Methods and devices for analyzing abnormal software behavior, electronic devices, and storage media.

Abstract

This invention discloses a method, apparatus, electronic device, and storage medium for analyzing abnormal software behavior, relating to the field of financial technology. The method includes: reading bit sequences from software behavior data to obtain a set of bit sequences; segmenting each bit sequence in the set of bit sequences to obtain N subsequences, where N is a positive integer greater than or equal to 1; statistically analyzing the first measure statistical distribution of a first sequence value and the second measure statistical distribution of a second sequence value in each of the N subsequences; and performing cluster analysis on the first measure statistical distribution and the second measure statistical distribution to obtain an abnormal behavior feature library, wherein the abnormal behavior feature library is used to detect abnormal behavior of malicious software. This invention solves the technical problem in related technologies that cannot effectively monitor the abnormal software behavior of malicious software.

Description

Technical Field

[0001] This invention relates to the field of financial technology or other related technical fields. Specifically, it relates to a method and apparatus for analyzing abnormal software behavior, an electronic device, and a storage medium. Background Technology

[0002] With the development of Internet technology, while data exchange efficiency has been greatly improved, the rampant spread of a large number of malicious software programs has made network security issues more prominent. Different types of malicious software have exhibited various abnormal behaviors, such as forced installation and malicious collection of user information. These abnormal behaviors can easily lead to adverse effects such as leakage of user information and threats to user terminal security. Therefore, the monitoring of abnormal software behavior has become increasingly urgent.

[0003] In related technologies, the identification of abnormal software behavior usually relies on computers to complete automatically. Depending on whether the runtime state of malware is considered, abnormal software behavior monitoring is divided into two categories: dynamic monitoring and static monitoring. Dynamic monitoring methods detect abnormal behavior in environments such as virtual machines, which is time-consuming and complex to analyze. Static detection usually uses methods such as feature matching, signature codes, and heuristic scanning. This detection method is relatively simple, but malware often uses methods such as packing, deformation, and variants to interfere with detection and analysis, resulting in unsatisfactory detection results and missing a large number of malware.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a method, apparatus, electronic device, and storage medium for analyzing abnormal software behavior, in order to at least solve the technical problem in the related art that it is impossible to effectively monitor the abnormal software behavior of malicious software.

[0006] According to one aspect of the present invention, a method for analyzing abnormal software behavior is provided, comprising: reading bit sequences from software behavior data to obtain a set of bit sequences, wherein bits in each bit sequence are shifted; segmenting each bit sequence in the set of bit sequences to obtain N subsequences, wherein N is a positive integer greater than or equal to 1; respectively statistically analyzing a first measure statistical distribution result of a first sequence value and a second measure statistical distribution result of a second sequence value in each of the N subsequences, wherein the first sequence value indicates the static distribution characteristics of the software behavior data, and the second sequence value indicates the dynamic distribution characteristics of the software behavior data; performing cluster analysis on the first measure statistical distribution result and the second measure statistical distribution result to obtain an abnormal behavior feature library, wherein the abnormal behavior feature library is used to provide detection of abnormal behavior of malicious software.

[0007] Optionally, the step of reading bit sequences from software behavior data to obtain a set of bit sequences includes: reading bit sequences from software behavior data generated by each software in the software set using a binary strategy; and shifting bits in each bit sequence using a preset shift strategy to obtain the set of bit sequences.

[0008] Optionally, the step of shifting the bits in each bit sequence using a preset shift strategy to obtain the set of bit sequences includes: shifting each bit sequence in the target direction by a specified shift length k, where k is a positive integer greater than or equal to 1 and k is less than the total length of the bit sequence; adding the last bit of the bit sequence that was removed after shifting to the starting position of the bit sequence to obtain the set of bit sequences.

[0009] Optionally, the step of segmenting each bit sequence in the set of bit sequences to obtain N subsequences includes: obtaining a preset segmentation fixed length; and using the preset segmentation fixed length to segment each bit sequence to obtain the N subsequences of the same length.

