiment of this application, one implementation of the building unit includes:

[0225] The second crawling unit is used to crawl user information for each user who accesses the network interface.

[0226] User information includes information about the user's followers and information about the people the user follows.

[0227] The construction unit is used to construct the user recursion tree corresponding to the user based on the information of the user's followers and the information of the people the user follows.

[0228] The third crawling unit is used to crawl the repository information of the code repositories held by each user in the user's recursion tree.

[0229] The repository information includes: basic information about the code repository held by the user, repository commit information, and download address of the repository content; the project commit information of the code repository held by the user is a description of the source code information of the project submitted by the user.

[0230] The download unit is used to download the repository content of the user-held code repository in the user's recursive tree from the download address of the repository content.

[0231] The downloaded user recursion tree contains the contents of the code repositories held by the users, which are used as training samples.

[0232] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, such as... Figure 10 As shown, it will not be elaborated further here.

[0233] Optionally, in another embodiment of this application, one implementation of the malicious attack tracing device further includes:

[0234] The first extraction unit is used to extract the inverse frequency features of word frequencies from the source code information.

[0235] The first input unit 1602 is used for:

[0236] The inverse frequency features of word frequency are input into the deanonymization model, and the set of suspicious users is obtained from the deanonymization model.

[0237] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, which will not be repeated here.

[0238] Optionally, in another embodiment of this application, one implementation of the malicious attack tracing device further includes:

[0239] The second extraction unit is used to extract the inverse frequency features of word frequencies from the training samples.

[0240] The second input unit is used for:

[0241] The inverse frequency features of word frequencies are input into a deep learning network model, which then obtains the predicted user information.

[0242] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, which will not be repeated here.

[0243] Optionally, the deep learning network model is constructed using fully connected layers with leak-corrected linear units as activation functions, batch normalization layers, and a softmax function; or, the deep learning network model is constructed using fully connected layers with leak-corrected linear units as activation functions, batch normalization layers, and a random forest algorithm; the deep learning network model is trained using an adaptive moment estimation optimizer.

[0244] As can be seen from the above scheme, this application provides a malicious attack tracing device. The first input unit 1602 inputs the source code information obtained by the first acquisition unit 1601 into a deanonymization model, which then obtains a set of suspicious users. The set of suspicious users includes at least one suspicious user. The deanonymization model is trained on a deep learning network model using training samples of multiple source code information and the corresponding real user information. Then, the first crawling unit 1603 crawls the user information of each suspicious user, as well as the repository information and content of the code repository held by the suspicious user. The code repository held by the suspicious user stores the source code of the projects in which the suspicious user participated. Finally, the processing unit 1604 processes the user information, the repository information, and the content of the code repository held by each suspicious user to obtain a profile of each suspicious user. This achieves the purpose of accurately tracing the source of malicious attacks.

[0245] Another embodiment of this application provides a server, such as Figure 17 As shown, it includes:

[0246] One or more processors 1701.

[0247] Storage device 1702, on which one or more programs are stored.

[0248] When the one or more programs are executed by the one or more processors 1701, the one or more processors 1701 perform the method as described in any of the above embodiments.

[0249] Another embodiment of this application provides a computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in any of the above embodiments.

[0250] In the embodiments disclosed in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus and method embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0251] Furthermore, the functional modules in the various embodiments of this disclosure can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part. If the functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a live streaming device, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this disclosure. The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0252] Those skilled in the art will be able to implement or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for tracing the source of a malicious attack, characterized in that, include: Obtain the source code information that leads to malicious attacks; The source code information is input into the deanonymization model, and the deanonymization model obtains a set of suspicious users; wherein, the set of suspicious users includes at least one suspicious user; the deanonymization model is obtained by training a deep learning network model with training samples of multiple source code information and real user information corresponding to the training samples of the source code information. The user information of each suspicious user, as well as the repository information and code repository content of the code repository held by the suspicious user, are crawled separately; wherein, the code repository held by the suspicious user stores the source code of the project in which the suspicious user participated; From the user information, code repository information, and code repository content of each suspicious user, data for each suspicious user under the profile description dimension is filtered out; wherein, there are multiple profile description dimensions, and the data under each profile description dimension describes the suspicious user in one aspect; For each suspicious user, the filtered data of the suspicious user under the profile description dimension is mapped to the corresponding profile description dimension to obtain the profile of each suspicious user.

2. The tracing method according to claim 1, characterized in that, The acquisition of source code information that constitutes a malicious attack includes: Obtain the binary file that forms the malicious attack; Parse the binary file to obtain pseudocode information; Obtain the source code information corresponding to the pseudocode information.

3. The tracing method according to claim 1, characterized in that, Before inputting the source code information into the deanonymization model and obtaining the set of suspicious users from the deanonymization model, the process further includes: Extract the inverse frequency features of the terms from the source code information; The step of inputting the source code information into the deanonymization model and obtaining a set of suspicious users from the deanonymization model includes: The inverse frequency features of the word frequency are input into the deanonymization model, and the set of suspicious users is obtained by the deanonymization model.

