A malicious code detection method based on memory forensics and graph neural network

Abstract

The application discloses a malicious code detection method based on memory forensics and a graph neural network, relates to the technical field of software security, and utilizes the combination of memory forensics and a graph neural network to reduce the dependence of the detection method on expert knowledge, improve the detection efficiency for armored malicious codes, and improve the generalization ability for unknown samples. The method comprises the following steps: obtaining a memory image of a target program; extracting functions in the target program and the calling relationship between the functions from the memory image; obtaining the semantic representation of each function in the memory image by using a natural language processing (NLP) method, and obtaining a semantic vector of each function; constructing a semantic embedded function call graph (FCG) of the target program by using the semantic vector of the function; analyzing the semantic embedded FCG by using a graph neural network (GNN) model to perform malicious code recognition, and obtaining a detection result.

Description

Technical Field

[0001] This invention relates to the field of software security technology, specifically to a malicious code detection method based on memory forensics and graph neural networks. Background Technology

[0002] Malicious code refers to a piece of code written with malicious intent. It includes various forms such as trapdoors, logic bombs, Trojan horses, worms, and viruses, and can cause serious harm to computer or network systems.

[0003] Malicious code is one of the major threats facing internet users today. It can cause various forms of damage to computers, leading to abnormal behaviors such as slower operation or even crashes, reduced disk space, and increased online activity. It can also be used to obtain internet users' personal information, such as banking information and passwords, seriously jeopardizing people's data and financial security. These malicious codes can be classified according to their propagation methods or behavioral characteristics, mainly including viruses, worms, Trojans, spyware, and ransomware. According to a recent report by AV-Test, a total of 1.312 billion malicious programs appeared on the internet by 2021, posing a serious threat to software security.

[0004] Malicious code detection is a method for identifying malicious programs, mainly divided into static detection and dynamic detection. Static detection refers to using static characteristics (such as byte sequences and strings) to detect suspicious programs without executing them. The main advantage of static methods is their speed and scalability in detecting malicious programs. However, if the target program employs advanced obfuscation techniques (such as encryption and packaging), static methods will be unable to distinguish between benign and malicious programs. Unlike static methods, dynamic methods rely on analyzing the runtime characteristics of the program and require the target program to be run first. Even if the program is well packaged or encrypted, malicious behavior will eventually be exposed at runtime. Therefore, dynamic methods can identify advanced malware that hides its malicious activities.

[0005] Given the limitations of signature-based and heuristic detection methods, researchers and cybersecurity companies have turned their attention to deep learning methods, especially convolutional neural networks, which have achieved remarkable results in image processing. Therefore, in malware detection, malicious programs are typically converted into images or matrices, and then trained using deep learning techniques to ultimately obtain a model with high detection accuracy.

[0006] There are many methods for converting malware into images and then performing deep learning. The two most common methods are as follows:

[0007] Method 1: Convert the target binary program into a grayscale image through static analysis. Each byte of a binary program ranges from 00 to 0xFF, corresponding to 0 to 255 in a grayscale image. By setting the length and width, the byte sequence of the program can be converted into a matrix. Each item in the matrix corresponds to a pixel in the grayscale image. Finally, deep learning algorithms are used to analyze the grayscale image to identify the corresponding malicious program.

[0008] Method 2: Convert the API sequence information called by the sample program during runtime into a matrix. Analyze the API sequence information called by the malicious program during system runtime using API hooking or program instrumentation techniques. Convert each API call information into a word vector, and abstract the list of API sequences obtained by each sample program during runtime into a matrix. Finally, analyze the matrix using deep learning algorithms to identify the corresponding malicious program.

[0009] Packing refers to adding an encryption process before the execution flow of the original code. Packed programs need to be decompressed before execution. Early on, technicians could directly determine whether a program was malicious by detecting whether it was packed or obfuscated. However, packing technology not only prevents malicious code analysis but also begins to be used for legitimate programs to protect their intellectual property. Therefore, judging packed files as malicious code is no longer a viable method; new technologies are needed to detect programs. The packing process includes:

[0010] 1) The code segment, data segment, and resource segment of the original code are encrypted and compressed by the packer, and these byte segments are used as the data segment of the new program.