[0010] Optionally, the step of statistically analyzing the first measure distribution of the occurrence of the first sequence value in each of the N subsequences includes: assigning a subsequence identifier to each segmented subsequence for each bit sequence; counting the total number of occurrences of the first sequence value in each subsequence after segmentation of each bit sequence to obtain a value corresponding to each subsequence; accumulating the value corresponding to each subsequence according to the identifier order of the subsequence identifiers to obtain a first accumulated value; statistically analyzing the first probability distribution data associated with the first sequence value in the bit sequence based on the value corresponding to each subsequence; and determining the first measure distribution result based on the first accumulated value and the first probability distribution data.

[0011] Optionally, the step of statistically analyzing the second measure distribution of the second sequence value in each of the N subsequences includes: calculating the total number of occurrences of the second sequence value in each subsequence after segmenting each bit sequence to obtain a numerical value corresponding to each subsequence; accumulating the numerical values ​​corresponding to each subsequence according to the identification order of the subsequence identifiers to obtain a second accumulated value; statistically analyzing the second probability distribution data associated with the second sequence value in the bit sequence based on the numerical values ​​corresponding to each subsequence; and determining the second measure distribution result based on the second accumulated value and the second probability distribution data.

[0012] Optionally, the step of performing cluster analysis on the first measure statistical distribution results and the second measure statistical distribution results includes: performing cluster analysis on the first measure statistical distribution results and the second measure statistical distribution results using the K-means algorithm.

[0013] According to another aspect of the present invention, an analysis apparatus for abnormal software behavior is also provided, comprising: a reading unit for reading bit sequences in software behavior data to obtain a set of bit sequences, wherein bits in each bit sequence are shifted; a segmentation unit for segmenting each bit sequence in the set of bit sequences to obtain N subsequences, wherein N is a positive integer greater than or equal to 1; a statistics unit for statistically analyzing a first measure statistical distribution result of a first sequence value and a second measure statistical distribution result of a second sequence value in each of the N subsequences, wherein the first sequence value indicates the static distribution characteristics of the software behavior data and the second sequence value indicates the dynamic distribution characteristics of the software behavior data; and an analysis unit for performing cluster analysis on the first measure statistical distribution result and the second measure statistical distribution result to obtain an abnormal behavior feature library, wherein the abnormal behavior feature library is used to detect abnormal behavior of malicious software.

[0014] Optionally, the reading unit includes: a first reading module, configured to read bit sequences from software behavior data generated by each software in the software set using a binary strategy; and a first shifting module, configured to shift bits in each bit sequence using a preset shifting strategy to obtain the bit sequence set.

[0015] Optionally, the first shift module includes: a first shift submodule, configured to shift each bit sequence in the target direction according to a specified shift length k, wherein k is a positive integer greater than or equal to 1 and k is less than the total length of the bit sequence; and a first addition submodule, configured to add the last bit of the bit sequence that was removed after shifting to the starting position of the bit sequence to obtain the set of bit sequences.

[0016] Optionally, the segmentation unit includes: a first acquisition module, used to acquire a preset segmentation fixed length; and a first segmentation module, used to segment each bit sequence using the preset segmentation fixed length to obtain the N subsequences of the same length.

[0017] Optionally, the statistical unit includes: a first allocation module, configured to assign a subsequence identifier to each segmented subsequence for each bit sequence; a first statistical module, configured to count the total number of occurrences of the first sequence value in each subsequence after segmentation of each bit sequence, obtaining a value corresponding to each subsequence; a first accumulation module, configured to accumulate the value corresponding to each subsequence according to the identifier order of the subsequence identifiers, obtaining a first accumulated value; a second statistical module, configured to calculate a first probability distribution data associated with the first sequence value in the bit sequence based on the value corresponding to each subsequence; and a first determination module, configured to determine the first measure statistical distribution result based on the first accumulated value and the first probability distribution data.

