Automatic malware detection method based on multiple features

Abstract

The present invention discloses a multi-feature-based automated malware detection method, comprising the following steps: step S1: preprocessing data; step S2: extracting features from the data to obtain a feature vector; step S3: effectively aligning and fusing the binary feature vector obtained in the above step S2 and the operation code feature vector generated by the triangular attention mechanism to generate a final fusion vector; step S4: detecting and classifying malware; the present invention can more effectively detect malware variants with a higher accuracy. In an actual production environment, the present invention enhances the performance of automatic malware analysis tools by increasing the recognition efficiency of malware variants, thereby reducing labor costs.

Description

Technical Field

[0001] The present invention belongs to the field of software, and in particular relates to a multi-feature based automated malware detection method. Background Art

[0002] The internet is increasingly permeating every aspect of human life and work, and the proliferation of innovative internet applications is profoundly transforming social life in the information age. The global outbreak of COVID-19 has led to a gradual shift in work practices across various sectors to online. The surge in online work has also created opportunities for malware developers, who have developed a variety of malware, including malvertising, ransomware, and cryptocurrency mining viruses. According to data from Kaspersky Security Network (KSN) from November 2019 to October 2021, 15.45% of internet users worldwide experienced at least one malware attack on their computers in that year alone, with ransomware and cryptocurrency mining viruses being particularly prevalent. These malware programs collect private information on targeted networks, abuse server resources, and even infect hosts across the internet through botnet applications. These activities pose a significant threat to personal and industry security, making timely detection and response to emerging malware essential for ensuring online workplace security.

[0003] Malware detection methods are mainly divided into static detection and dynamic detection. Static detection methods generally use static analysis tools such as decompilation to extract malware features such as binary sequences, assembly code, and opcode sequences to determine whether the code is malicious. This method generates a signature from the extracted key features, and rule-based matching methods are generally used during detection. Dynamic detection is generally divided into dynamic monitoring and dynamic analysis. Dynamic monitoring refers to observing the software's behavior by running the target software virtually and using methods such as just-in-time debugging. Dynamic analysis refers to running the target software in an environment such as a sandbox to obtain relevant API call sequences, system resource usage, and other information for further analysis. Summary of the Invention

[0004] In response to the deficiencies or improvement needs of the existing technology, the present invention proposes an automatic malware detection method based on multiple features.

[0005] The specific technical solutions are as follows:

[0006] The automated malware detection method based on multiple features includes the following steps:

[0007] Step S1: preprocessing data;

[0008] Step S2: extract features from the data to obtain feature vectors;

[0009] Step S3: effectively align and fuse the binary feature vector obtained in step S2 above and the opcode feature vector generated by the triangular attention mechanism to generate the final fused vector;

[0010] Step S4: Responsible for malware detection and classification.

[0011] Preferably, step S1 includes the following sub-steps:

[0012] Sub-step S11: After obtaining the original malware file, use the IDApro tool to statically decompile the file to obtain the binary file and assembly file of the malware;

[0013] Sub-step S12: Obtain the frequency of key operation codes from the assembly file.

[0014] Preferably, sub-step S12 includes the following sub-steps:

[0015] Sub-step S121: Divide each program into multiple sub-program blocks, and calculate the frequency of occurrence of key operation codes in each sub-program block;

[0016] Sub-step S122: These key operation codes include basic operation codes, variable names and register names.

[0017] Preferably, step 2 includes the following sub-steps:

[0018] Sub-step S21: The malware sequence information represented by the binary contains key information such as core functions and resource calls, which are usually dispersed to different locations in the sequence during compilation. A stacked two-layer one-dimensional convolutional neural network model is used to encode the binary file's features, overcoming the problem of long-range information dependency in binary text.

[0019] Sub-step S22: extracting opcode information and using the currently advanced triangular attention algorithm to calculate the internal correlation of the opcode block and the long-distance relationship between different opcode blocks;

[0020] Sub-step S23: Calculate the correlation scores between the opcodes in different sub-program blocks and other opcodes, thereby obtaining a matrix vector describing the malware assembly file.

[0021] Preferably, step S3 includes the following sub-steps:

[0022] Sub-step S31: using a gated self-attention mechanism module to further filter out key information;

[0023] Sub-step S32: using the cross attention module and the self-attention calculation method, taking the operation code matrix vector as the calculation condition of the binary eigenvector, so that the calculated output vector integrates the information of the two eigenvectors;

[0024] Sub-step S33: A residual network structure is used to reduce information loss during the transmission of the training model.

[0025] Preferably, S4 includes the following sub-steps:

[0026] Sub-step S41: using the DNN network to generate classification results;

[0027] Sub-step S42: At the output layer, use the softmax function to label the input software as its malicious family;

[0028] Sub-step S43: adopting the cross entropy loss function during training.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] 1. A stacked two-layer one-dimensional convolutional network is proposed to effectively extract features of malware binary files.

[0031] 2. Use the triangular attention algorithm to extract assembly file features, which can calculate the key features in the assembly file based on the opcode and assembly code block respectively.

[0032] 3. A multi-feature based neural network classification model was proposed, and a multi-feature alignment fusion algorithm was used to achieve good malware classification results. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a flow chart of the present invention.

[0034] Figure 2 This is a diagram of a stacked double-layer one-dimensional convolutional neural network model of the present invention. DETAILED DESCRIPTION

[0035] The following is a further detailed description of the embodiments of the present invention in conjunction with the accompanying drawings and examples. The detailed description of the following embodiments and the accompanying drawings are intended to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention. Those skilled in the art can combine the technical features in the embodiments to form new embodiments without creative effort, and these new embodiments are also covered by the scope of protection of the present invention.