[0011] 2) Add a new PE head in front of the shell part.

[0012] 3) Save the key used for decryption in the new program. For example... Figure 1 As shown.

[0013] The packed file includes: a new PE header, the packed section, and a decompression stub—used for decompressing the code. During the packing process, the original entry point and packed section are redirected. The new program is executable like a normal program, but its behavior, as can be seen from disassembly, is that the program has only one function: decompressing the packed section and then executing it. This process makes it very difficult to identify the Import Address Table (IAT) and the original entry point. The import table mainly contains decryption functions, such as Base64 encoding and hash algorithm functions. These functions mainly decrypt the packed section of the file, recovering the original program's PE header and different sections, and then executing the original program. The results of disassembling or extracting features from the packed program are not significantly different because the extracted features are all shell features. Therefore, this mechanism can effectively evade static detection and feature extraction.

[0014] When a program is packed, it essentially executes two programs: first, it runs a decompression program to extract the compressed data, and then it executes the original program's actual functionality. For malicious code, this method prevents security experts from analyzing its execution flow through debugging to extract signatures. For legitimate programs, previous crackers could reverse engineer the program by debugging to create pirated versions or by cracking the registration code authentication process, thus developing tools like registration code generators. In short, packing prevents reverse engineering by malicious actors; therefore, judging a program's maliciousness solely by its packing has a high false positive rate.

[0015] Currently, there are few technologies for detecting packed malware, and most methods rely on manual analysis by professionals. However, manual analysis methods are labor-intensive, inefficient, and struggle to cope with today's complex internet environment.

[0016] Many dynamically acquired malware signatures can be interfered with by malware, such as malware API information obtained using sandboxes. However, this API information may be deliberately misrepresented by malware, so analyzing this information may affect the detection results.

[0017] Machine learning and deep learning methods often learn overly simplistic features, focusing only on one aspect of malicious program behavior, resulting in a lack of logical coherence between features. Existing network models primarily use algorithms like LSTM and CNN to model malicious files. These semantically or spatially structure-based models have weak generalization capabilities for unknown programs.

[0018] Therefore, there is still a difficulty in detecting packed malicious programs. How to improve the detection efficiency of packed malicious code and enhance the generalization ability of unknown samples are urgent problems to be solved. Summary of the Invention

[0019] In view of this, the present invention provides a malicious code detection method based on memory forensics and graph neural networks. The present invention utilizes a combination of memory forensics and graph neural networks to reduce the detection method's reliance on expert knowledge, while improving the detection efficiency against packed malicious code and the generalization ability for unknown samples.

[0020] To achieve the above objectives, this invention provides a malicious code detection method based on memory forensics and graph neural networks, comprising the following steps:

[0021] Step 1: Obtain the memory image of the target program.

[0022] Step 2: Extract the functions and their call relationships from the memory image of the target program.

[0023] Step 3: Use Natural Language Processing (NLP) methods to obtain the semantic representation of each function in the memory image, and obtain the semantic vector of each function.

[0024] Step 4: Construct a semantic embedding function call graph (FCG) of the target program using the semantic vectors of the functions. Use a graph neural network (GNN) model to analyze the semantic embedding FCG to identify malicious code and obtain detection results.

[0025] Further, in step one, the memory image of the target program is obtained, specifically by using the Procdump tool to extract the memory image of the target program, obtaining the memory dump file of the target program, and then analyzing the program code in it. The extracted memory dump file contains the entire virtual memory address space of the target program.

[0026] Further, in step two, the program assembly instruction sequence and the program's control flow graph (CFG) are extracted from the memory image. Specifically, after obtaining the memory image of the target program, the SMDA tool is used to extract the program assembly instruction sequence from the memory image and restore the program's control flow graph. Specifically, the SMDA tool uses a recursive disassembly algorithm and heuristic rules to identify functions in memory and the calling relationships between functions; the SMDA tool assigns a confidence value to each identified function and filters out functions with confidence values ​​lower than a set threshold.