[0018] Optionally, the statistical unit further includes: a third statistical module, used to count the total number of occurrences of the second sequence value in each subsequence after segmenting each bit sequence, to obtain a numerical value corresponding to each subsequence; a second accumulation module, used to accumulate the numerical value corresponding to each subsequence according to the identification order of the subsequence identifiers, to obtain a second accumulated value; a fourth statistical module, used to count the second probability distribution data associated with the second sequence value in the bit sequence based on the numerical value corresponding to each subsequence; and a second determination module, used to determine the second measure statistical distribution result based on the second accumulated value and the second probability distribution data.

[0019] Optionally, the analysis unit includes: a first analysis module, used to perform cluster analysis on the statistical distribution results of the first measure and the statistical distribution results of the second measure using the K-means algorithm.

[0020] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the analysis method for any of the above-mentioned abnormal software behaviors.

[0021] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement any of the above-described methods for analyzing abnormal software behavior.

[0022] In this disclosure, the following steps are employed: bit sequences are read from software behavior data to obtain a set of bit sequences, wherein the bits in each bit sequence are shifted; each bit sequence in the set of bit sequences is segmented to obtain N subsequences; then, the first measure statistical distribution result of the first sequence value and the second measure statistical distribution result of the second sequence value appearing in each of the N subsequences are statistically analyzed, wherein the first sequence value indicates the static distribution characteristics of the software behavior data, and the second sequence value indicates the dynamic distribution characteristics of the software behavior data; cluster analysis is performed on the first measure statistical distribution result and the second measure statistical distribution result to obtain an abnormal behavior feature library, wherein the abnormal behavior feature library is used to provide detection of abnormal behaviors of malware.

[0023] This disclosure uses the statistical distribution characteristics of software behavior as a basis to effectively detect abnormal behavior of malware. By utilizing the inherent stability of statistical methods, it can effectively prevent malware from interfering with detection. It can simulate the dynamic characteristics of data (i.e., the dynamic distribution characteristics of software behavior data), improve the efficiency of static monitoring and analysis of abnormal software behavior, and reduce algorithm complexity and resource consumption. This achieves the technical effect of effectively monitoring abnormal behavior of malware, thereby solving the technical problem in related technologies that cannot effectively monitor abnormal software behavior of malware.

[0024] In this disclosure, probabilistic and statistical methods are also used to extract data features, and reasonable convergence is achieved based on the original data space scale, which reduces the data scale for subsequent model training, data mining and other work. Attached Figure Description

[0025] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0026] Figure 1 This is a flowchart of an optional method for analyzing abnormal software behavior according to an embodiment of the present invention;

[0027] Figure 2 This is a schematic diagram of an optional software abnormal behavior analysis step according to an embodiment of the present invention;

[0028] Figure 3 This is a flowchart of an optional K-means algorithm according to an embodiment of the present invention;

[0029] Figure 4 This is a schematic diagram of an optional software abnormal behavior analysis device according to an embodiment of the present invention;

[0030] Figure 5This is a hardware structure block diagram of an electronic device (or mobile device) according to an embodiment of the present invention, which is a method for analyzing abnormal software behavior. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] It should be noted that the software abnormal behavior analysis method and apparatus in this disclosure can be used in the fintech field for monitoring and analyzing software abnormal behavior, and can also be used in any field other than fintech for monitoring and analyzing abnormal behavior of malicious software. The application field of the software abnormal behavior analysis method and apparatus in this disclosure is not limited.

[0034] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are information and data authorized by the user or fully authorized by all parties. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving consent information from the aforementioned user or organization.

[0035] This invention can be applied to various abnormal behavior monitoring systems / devices / products (e.g., various mobile terminals, PCs, and behavior monitoring apps). It uses the statistical distribution characteristics of software for effective detection, and leverages the inherent stability of statistical methods to effectively prevent malware interference. Accumulating the shifted statistical distribution simulates the dynamic characteristics of the data, improving the efficiency of monitoring and analyzing abnormal software behavior. Simultaneously, by using probabilistic statistical methods to extract data features and achieving reasonable convergence based on the original data space scale, subsequent model training and data mining processes reduce the data scale, algorithm complexity, and resource consumption, achieving effective monitoring and analysis of abnormal malware behavior.