4. The tracing method according to claim 1, characterized in that, The step of crawling the user information of each suspicious user, as well as the repository information and content of the code repository held by the suspicious user, includes: Using a user information crawler, the personal information of each suspicious user, the organizational information of the organization the suspicious user participates in, and the member information within the organization are crawled; and the personal information of each suspicious user, the organizational information of the organization the suspicious user participates in, and the member information within the organization are saved in a file of a predetermined format to obtain the user information of each suspicious user; Using a repository information crawler, basic information and repository commit information of each code repository held by the suspected user are crawled; the basic information of each code repository held by the suspected user is saved as a first file in a predetermined format, and the repository commit information is saved as a second file in a predetermined format; wherein, the first file and the second file are the repository information of the code repository held by the suspected user; the repository commit information of the code repository held by the suspected user is the description information of the source code information of the user-submitted project; Using a repository download crawler, the code repository content of each code repository held by the suspected user is crawled, and the crawled code repository content of each code repository held by the suspected user is classified according to programming language.

5. The tracing method according to any one of claims 1 to 4, characterized in that, The training method for the deanonymization model includes: Construct a training sample set; wherein the training sample set includes multiple training samples and real user information corresponding to each training sample; the training samples are source code information; The training samples are input into a deep learning network model, and the deep learning network model obtains predicted user information. The cross-entropy between the predicted user information and the real user information is used as the loss function. Determine whether the loss function satisfies the preset convergence condition; If it is determined that the loss function does not meet the preset convergence condition, the parameters in the deep learning network model are adjusted until the loss function of the adjusted deep learning network model meets the preset convergence condition, and the adjusted deep learning network model is used as the deanonymization model.

6. The tracing method according to claim 5, characterized in that, The construction of the training sample set includes: The system crawls user information for each user accessing the network interface; wherein, the user information includes information about the user's followers and information about the people the user follows. Construct a user recursion tree corresponding to the user based on the information of the user's followers and the information of the people the user follows; The repository information of the code repositories held by each user in the user recursion tree is crawled respectively; wherein, the repository information of the code repository includes: the basic information of the code repository held by the user, the repository commit information, and the download address of the repository content; the project commit information of the code repository held by the user is the description information of the source code information of the project submitted by the user; Download the repository content of the user-held code repository in the user recursion tree from the download address of the repository content; wherein, the downloaded repository content of the user-held code repository in the user recursion tree is used as the training sample.

7. The tracing method according to claim 5, characterized in that, Before inputting the training samples into the deep learning network model and obtaining the predicted user information from the deep learning network model, the method further includes: Extract the inverse frequency features of the word frequency from the training samples; The training samples are input into a deep learning network model, and the predicted user information is obtained from the deep learning network model, including: The inverse frequency features of the word frequency are input into a deep learning network model, and the predicted user information is obtained by the deep learning network model.

8. The traceability method according to claim 5, characterized in that, The deep learning network model is constructed using a fully connected layer with leak-corrected linear units as activation functions, a batch normalization layer, and a softmax function; or, the deep learning network model is constructed using a fully connected layer with leak-corrected linear units as activation functions, a batch normalization layer, and a random forest algorithm. The deep learning network model is trained using an adaptive moment estimation optimizer.

9. A device for tracing the source of a malicious attack, characterized in that, include: The first acquisition unit is used to acquire source code information that forms the malicious attack; The first input unit is used to input the source code information into the deanonymization model, and the deanonymization model obtains a set of suspicious users; wherein, the set of suspicious users includes at least one suspicious user; the deanonymization model is obtained by training a deep learning network with training samples of multiple source code information and real user information corresponding to the training samples of the source code information. The first crawling unit is used to crawl the user information of each of the suspicious users, as well as the repository information and code repository content of the code repository held by the suspicious user; wherein, the code repository held by the suspicious user stores the source code of the project in which the suspicious user participated; The processing unit is used to process the user information, the repository information of the code repository held by each of the suspected users, and the content of the code repository to obtain a profile of each of the suspected users; The processing unit includes: The filtering unit is used to filter out the data of each suspicious user under the profile description dimension from the user information, the code repository information and code repository content of each suspicious user; wherein, there are multiple profile description dimensions, and the data under each profile description dimension describes the suspicious user in one aspect; The mapping unit is used to map the filtered suspicious user data under the profile description dimension to the corresponding profile description dimension to obtain a profile for each suspicious user.

10. A server, characterized in that, include: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method as described in any one of claims 1 to 8.

11. A computer storage medium, characterized in that, It stores a computer program thereon, wherein the computer program, when executed by a processor, implements the method as described in any one of claims 1 to 8.

Images