[0027] Further, step three: Utilizing Natural Language Processing (NLP) methods to obtain the semantic representation of each function in the memory image, specifically, obtaining the semantic vector for each function involves: for each identified function in the memory image, it contains a series of assembly instructions; the assembly instructions for the function are then normalized. After normalizing the assembly instructions, the Doc2vec model is used to convert the function into a semantic vector.

[0028] Furthermore, the assembly instructions for functions are standardized as follows: an assembly instruction consists of two parts: an opcode and one or more operands; regular expressions are used to batch replace memory addresses appearing in operands; an operand threshold is set, operands below the threshold are considered small operands, otherwise they are considered large operands, only small operands are retained and large operands are replaced with uniform identifiers.

[0029] Further, step four: Construct a semantically embedded function call graph (FCG) of the target program using the semantic vectors of the functions, and analyze the semantically embedded FCG using a graph neural network (GNN) model to identify malicious code and obtain detection results, specifically:

[0030] The function call graph (FCG) is defined as a directed graph G = (V, E), where V is the set of nodes and E is the set of edges; for each node v i For each ∈V, there is an eigenvector x. i The semantic vector represents the function; for each edge e ij For each node ∈E, there is a path from node v. i to node v j The directed edges are used to represent the function v i Call function v j .

[0031] We use a simplified GraphSAGE model of GNNs to obtain structural information about the interactions between different functions.

[0032] Beneficial effects:

[0033] 1. This invention provides a malware detection method based on memory forensics and graph neural networks. Building upon existing malware detection methods, it improves detection accuracy by using dynamic analysis and memory forensics techniques to extract memory images, thus distinguishing between packed and normal programs, as well as unpacked and normal programs. Combining semantic and structural information from the memory images enhances malware detection capabilities. The graph neural network model aggregates function call graphs containing feature embeddings, improving the invention's semantic awareness and generalization capabilities for unknown programs.

[0034] 2. This invention improves the accuracy of malicious code detection by constructing a function call graph, combining the disassembled program assembly instruction sequence of the memory image with the structural information between functions, and analyzing it.

[0035] 3. This invention represents the functions composed of assembly instruction sequences in the function call graph using vectors embedded by Doc2vec. This method allows functions with the same semantics to have similar vector representations. At the same time, the directed edges of the graph are represented by the function call relationship, which effectively ensures the logical relationship between features.

[0036] 4. The graph classification model built on GraphSAGE in this invention can extend the graph neural network into a network with inductive learning ability by training a function that aggregates the neighbors of nodes, and has a strong generalization ability for unknown nodes. Attached Figure Description

[0037] Figure 1 Flowchart of program packing and unpacking;

[0038] Figure 2 Framework diagram of a malware detection method based on memory forensics and graph neural networks;

[0039] Figure 3 PV-DM and PV-DBOW methods;

[0040] Figure 4 Function call graph. Detailed Implementation

[0041] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0042] This invention provides a malicious code detection method based on memory forensics and graph neural networks.

[0043] Figure 2 The overall framework of this detection method is shown. (For example...) Figure 2 As shown, a malicious code detection method based on memory forensics and graph neural networks is mainly divided into four stages: memory forensics, feature extraction, feature vectorization, and malicious code detection.

[0044] The memory forensics phase mainly involves obtaining a memory image of the target program, which contains the program's runtime code and data in memory.

[0045] The feature extraction stage mainly involves extracting the program assembly instruction sequence and the program's control flow graph (CFG) from the memory image.

[0046] The feature vectorization stage mainly utilizes natural language processing (NLP) methods to obtain the semantic representation of each function, thereby enabling similar functions to generate similar vectors.

[0047] The malicious code detection phase mainly involves constructing the function call graph (FCG) of the program and using a graph neural network (GNN) model to analyze the semantically embedded FCG for malicious code identification.