[0036] The present invention will now be described in detail with reference to various embodiments.

[0037] Example 1

[0038] According to an embodiment of the present invention, a method embodiment for analyzing abnormal software behavior is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0039] Figure 1 This is a flowchart of an optional method for analyzing abnormal software behavior according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0040] Step S101: Read the bit sequence in the software behavior data to obtain a set of bit sequences, wherein the bits in each bit sequence are shifted;

[0041] Step S102: Divide each bit sequence in the bit sequence set into segments to obtain N subsequences, where N is a positive integer greater than or equal to 1;

[0042] Step S103: Calculate the statistical distribution results of the first measure of the first sequence value and the statistical distribution results of the second measure of the second sequence value in each of the N subsequences, where the first sequence value indicates the static distribution characteristics of the software behavior data and the second sequence value indicates the dynamic distribution characteristics of the software behavior data.

[0043] Step S104: Perform cluster analysis on the statistical distribution results of the first measure and the statistical distribution results of the second measure to obtain an abnormal behavior feature library, wherein the abnormal behavior feature library is used to detect abnormal behaviors of malware.

[0044] Through the above steps, bit sequences in the software behavior data are read to obtain a set of bit sequences, wherein the bits in each bit sequence are shifted; each bit sequence in the set of bit sequences is segmented to obtain N subsequences, where N is a positive integer greater than or equal to 1; the first measure statistical distribution result of the first sequence value and the second measure statistical distribution result of the second sequence value in each of the N subsequences are statistically analyzed, wherein the first sequence value indicates the static distribution characteristics of the software behavior data, and the second sequence value indicates the dynamic distribution characteristics of the software behavior data; cluster analysis is performed on the first measure statistical distribution result and the second measure statistical distribution result to obtain an abnormal behavior feature library, wherein the abnormal behavior feature library is used to provide detection of abnormal behaviors of malware. In this embodiment, the statistical distribution characteristics of software behavior are used as a basis for effectively detecting abnormal behavior of malware. By utilizing the inherent stability of statistical methods, it is possible to effectively prevent malware from interfering with detection. It can simulate the dynamic characteristics of data (i.e., the dynamic distribution characteristics of software behavior data), improve the efficiency of static monitoring and analysis of abnormal software behavior, and at the same time reduce algorithm complexity and resource consumption, thereby achieving the technical effect of effectively monitoring abnormal behavior of malware. This solves the technical problem in related technologies that cannot effectively monitor abnormal software behavior of malware.

[0045] The embodiments of the present invention will be described in detail below with reference to the above implementation steps. The embodiments of the present invention are illustrated using static monitoring of malicious software as an example (of course, the technical solutions provided by the embodiments of the present invention can also achieve dynamic monitoring).

[0046] Step S101: Read the bit sequence in the software behavior data to obtain a set of bit sequences, wherein the bits in each bit sequence are shifted.

[0047] In this embodiment of the invention, step S101 includes: reading the bit sequences in the software behavior data generated by each software in the software set using a binary strategy; and shifting the bits in each bit sequence using a preset shift strategy to obtain a set of bit sequences.

[0048] It should be noted that the binary strategy refers to the method of converting various types of software behavior data (such as decimal and hexadecimal) into binary format using 0 and 1 as carriers.

[0049] In this embodiment of the invention, step S101 further includes: shifting each bit sequence in the target direction according to a specified shift length k, where k is a positive integer greater than or equal to 1 and k is less than the total length of the bit sequence; adding the last bit of the bit sequence that was removed after shifting to the starting position of the bit sequence to obtain a set of bit sequences.

[0050] Optionally, during sequence shifting, for the read bit sequence, it is shifted in the target direction (direction includes shifting to the left or right, and this embodiment uses shifting to the right as an illustration) according to different shift lengths k (k = 1, 2, 3...m | 1 ≤ k ≤ m, m ≤ sequence length). For the shifted bits, they are added to the starting position in their original order. Depending on the value of k, m-1 shift sequences can be obtained (corresponding to the bit sequence set mentioned above).

