Method for Determining Malware Attribution Attack Organization Based on Time Series

Abstract

This invention discloses a method for determining malware attribution to an attacking organization based on time series. The main steps are: 1) malware function information extraction; 2) malware function screening, removing library functions and functions that do not contain API calls; 3) malware path generation, based on API calls and betweenness centrality; 4) malware feature vectorization, using ACFG features to vectorize basic blocks; 5) malware critical path segment generation, using a time series algorithm to extract critical path segments from the path; and 6) malware attribution to an attacking organization, using a classifier to determine malware attribution to an attacking organization. This method achieves high accuracy in malware attribution to an attacking organization.

Description

Technical Field

[0001] The present invention relates to a method for determining whether malware belongs to an attacking organization in the technical field of network security, and in particular to a method for determining whether malware belongs to an attacking organization based on a time series. Background Art

[0002] Attacker organizations often construct malware to carry out cyberattacks. APT (advanced persistent threat) attacks are a type of cyberattack. APT attacks are stealthy and persistent computer intrusions, often orchestrated by individuals and targeting specific targets. These attacks are often motivated by commercial or political reasons, targeting specific organizations or countries, and require a high level of concealment for extended periods. Cyberattacks pose a serious threat to cybersecurity. Therefore, analyzing cyberattacks and studying attacking organizations is essential.

[0003] Current malware analysis methods typically rely on control flow graphs (CFGs) and API calls. Characterization methods for control flow graphs and API calls generally include sequence features, code structure features, and distribution features. Sequence features refer to API call sequences and basic block sequences in CFGs. Code structure features represent the logical structure that expresses program semantics and typically rely on graph technology. Distribution features extract semantic information based on the contextual distribution of features and typically rely on natural language processing methods.

[0004] Existing interpretable malware methods for identifying attack groups typically extract features based on functions, such as code structure and distribution. Each function is a control flow graph (CFG). Different platforms and compilers can cause variations in CFG structure, posing a challenge to extracting function features. Furthermore, generating path / basic block sequences within a CFG is an NP-hard problem, posing a challenge to extracting basic block sequence features.

[0005] In view of the above-mentioned defects in the existing technology, the inventor has finally created the present invention which is of practical value after continuous research, design, repeated trials and improvements. Summary of the Invention

[0006] The main purpose of the present invention is to overcome the defects of existing function features for attributing malware to attack organizations and to provide a new method for determining malware attribution to attack organizations based on time series. The technical problem to be solved is to adopt a basic block sequence determination method to make its determination effect better, provide more specific interpretability, and be very suitable for practical use.

[0007] Another object of the present invention is to provide a new method for determining the malware's attribution to an attacking organization based on time series. The technical problem to be solved is to adopt a function filtering method to filter out a large number of useless functions, thereby improving the determination efficiency and making it more suitable for practical use.

[0008] Another object of the present invention is to provide a new method for determining the malware belonging to an attacking organization based on time series. The technical problem to be solved is a path generation method that avoids NP-hard problems and generates a focused path, thereby being more suitable for practical use.

[0009] The purpose of the present invention and the technical problem to be solved are achieved by adopting the following technical solutions. According to the method of determining the malware belonging to the attacking organization based on time series proposed by the present invention, it includes the following steps: system initialization and system operation; wherein the system initialization step is as follows

[0010] Step 1: Malware function information extraction

[0011] Use disassembly tools to extract the malware's function information, which refers to the function's control flow graph (CFG).

[0012] Step 2: Malware Function Filtering

[0013] Remove library functions, keep custom functions, remove functions that do not contain API (application programming interface) calls, and keep functions that have at least one function call;

[0014] Step 3: Malware Path Generation

[0015] The malware path generation starts with the basic block with API calls, and then generates paths based on the betweenness centrality in graph theory.

[0016] Step 4: Malware Feature Vectorization

[0017] The feature vectorization of the basic block is done using ACFG (attributed CFG) features, and the feature dimension is reduced using principal component analysis (PCA).