[0048] The specific procedures for each stage are as follows:

[0049] Memory forensics stage

[0050] The function code of a program is exposed in memory during runtime. Therefore, this invention uses the Procdump tool to extract the program's memory image, obtain a memory dump file of the target program, and then analyze the program code within it. The extracted memory dump file contains the entire virtual memory address space of the target program, which includes runtime code and data.

[0051] ProcDump is a command-line based memory forensics program. Its main purpose is to monitor CPU crashes in applications and generate memory dumps during crashes, as well as obtain the memory image of the corresponding process by process ID. This avoids the tedious process of first extracting the memory image of the entire system and then extracting the image of the specific process.

[0052] Feature extraction stage

[0053] After obtaining the memory image of the target process, the SMDA tool is used to extract the program assembly instruction sequence from the memory image and reconstruct the program's control flow graph. Each function consists of a series of assembly instructions.

[0054] Specifically, the SMDA tool uses a recursive disassembly algorithm and heuristic rules to identify functions in memory and the call relationships between them. Because program code and data may be mixed in the same memory region, the SMDA tool cannot guarantee that all identified function results are correct. Therefore, the tool assigns a confidence value to each identified function, which is used to filter out functions with low confidence values. For example, if a function contains unknown instructions, its confidence value will be very low. In this invention, the confidence value is set to 0.5 for function identification.

[0055] SMDA is a lightweight, recursive, open-source disassembler (downloadable at https: / / github.com / danielplohmann / smda) that recovers the control flow graph of a program from a memory dump. Built on the Capstone open-source library, it's a memory dump analyzer that currently supports x86 and x64 instruction sets and can analyze arbitrary memory dumps. The tool outputs a set of functions, basic blocks, and instructions, and can infer the call relationships between functions.

[0056] Feature vectorization stage

[0057] For each identified function in the memory image, it contains a series of assembly instructions. For ease of calculation, this invention does not consider the control flow inside the function. An instruction consists of two parts: an opcode and one (or more) operands. The opcode type is finite, while the operands have various possible values. To preserve the key information of the operands, this invention proposes a simple method to normalize instruction operands, namely, applying regular expressions to batch replace memory addresses (e.g., function addresses and jump addresses) appearing in the operands. Because small operands usually appear in relative addressing and indexed addressing, while large operands often appear in arithmetic operations, this invention only retains small operands and replaces large operands with uniform identifiers. This invention distinguishes between large and small operands by setting an operand threshold, for example, an operand threshold of 255; operands greater than the threshold are large operands, and operands less than the threshold are small operands.

[0058] After normalizing the original instructions, a semantic vector extraction method is selected from NLP methods. In this embodiment, the Doc2vec model is used to convert functions (a function containing several assembly instructions) into semantic vectors. This model can learn fixed-length feature representations from variable-length instructions. It can handle cases where different functions contain different types and numbers of instructions well. There are two different methods (PV-DM and PV-DBOW) to train the Doc2vec model. PV-DM uses a fixed context window to generate function vectors to predict the next instruction in the code. PV-DBOW randomly samples instructions for prediction, thereby learning function vectors. Figure 3 The training methods of this invention, namely PV-DM and PV-DBOW, are demonstrated, which can enable similar functions to produce similar vectors.

[0059] Malicious code detection phase

[0060] The Doc2vec model can encode program functions into meaningful vectors. To model function calls, this invention defines the function call graph as a directed graph G = (V, E), where V is the set of nodes and E is the set of edges. For each node v... i For each ∈V, there is an eigenvector x. i This represents the semantic vector of the function. For each edge e ij For each node ∈E, there is a path from node v. i to node v j The directed edges are used to represent the function v i Call function v j Figure 4 illustrates in detail the function call graph constructed by this invention. By integrating the semantic information in the function call graph, it is possible to more accurately determine whether malicious behavior exists in the program.

[0061] Figure 4 The diagram shows a function call graph, where each node represents a function and the edges represent the call relationships between functions.