[0051] This embodiment uses the above steps to perform a bit shift operation on the bit sequence and accumulates the statistical distribution after the shift. To a certain extent, it can simulate the dynamic characteristics of the data and improve the detection of anti-detection methods such as packing and variants of malicious software.

[0052] Step S102: Divide each bit sequence in the bit sequence set into segments to obtain N subsequences, where N is a positive integer greater than or equal to 1.

[0053] In this embodiment of the invention, step S102 includes: obtaining a preset segmentation fixed length; performing segmentation operation on each bit sequence using the preset segmentation fixed length to obtain N subsequences of the same length.

[0054] Optionally, when segmenting the bit sequence, a fixed segment length m (the same as the value of m mentioned above) is first set, and then each shifted sequence is segmented according to the fixed length to obtain multiple subsequences of fixed length. All the shifted sequences obtained above are processed in the same way.

[0055] Step S103: Statistically analyze the first measure distribution of the first sequence value and the second measure distribution of the second sequence value in each of the N subsequences. The first sequence value indicates the static distribution characteristics of the software behavior data, and the second sequence value indicates the dynamic distribution characteristics of the software behavior data.

[0056] In this embodiment of the invention, the step of statistically analyzing the first measure distribution of the occurrence of the first sequence value in each of the N subsequences includes: assigning a subsequence identifier to each segmented subsequence for each bit sequence; counting the total number of occurrences of the first sequence value in each subsequence after segmentation of each bit sequence to obtain a value corresponding to each subsequence; accumulating the value corresponding to each subsequence according to the identifier order of the subsequence identifiers to obtain a first accumulated value; statistically analyzing the first probability distribution data associated with the first sequence value in the bit sequence based on the value corresponding to each subsequence; and determining the first measure distribution result based on the first accumulated value and the first probability distribution data.

[0057] In this embodiment of the invention, the step of statistically analyzing the second measure distribution of the occurrence of the second sequence value in each of the N subsequences includes: counting the total number of occurrences of the second sequence value in each subsequence after segmenting each bit sequence to obtain a numerical value corresponding to each subsequence; accumulating the numerical values ​​corresponding to each subsequence according to the identification order of the subsequence identifiers to obtain a second accumulated value; statistically analyzing the second probability distribution data of the associated second sequence value in the bit sequence based on the numerical values ​​corresponding to each subsequence; and determining the second measure statistical distribution result based on the second accumulated value and the second probability distribution data.

[0058] Optionally, there are no specific limitations on the first and second sequence values ​​selected above. For example, the first sequence value can be any one of "1", "0", "01", "10", "11", "00", "101", "100", etc.; the second sequence value can also be any one of "01", "10", "11", "00", "101", "100", "110", "011", etc. Below, we will use "1" as the first sequence value and "01" as the second sequence value to analyze the behavioral characteristics. For the binary data after binarization, the number of statistical signal "1" represents the distribution of the "valid" part in the data set, which is used to represent the static distribution characteristics of the data (corresponding to the static distribution characteristics of the software behavioral data indicated by the first sequence value above). The statistical signal "01" represents the number of pulses from "nothing" to "something" in the data, which is used to represent the dynamic distribution characteristics of the data (corresponding to the dynamic distribution characteristics of the software behavioral data indicated by the second sequence value above).

[0059] It should be noted that when calculating the statistical distribution of the first measure of the first sequence value in each subsequence, for a fixed-length binary bit sequence, the number of "1"s appearing in the sequence is counted, denoted as p. i (For example, in a sequence of length 32, if the number of occurrences of "1" is 12, then the sequence is p) i =12 (corresponding to the total number of times the first sequence value appears in the above statistics), according to the definition of m value, p i The phase space is restricted to 0≤p≤m. By combining multiple subsequences, the statistical distribution of the sequence is obtained. Multiple subsequences form the first measure statistical distribution. The first measure statistical distribution of each shift sequence is added according to the subsequence labels. The first measure statistical distribution is formed by counting the number of 1s in the 01 sequence, thus obtaining the static distribution characteristics of the data.