[0018] Step 5: Malware critical path fragment generation

[0019] Use the time series algorithm Shapelets to extract key path segments from the path;

[0020] The time series Shapelets algorithm is applied to the path vector to generate critical path segments. The critical path segments can represent the sub-paths of the path. In order to reduce the resource consumption of the Shapelets algorithm, clustering is first used to reduce the input of the algorithm. The path vectors are clustered using the HDBSCAN clustering algorithm. The path vector at the center of each cluster in the clustering result is used to generate critical path segments. Finally, h critical path segments ps = [ps1, ps2, …, psh] are generated.

[0021] Step 6: Malware Attribution

[0022] The minimum distance between each path of the malware and each key path segment is calculated and used as the input of the random forest classifier to determine the malware's attribution to the attacking organization.

[0023] Furthermore, the CFG information of the malware function is extracted using a disassembly tool, specifically including the instruction information of the basic block and the jump relationship of the basic block.

[0024] Furthermore, the removing of library functions and retaining of custom functions specifically includes counting the number of API calls within the functions and removing functions with a number of API calls of 0.

[0025] Furthermore, in step 3, the malware path generation is based on the basic block with the API call as the starting point, and the forward and backward paths are generated according to the larger central betweenness score;

[0026] Suppose a function's CFG contains n basic blocks b1, b2, ..., bn. Generate m CFG paths p1, p2, ..., pm. Each path consists of a sequence of basic blocks, pi = [bi, bj, ..., bk], where pi is the i-th path and bi, bj, bk are the i-th, j-th, and k-th basic blocks, respectively.

[0027] Furthermore, the feature uses ACFG features to vectorize the basic blocks. Specifically, the ACFG feature counts different types of instructions in the basic blocks and generates a multi-dimensional feature vector for each basic block. The i-th basic block bi = [f1, f2, ..., fi];

[0028] Then PCA is used to reduce the dimension of the ACFG features to obtain a 1-dimensional vector; the i-th basic block bi = [xi];

[0029] Finally, based on the path generated in the previous step, generate the path vector, the i-th path pi = [bi,bj,...,bk], that is, pi = [xi,xj,...,xk];

[0030] Due to the inconsistency of path lengths, for the sake of subsequent tasks, the path length is limited to a fixed length. The fixed length refers to the length distribution of the path, and the path length is 1 to 300. If the path length is too long, a fixed length is intercepted from the starting basic block in the path. If the path length is insufficient, the path is padded with 0 to the fixed length.

[0031] Furthermore, the attack organization to which the malware belongs is predicted using a classification model. The input of the classification model is the minimum distance between each path of the malware and each key path fragment generated during the system initialization process. The classification model predicts the attack organization to which each path belongs. The malware belongs to the attack organization based on the average prediction probability of all paths of the software.

[0032] Furthermore, the classification model is trained using the minimum distance vector between the path and the critical path segment and the organizational label; the minimum distance between a path vector of malware and each critical path segment is used as a model input vector; the input vector Ii = [d1, d2, …, dh], where Ii is the minimum distance vector between the i-th path and the critical path segment, and di is the minimum distance between the path and the critical path segment psi.

[0033] Furthermore, the main steps of the system operation are as follows:

[0034] Step 1: Extract function information. The specific steps are the same as Step 1 of system initialization: Extract malware function information.

[0035] Step 2: Function screening. The specific steps are the same as Step 2 of system initialization: Malware function screening.

[0036] Step 3: Generate important paths. The specific steps are the same as Step 3 of system initialization: Generate malware paths.

[0037] Step 4: Feature vectorization. The specific steps are the same as Step 4 of system initialization: malware feature vectorization.

[0038] Step 5: Attack organization attribution. The specific steps are the same as Step 5 of system initialization: Malware attribution to the attack organization.

[0039] Compared with the prior art, the present invention has obvious advantages and beneficial effects. It has at least the following advantages:

[0040] 1. This invention is the first to apply the idea of time series to CFG path analysis. Due to the similarity between time series and CFG path, the time series method provides a basis for CFG path analysis.