[0036] By effectively integrating binaries and assembly code, a hybrid attention model for malware detection is proposed. To overcome the problem of incomplete capture of binary sequence information, we take the binary sequence as the raw input and extract features through a stacked two-layer convolutional network. The first convolutional layer extracts temporal information, and the second convolutional layer captures discontinuities during function calls and jumps. At the same time, we use a triangular attention module to extract code-level features, which not only considers the overall relationship of functions but also incorporates the inherent usage patterns of opcodes. Finally, a cross-attention module is used to align and fuse these two features, and the fused feature vector is input into the network for training. This enables the network to learn the relationship between binaries and assembly code, improve the stability of the fused feature representation, and thus achieve better performance in independent tests.

[0037] Figure 1 This is the main design drawing of the technical solution of the present invention. Figure 1 As shown, the multi-feature-based automated malware detection method proposed in the present invention includes the following four modules:

[0038] Module a: Data Preprocessing. After obtaining the original malware file, we statically decompile it using the IDA Pro tool to obtain the malware binary and assembly files. We then extract the opcode sequences from the binary files. Specifically, we divide each program into multiple subroutine blocks and calculate the frequency of key opcodes within each subroutine block. These key opcodes include basic opcodes, variable names, and register names.

[0039] Module b: Feature extraction. The opcodes extracted from the binary files and assembly files obtained in module a are further subjected to feature extraction. Specifically, the malware sequence information represented by the binary contains key information such as core functions and resource calls, which are usually scattered to different positions in the sequence as the compilation progresses. Using a stacked two-layer one-dimensional convolutional neural network model to encode features of the binary file can overcome the problem of long-distance information dependence of binary text. Secondly, extract the opcode information. Use the currently advanced triangular attention algorithm to calculate the internal correlation of the opcode block and the long-distance relationship between different opcode blocks. The algorithm calculates the correlation score between the opcodes in different subroutine blocks and other opcodes, thereby obtaining a matrix vector that describes the malware assembly file.

[0040] The following is combined with Figure 2 The stacked double-layer one-dimensional convolutional neural network model proposed in the present invention is further described.

[0041] The binary sequence is first input into a one-dimensional convolution to extract byte features within a fixed window size.

[0042] Then, dilated convolution is used to extract the vector. By increasing the receptive field, the range of information contained in each convolution output is expanded and the long-range information dependency problem of binary text is overcome.

[0043] The feature maps output by the two-layer one-dimensional convolution are input to the pooling layer to reduce the dimension and compress the features.

[0044] The basic structure consisting of two layers of one-dimensional convolution and pooling layers is repeated until the dimension of the output features matches the threshold accepted by the subsequent module.

[0045] Module c: To effectively align and fuse the binary feature vector obtained by the above module b and the matrix vector generated by the triangular attention mechanism.

[0046] First, a gated self-attention mechanism module is used to further filter out key information.

[0047] Then, the cross-attention module is used to calculate the binary feature vector using the self-attention calculation method, so that the calculated output vector integrates the information of the two feature vectors.

[0048] Finally, to reduce information loss during the transmission of the trained model, we use a residual network structure.

[0049] Module d: Responsible for malware detection and classification. It uses a DNN network to produce classification results. At the output layer, a softmax function is used to label the input software as belonging to its malicious family. The cross-entropy loss function is used during training.

Claims

1. A multi-feature based automated malware detection method, characterized in that: The following steps are included: Step S1: preprocessing data; Step S2: Extract features from the data to obtain binary feature vectors and matrix vectors generated by the triangular attention mechanism; Step S3: effectively align and fuse the binary feature vector obtained in step S2 above and the matrix vector generated by the triangular attention mechanism to generate the final fused vector; Step S4: responsible for malware detection and classification; The step S1 includes the following sub-steps: Sub-step S11: After obtaining the original malware file, use the IDA pro tool to statically decompile the file to obtain the binary file and assembly file of the malware; Sub-step S12: Counting the frequencies of key operation codes from the assembly file; The sub-step S12 includes the following sub-steps: Sub-step S121: Divide each program into multiple sub-program blocks, and calculate the frequency of occurrence of key operation codes in each sub-program block; Sub-step S122: These key operation codes include basic operation codes, variable names and register names; The step S2 includes the following sub-steps: Sub-step S21: The malware sequence information represented by the binary contains key information about core functions and resource calls, which are usually distributed to different locations in the sequence during compilation. A stacked two-layer one-dimensional convolutional neural network model is used to encode the binary file's features, overcoming the problem of long-range information dependency in binary text. Sub-step S22: extracting opcode information and using the currently advanced triangular attention algorithm to calculate the internal correlation of the opcode block and the long-distance relationship between different opcode blocks; Sub-step S23: calculating the correlation scores between the opcodes in different sub-program blocks and other opcodes, thereby obtaining a matrix vector describing the malware assembly file; The step S3 includes the following sub-steps: Sub-step S31: using a gated self-attention mechanism module to further filter out key information; Sub-step S32: using the cross attention module and the self-attention calculation method, taking the operation code matrix vector as the calculation condition of the binary eigenvector, so that the calculated output vector integrates the information of the two eigenvectors; Sub-step S33: using a residual network structure to reduce information loss during the training model transmission process; The S4 includes the following sub-steps: Sub-step S41: using the DNN network to generate classification results; Sub-step S42: At the output layer, use the softmax function to label the input software as its malicious family; Sub-step S43: adopting the cross entropy loss function during training.

Images