[0062] Graph Neural Networks (GNNs) are a class of deep learning-based methods for processing information in graph domains. Due to their superior performance and interpretability, GNNs are gaining popularity across various fields, including social networks, recommender systems, transportation, and life sciences. A graph is a non-Euclidean data structure that uses nodes (vertices) and edges connecting them to represent information.

[0063] One motivation for Graph Neural Networks (GNNs) comes from graph embeddings; they learn how to represent graph nodes, edges, or subgraphs using low-dimensional vectors. In machine learning, features are often manually designed and filled into feature vectors using these manually defined features. Typically, specific bits are used to represent features, with the number in that bit indicating the quantity or presence of the feature. This greatly limits the range of representation and cannot guarantee that manually extracted features will cover all features.

[0064] The core function of graph neural networks is to perform convolution operations on the node embedding information in the spatial domain of the graph. That is, the neural network aggregates the embedding information of a node's neighbors and transmits and receives information about its neighbors among nodes. Consider a target node with initial embeddings: it receives information from the edge neural networks of its neighbors, aggregates this edge data (e.g., max pooling, average pooling, etc.), and then passes it to the node's activation units to obtain a new set of embedding vectors for that node.

[0065] Mainstream GNN algorithms include Graph Convolutional Neural Networks (GCNs), Graph Autoencoders, Graph Generating Networks, Graph Recurrent Networks, and Graph Attention Networks. GCN computation can be divided into frequency domain-based and spatial domain-based approaches. This section primarily introduces a classic spatial domain-based algorithm, GraphSAGE, which improves upon traditional GCNs in two ways. First, during training, it optimizes GCN's full-graph sampling to partial neighbor sampling centered on nodes. This enables distributed training on large-scale graph data and allows the network to learn from unseen nodes, allowing GraphSAGE to perform inductive learning. Second, GraphSAGE investigates several neighbor aggregation methods and compares the advantages and disadvantages of different aggregation methods through experiments and theoretical analysis.

[0066] This invention uses Graph Neural Networks (GNNs) to analyze the complex interactions between different functions in malware. Generally, GNNs transform graph nodes from a sparse, high-dimensional embedding space to a dense, low-dimensional embedding space. Therefore, this invention uses the node embedding vectors initially generated by the Doc2vec model as initial feature vectors and utilizes a simplified GNN model, namely the GraphSAGE model, to obtain structural information about the interactions between different functions. Further encoding of the graph nodes is achieved by applying multiple layers of GraphSAGE to iteratively generate node embedding vectors. GraphSAGE involves two steps: the first step is to randomly sample a fixed-size subset of the node's neighbors; the second step is to aggregate the feature information of the sampled nodes into a single vector for the target node.

[0067] Specifically, in the k-th layer of GraphSAGE, node v i The formula for aggregating information is as follows:

[0068]

[0069] in Represents node v i Hidden embedding at layer k, N(v) i ) represents node v i The sampling neighborhood, |N(v i )| represents N(v i The size of the self-transfer function (f). self ) and message passing function (f msg ) is used to accumulate information from the node itself and its neighboring nodes in the (k-1)th layer. σ represents the ReLU activation function. For simplicity, this invention uses a neural network to implement self-propagation and message passing functions. Therefore, node embedding can be further represented as:

[0070]

[0071] in and This represents the transformation matrices, which are the different neural network parameters learned in the (k-1)th layer. An index of 1 indicates the first transformation matrix, and an index of 2 indicates the second transformation matrix. After iterating through k GraphSAGE layers, we obtain... v i The node embeddings ∈G. Next, in order to obtain the graph-level embedding vector z representing the memory mirror. m This invention utilizes a max-pooling function on all node embeddings, as shown in Equation (3). Specifically, the number of GraphSAGE layers (i.e., k) is set to 2, and the number of sampling node neighbors in each layer is set to 20.