[0060] It should be noted that when calculating the statistical distribution of the second measure of the second sequence value in each subsequence, for a fixed-length binary bit sequence, the number of consecutive "0"s and "1"s in the sequence is counted, denoted as q. i(For example, in a sequence of length 32, if "01" appears 5 times, then the sequence is q.) i =5 (corresponding to the total number of second sequence values ​​appearing in the above statistics), according to the definition of m value, q i The phase space is confined to In this process, multiple subsequences are combined to obtain the statistical distribution of the sequence. Multiple subsequences form a second measure statistical distribution. The second measure statistical distribution of each shift sequence is added together according to the subsequence labels.

[0061] Step S104: Perform cluster analysis on the statistical distribution results of the first measure and the statistical distribution results of the second measure to obtain an abnormal behavior feature library, wherein the abnormal behavior feature library is used to detect abnormal behaviors of malware.

[0062] In this embodiment of the invention, step S104 includes: performing cluster analysis on the statistical distribution results of the first measure and the statistical distribution results of the second measure using the K-means algorithm.

[0063] Optionally, this embodiment of the invention uses the K-means algorithm for illustration. The K-means algorithm is used to perform cluster analysis on the statistical distributions of two statistical measures (the statistical distribution results of the first measure and the statistical distribution results of the second measure) to obtain a feature library of abnormal behavior of malicious software. This feature library is used as a reference to support the detection of abnormal behavior of the software to be detected by comparing visual features and comparing the degree of correlation of numerical values.

[0064] Optionally, the abnormal behaviors of malware in the embodiments of the present invention include, but are not limited to: forced installation, browser hijacking, pop-up ads, and malicious collection of user information.

[0065] In this embodiment, the statistical distribution characteristics of the software are used as the basis for effective detection. By utilizing the inherent stability of statistical methods, it is possible to effectively prevent the use of anti-detection measures such as packing and variants of malicious software during the static monitoring of abnormal software behavior, thereby improving the accuracy of monitoring for the presence of these anti-detection measures of malicious software.

[0066] The embodiments of the present invention also utilize probabilistic statistical methods to extract data features and achieve reasonable convergence based on the original data space scale, thereby reducing the data scale and resource consumption for subsequent model training, data mining and other tasks.

[0067] The following is a schematic illustration using a specific embodiment.

[0068] Figure 2 This is a schematic diagram illustrating an optional software anomaly behavior analysis step according to an embodiment of the present invention, such as... Figure 2As shown, the software abnormal behavior analysis system includes a sequence shifting processing module, a shifted sequence segmentation processing module, a segmented P-measure statistics module, a segmented Q-measure statistics module, and a data analysis module. These modules respectively perform sequence shifting processing, segmentation processing, segmented P-measure statistics, segmented Q-measure statistics, and data analysis functions. The analysis of the entire software abnormal behavior includes the following steps:

[0069] Step 1: Shifting process;

[0070] The input is a 0-1 bit sequence. The bits are shifted in the target direction (e.g., left or right) according to different shift lengths k (k = 1, 2, 3...m | 1 ≤ k ≤ m, m ≤ sequence length). The shifted bits are added to the starting position in the original order. Depending on the value of k, m-1 shift sequences can be obtained.

[0071] Step 2: Segmented processing;

[0072] Set a fixed length m (the same as the m value mentioned above), and then divide each shifted sequence into segments according to this fixed length to obtain multiple subsequences of fixed length. Process all shifted sequences obtained in step one in the same way.

[0073] Step 3: Segmented P-measure statistics (corresponding to the first measure statistical distribution results of the first sequence values ​​mentioned above);

[0074] Given a fixed-length 0-1 sequence, count the number of "1"s that appear in the sequence, denoted as p. i (For example, in a sequence of length 32, if the number of occurrences of "1" is 12, then the sequence is p) i =12), according to the definition of m value, p i The phase space is restricted to 0≤p≤m. By combining multiple subsequences, the statistical distribution of the sequence is obtained. Multiple subsequences form a probability statistical distribution of the P measure. The P measure distribution of each shift sequence is added together according to the subsequence labels.