[0041] 2. The present invention uses Shapelet to identify critical path segments for subsequent decision tasks. This segment makes the features more localized, while also reducing the impact of changes in the CFG path affected by the compiler and platform on the decision task. In addition, the time series method is interpretable.

[0042] 3. Existing technologies often use global function signatures. Due to the varying CFG structures of functions across different platforms and compilers, global signatures can be noisy. This invention uses local function signatures to reduce the noise in determining malware attribution to an attacking organization.

[0043] 4. Existing technologies often focus their explainability on functions. This invention uses path segments as features and provides explainability, locating explainability on path segments in functions, which is more specific.

[0044] 5. The present invention uses API calls to perform function screening because the behavior of malware usually requires API calls to be implemented. This filtering method can filter out many irrelevant functions.

[0045] 6. The present invention uses a path generation method to avoid the path generation problem in CFG.

[0046] 7. The present invention uses the Shapelets algorithm to extract key path segments, which makes the malicious features more localized and is beneficial to subsequent classification tasks.

[0047] 8. The accuracy of the present invention is about 5% higher than that of the prior art.

[0048] 9. The present invention locates the interpretability of existing technologies to the paths in the function.

[0049] The specific method of the present invention is given in detail by the following examples and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is the initialization flow chart of the present invention.

[0051] Figure 2 This is a systematic flow chart of the present invention DETAILED DESCRIPTION

[0052] To further illustrate the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, the following, in conjunction with the accompanying drawings and preferred embodiments, describes in detail the specific implementation methods, methods, steps, features and effects of the method for determining the time series-based malware attribution to an attacking organization proposed by the present invention.

[0053] See also Figure 1As shown, the method for determining malware belonging to an attacking organization based on time series in a preferred embodiment of the present invention mainly includes system initialization and system operation, wherein the system initialization includes the following steps:

[0054] Step 1: Malware function information extraction

[0055] Use a disassembly tool to extract the malware's function information, including basic block instruction information and basic block jump relationships. Function information refers to the function's control flow graph (CFG).

[0056] Step 2: Malware Function Filtering

[0057] Remove library functions and retain custom functions. Remove functions that do not contain API (application programming interface) calls, and retain functions that contain at least one function call. This includes counting the number of API calls within a function and removing functions with zero API calls.

[0058] Step 3: Malware Path Generation

[0059] The malware path generation starts with the basic block with API calls, and then generates paths based on the betweenness centrality in graph theory.

[0060] Specifically, CFG path generation

[0061] The path generation algorithm is shown in Algorithm 1. The algorithm starts with the basic block with API calls and generates paths forward and backward according to the larger central betweenness score.

[0062] Suppose a function's CFG contains n basic blocks b1, b2, ..., bn. Generate m CFG paths p1, p2, ..., pm. Each path consists of a sequence of basic blocks, pi = [bi, bj, ..., bk], where pi is the i-th path and bi, bj, bk are the i-th, j-th, and k-th basic blocks, respectively.

[0063]

[0064] Step 4: Malware Feature Vectorization

[0065] The basic blocks are vectorized using ACFG (attributed CFG) features. Principal component analysis (PCA) is used to reduce the dimensionality of the features.

[0066] Specifically, the ACFG feature counts different types of instructions within a basic block and generates a multi-dimensional feature vector for each basic block. For the i-th basic block, bi = [f1, f2, ..., fi]. In this embodiment, an 18-dimensional feature vector is generated for each basic block. A description of the ACFG feature is shown in Table 1. For the i-th basic block, bi = [f1, f2, ..., f18].

[0067] Table 1·Basic Block Features.

[0068]

[0069] Then, PCA is used to reduce the dimensionality of the ACFG features to a 1-dimensional vector. The i-th basic block bi = [xi]. Finally, based on the paths generated in the previous step, a path vector is generated. The i-th path pi = [bi, bj, ..., bk], i.e., pi = [xi, xj, ..., xk].