[0072]

[0073] After obtaining the graph-level embedding vector z m Subsequently, two multilayer perceptron neural networks (MLPs) are applied to calculate the probability assigned to a malicious label. In this way, the embedding vector is projected onto a scalar. To ensure that the expected malicious probability is within the range [0,1], this invention uses the sigmoid function to calculate the probability as follows:

[0074] p m =sigmoid(MLP) θ2 (MLP θ1 (z m (4)

[0075] Where p m MLP represents the predicted probability. θ1 and MLP θ2 This indicates the MLP layer to be trained (there are two MLP layers: θ1 is the first layer of the neural network, and θ2 is the second layer of the neural network).

[0076] To predict the final label y of a given memory image m This invention predicts the probability p of malicious code. m The value is compared to a predefined threshold ζ. If the probability value is high, it indicates that the memory image contains malicious code. Otherwise, it indicates that the memory image is normal. The label prediction process is as follows:

[0077]

[0078] Among them, y m This is the detection result output by the method of the present invention.

[0079] During training, this invention applies the following binary cross-entropy loss function:

[0080]

[0081] Where L is the loss function, It is the actual label of the memory image, p m This is the probability of malicious memory mirroring calculated using this invention.

[0082] This invention utilizes a dynamic detection method to run sample programs in a virtual machine, avoiding interference caused by malicious programs' packing, deformation, and polymorphism. Compared to the problem of grayscale image segmentation leading to the destruction of feature continuity, this invention solves this problem by extracting the program's memory image, and the extracted features possess more semantic information and structural characteristics.

[0083] This invention focuses on the control flow information of the sample program, rather than the API information called during program runtime, thus avoiding the interception of program API function calls. In the process of constructing graph features, semantic features within functions and structural features between functions are combined, resulting in a more comprehensive feature set of the constructed function call graph, enhancing the model's semantic awareness and generalization ability.

[0084] In summary, the above are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A malicious code detection method based on memory forensics and graph neural networks, characterized in that, Includes the following steps: Step 1: Obtain the memory image of the target program; Step 2: Extract the functions and their call relationships from the target program from the memory image, specifically: After obtaining the memory image of the target program, the SMDA tool is used to extract the program assembly instruction sequence from the memory image and restore the program's control flow graph. Specifically, the SMDA tool uses a recursive disassembly algorithm and heuristic rules to identify functions in memory and the calling relationships between functions; the SMDA tool assigns a confidence value to each identified function and filters out functions with confidence values ​​lower than a set threshold. Step 3: Use Natural Language Processing (NLP) methods to obtain the semantic representation of each function in the memory image, specifically obtaining the semantic vector of each function as follows: For each identified function in the memory image, it contains a series of assembly instructions; the assembly instructions for the function are normalized; the normalization of the assembly instructions for the function specifically includes: an assembly instruction includes two parts: an opcode and one or more operands; regular expressions are applied to batch replace memory addresses appearing in operands; an operand threshold is set, operands below the operand threshold are small operands, otherwise they are large operands, only small operands are retained and large operands are replaced with a uniform identifier; After normalizing the assembly instructions, the Doc2vec model is used to convert the functions into semantic vectors; Step 4: Construct a semantically embedded function call graph (FCG) of the target program using the semantic vectors of the functions. Analyze the semantically embedded FCG using a graph neural network (GNN) model to identify malicious code and obtain detection results. Specifically: Function call graph (FCG) is defined as a directed graph. ,in It is a set of nodes. It is an edge set; for each node Each has a feature vector The semantic vector representing the function; for each edge There is a path from the node. To the node The directed edges are used to represent the function Calling functions ; By using the GNN model, a simplified GraphSAGE model, we can obtain structural information about the interactions between different functions, thereby enabling the identification of malicious code in memory images.

2. The malicious code detection method based on memory forensics and graph neural networks as described in claim 1, characterized in that, In step one, obtaining the memory image of the target program specifically involves: The Procdump tool is used to extract the memory image of the target program, obtain the memory dump file of the target program, and then analyze the program code in it. The extracted memory dump file contains the entire virtual memory address space of the target program.

Images