[0075] Step 4: Segmented Q-measure statistics (corresponding to the second measure statistical distribution results of the second sequence values ​​mentioned above);

[0076] Given a fixed-length sequence of 0s and 1s, count the number of consecutive "0"s and "1"s in the sequence, denoted as q. i (For example, in a sequence of length 32, if "01" appears 5 times, then the sequence is q.) i =5), according to the definition of m value, q i The phase space is confined to In this process, multiple subsequences are combined to obtain the statistical distribution of the sequence. The multiple subsequences form the probability statistical distribution of the Q measure. The Q measure distribution of each shift sequence is added together according to the subsequence labels.

[0077] Step 5: Data Analysis.

[0078] The statistical distributions of two statistical measures are analyzed, and clustering is performed using the K-means algorithm to achieve clustering analysis of abnormal malware behavior, resulting in a feature library of abnormal malware behavior. Based on this feature library, the software to be detected can perform abnormal behavior detection by comparing visual features and comparing the degree of numerical correlation.

[0079] Figure 3 This is a flowchart of an optional K-means algorithm according to an embodiment of the present invention, such as... Figure 3 As shown, the K-means algorithm includes the following steps:

[0080] Step 1: Select initial cluster centers;

[0081] Select K objects in the data space (each bit sequence after shifting is used as an object) as initial centers, and each object represents a cluster center.

[0082] Step 2: Cluster the data objects;

[0083] For data objects in the sample, based on their Euclidean distance to the cluster center, they are assigned to the class corresponding to the nearest (most similar) cluster center according to the nearest criterion.

[0084] Step 3: Update cluster centers;

[0085] The mean value of all objects in each category is used as the cluster center of that category, and the value of the objective function is calculated.

[0086] Step 4: Determine whether the values ​​of the cluster centers and the objective function have changed. If not, output the result; if yes, return to Step 2.

[0087] Finally, based on the distribution results obtained from clustering, a software abnormal behavior feature library is obtained.

[0088] Through the above steps, the inherent stability of statistical methods can be utilized to effectively monitor malware anti-detection measures such as packing and variants. In addition, this embodiment uses a bit shifting operation on the bit sequence and accumulates the statistical distribution after the shift, which can simulate the dynamic characteristics of the data and effectively monitor, analyze and prevent abnormal behavior of malware.

[0089] The above steps also utilize probabilistic statistical methods to extract the P-measure and Q-measure statistical distributions of the behavioral data. Based on the original data space scale, reasonable convergence was achieved, which reduced the data scale and resource consumption for subsequent model training, data mining, and other tasks.

[0090] The invention will now be described in conjunction with another alternative embodiment.

[0091] Example 2

[0092] This embodiment provides a software abnormal behavior analysis device, wherein each implementation module included in the software abnormal behavior analysis device corresponds to each implementation step in Embodiment 1.

[0093] Figure 4 This is a schematic diagram of an optional software abnormal behavior analysis device according to an embodiment of the present invention, such as... Figure 4 The device shown includes: a reading unit 41, a segmentation unit 42, a statistics unit 43, and an analysis unit 44, wherein...

[0094] The reading unit 41 is used to read the bit sequence in the software behavior data to obtain a set of bit sequences, wherein the bits in each bit sequence are shifted.

[0095] Segmentation unit 42 is used to segment each bit sequence in the bit sequence set to obtain N subsequences, where N is a positive integer greater than or equal to 1;

[0096] The statistical unit 43 is used to respectively count the first measure statistical distribution result of the first sequence value and the second measure statistical distribution result of the second sequence value in each of the N subsequences, wherein the first sequence value indicates the static distribution characteristics of the software behavior data and the second sequence value indicates the dynamic distribution characteristics of the software behavior data.