[0070] Due to inconsistent path lengths, for subsequent tasks, the path length is limited to a fixed length. The fixed length refers to the length distribution of the path, and it is recommended to choose 1 to 300. If the path length is too long, the fixed length is intercepted from the starting basic block in the path. If the path length is insufficient, the path is padded with 0 to the fixed length.

[0071] Specific embodiment: limit the path length to 140 basic blocks. If the path length is too long, cut off the first 140 basic blocks. If the path length is less than 140, fill the path with zeros to the fixed length.

[0072] Step 5: Malware critical path fragment generation

[0073] Use the time series algorithm Shapelets to extract key path segments from the path;

[0074] The time-series Shapelets algorithm is applied to the path vectors to generate critical path segments. A critical path segment is a subpath that represents a path. To reduce the resource consumption of the Shapelets algorithm, clustering is first used to reduce the input. The path vectors are clustered using the HDBSCAN algorithm. The central path vector of each cluster in the clustering results is used to generate critical path segments. Ultimately, h critical path segments ps = [ps1, ps2, …, psh] are generated.

[0075] Step 6: Malware Attribution

[0076] The minimum distance between each path of the malware and each key path segment is calculated and used as the input of the random forest classifier to determine the malware's attribution to the attacking organization.

[0077] Specifically, a classification model is used. The input of the classification model is the minimum distance between each path of the malware and each key path fragment generated during the system initialization process. The classification model predicts the attack organization to which each path belongs. The malware belongs to the attack organization based on the average prediction probability of all the paths of the software.

[0078] The classification model is trained using the minimum distance vector between paths and critical path segments and the organizational label. The minimum distance between a malware path vector and each critical path segment is used as a model input vector. The input vector Ii = [d1, d2, …, dh], where Ii is the minimum distance vector between the i-th path and the critical path segment, and di is the minimum distance between the path and the critical path segment psi.

[0079] See Figure 2 The specific steps of system operation are as follows:

[0080] Step 1: Extract function information. The specific steps are the same as Step 1 of system initialization: Extract malware function information.

[0081] Step 2: Function screening. The specific steps are the same as Step 2 of system initialization: Malware function screening.

[0082] Step 3: Generate important paths. The specific steps are the same as Step 3 of system initialization: Generate malware paths.

[0083] Step 4: Feature vectorization. The specific steps are the same as Step 4 of system initialization: malware feature vectorization.

[0084] Step 5: Attack organization attribution. The specific steps are the same as Step 5 of system initialization: Malware attribution to the attack organization.

[0085] The proposed method for attributing malware to attacking organizations allows network security technicians to attribute suspicious malware to attacking organizations and obtain key characteristics of attacking organization attribution, providing an important basis for analyzing attack organizations and threat intelligence.

[0086] Although the specific embodiments and drawings of the present invention are disclosed for illustrative purposes and are intended to facilitate understanding and implementation of the present invention, those skilled in the art will appreciate that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the preferred embodiments and the drawings, and the scope of protection claimed by the present invention shall be determined by the scope defined in the claims.

Claims

1. A method for determining the malware's attribution to an attacking organization based on time series, its characteristics is : It includes the following steps: System initialization and system operation; the system initialization steps are as follows: Step 1: Extracting malware function information: Use assembly tools to extract the malware's function information, which refers to the function's control flow graph (CFG). Step 2: Malware function screening: Remove library functions, keep custom functions, remove functions that do not contain API (application programming interface) calls, and keep functions that have at least one function call; Step 3: Malware path generation: The malware path generation starts with the basic block with API calls, and then generates paths based on the betweenness centrality in graph theory. Step 4: Malware Feature Vectorization: The feature vectorization of the basic block is done using ACFG (attributed CFG) features, and the feature dimension is reduced using principal component analysis (PCA). Step 5: Malware’s critical path fragment generation: Use the time series algorithm Shapelets to extract key path segments from the path; The time series Shapelets algorithm is applied to the path vectors to generate critical path segments. Critical path segments can represent subpaths of the path. To reduce the resource consumption of the Shapelets algorithm, clustering is first used to reduce the input of the algorithm. The path vectors are clustered using the HDBSCAN clustering algorithm. The path vector with the most central path in each cluster is used to generate critical path segments. Ultimately, h critical path segments are generated: ps = [ps1, ps2, …, psh], where psh represents the hth segment. Step 6: Malware Attribution to the Attacker Group: The minimum distance between each path of the malware and each key path segment is calculated and used as the input of the random forest classifier to determine the malware's attribution to the attacking organization.

2. The method for determining the malware belonging to an attacking organization based on time series according to claim 1, characterized in that: The CFG contains the instruction information of the basic block and the jump relationship of the basic block.

3. The method for determining the malware belonging to an attacking organization based on time series according to claim 1, characterized in that: The removing of functions that do not include API calls specifically includes counting the number of API calls in the functions and removing functions with a number of API calls of 0.

4. The method for determining the malware belonging to an attacking organization based on time series according to claim 1, characterized in that: In step 3, the malware path generation starts from the basic block with API calls, and generates paths forward and backward based on the larger central betweenness score. Assume that the CFG of a function contains n basic blocks b1, b2, ..., bn, and generates m CFG paths p1, p2, ..., pm. Each path consists of multiple basic block sequences, pi=[bi, bj, ..., bk], where pi is the i-th path, bi, bj, bk are the i-th, j-th, k-th basic blocks respectively.

5. The method for determining the malware belonging to an attacking organization based on time series according to claim 1, characterized in that: The feature described uses ACFG features to vectorize basic blocks. Specifically, the ACFG feature counts different types of instructions in the basic block and generates a multi-dimensional feature vector for each basic block. The i-th basic block bi=[f1,f2,...,fi]; Then use PCA to reduce the dimension of ACFG features to obtain a 1-dimensional vector; the i-th basic block bi=[xi]; Finally, based on the path generated in the previous step, generate the path vector, the i-th path pi=[bi,bj,...,bk], that is, pi=[xi,xj,...,xk]; Due to the inconsistency of path lengths, for the sake of subsequent tasks, the path length is limited to a fixed length. The fixed length refers to the length distribution of the path, and the path length is 1 to 300. If the path length is too long, a fixed length is intercepted from the starting basic block in the path. If the path length is insufficient, the path is padded with 0 to the fixed length.

6. The method for determining the malware belonging to an attacking organization based on time series according to claim 1, characterized in that: The malware is attributed to an attack organization using a classification model for prediction. The input of the classification model is the minimum distance between each path of the malware and each key path fragment generated during the system initialization process. The classification model predicts the attack organization to which each path belongs. The malware is attributed to an attack organization based on the average prediction probability of all paths of the software.

7. The method for determining the malware belonging to an attacking organization based on time series according to claim 6, characterized in that: The classification model is trained using the minimum distance vector between paths and critical path segments and the organizational label. The minimum distance between a malware path vector and each critical path segment is used as a model input vector. The input vector Ii=[d1,d2,…,dh], where Ii is the minimum distance vector between the i-th path and the critical path segment, and di is the minimum distance between the path and the critical path segment psi.

8. The method for determining the malware belonging to an attacking organization based on time series according to claim 1, characterized in that: The main steps of the system operation are as follows: Step 1: Extract function information. The specific steps are the same as Step 1 of system initialization: Extract malware function information. Step 2: Function screening. The specific steps are the same as Step 2 of system initialization: Malware function screening. Step 3: Generate important paths. The specific steps are the same as Step 3 of system initialization: Generate malware paths. Step 4: Feature vectorization. The specific steps are the same as Step 4 of system initialization: malware feature vectorization. Step 5: Attack organization attribution. The specific steps are the same as Step 5 of system initialization: Malware attribution to the attack organization.

Images