[0097] Analysis unit 44 is used to perform cluster analysis on the statistical distribution results of the first measure and to obtain an abnormal behavior feature library, wherein the abnormal behavior feature library is used to detect abnormal behaviors of malware.

[0098] The aforementioned software abnormal behavior analysis device reads bit sequences from software behavior data through reading unit 41 to obtain a set of bit sequences, wherein the bits in each bit sequence are shifted; segments each bit sequence in the set of bit sequences through segmentation unit 42 to obtain N subsequences, where N is a positive integer greater than or equal to 1; statistical unit 43 statistically analyzes the first measure statistical distribution result of the first sequence value and the second measure statistical distribution result of the second sequence value in each of the N subsequences, wherein the first sequence value indicates the static distribution characteristics of the software behavior data and the second sequence value indicates the dynamic distribution characteristics of the software behavior data; and analysis unit 44 performs cluster analysis on the first measure statistical distribution result and the second measure statistical distribution result to obtain an abnormal behavior feature library, wherein the abnormal behavior feature library is used to detect abnormal behaviors of malicious software.

[0099] In this embodiment, the statistical distribution characteristics of software behavior are used as a basis for effectively detecting abnormal behavior of malware. By utilizing the inherent stability of statistical methods, it is possible to effectively prevent malware from interfering with detection. It can simulate the dynamic characteristics of data (i.e., the dynamic distribution characteristics of software behavior data), improve the efficiency of static monitoring and analysis of abnormal software behavior, and at the same time reduce algorithm complexity and resource consumption, thereby achieving the technical effect of effectively monitoring abnormal behavior of malware. This solves the technical problem in related technologies that cannot effectively monitor abnormal software behavior of malware.

[0100] Optionally, the reading unit 41 includes: a first reading module, used to read bit sequences from the software behavior data generated by each software in the software set using a binary strategy; and a first shifting module, used to shift the bits in each bit sequence using a preset shifting strategy to obtain a set of bit sequences.

[0101] Optionally, the first shift module includes: a first shift submodule, used to shift each bit sequence in the target direction according to a specified shift length k, where k is a positive integer greater than or equal to 1 and k is less than the total length of the bit sequence; and a first addition submodule, used to add the last bit of the bit sequence that was removed after shifting to the starting position of the bit sequence to obtain a set of bit sequences.

[0102] Optionally, the segmentation unit 42 includes: a first acquisition module for acquiring a preset segmentation fixed length; and a first segmentation module for segmenting each bit sequence using the preset segmentation fixed length to obtain N subsequences of the same length.

[0103] Optionally, the statistics unit 43 includes: a first allocation module, used to assign a subsequence identifier to each segmented subsequence for each bit sequence; a first statistics module, used to count the total number of first sequence values ​​appearing in each subsequence after segmentation of each bit sequence, to obtain a value corresponding to each subsequence; a first accumulation module, used to accumulate the value corresponding to each subsequence according to the identifier order of the subsequence identifiers, to obtain a first accumulation value; a second statistics module, used to count the first probability distribution data associated with the first sequence values ​​in the bit sequence based on the value corresponding to each subsequence; and a first determination module, used to determine the first measure statistical distribution result based on the first accumulation value and the first probability distribution data.

[0104] Optionally, the statistical unit 43 further includes: a third statistical module, used to count the total number of second sequence values ​​appearing in each subsequence after segmenting each bit sequence, to obtain a numerical value corresponding to each subsequence; a second accumulation module, used to accumulate the numerical value corresponding to each subsequence according to the identification order of the subsequence identifiers, to obtain a second accumulated value; a fourth statistical module, used to count the second probability distribution data of the second sequence values ​​associated with each subsequence based on the numerical value corresponding to each subsequence; and a second determination module, used to determine the second measure statistical distribution result based on the second accumulated value and the second probability distribution data.

[0105] Optionally, the analysis unit 44 includes: a first analysis module, used to perform cluster analysis on the statistical distribution results of the first measure and the statistical distribution results of the second measure using the K-means algorithm.

[0106] The above-mentioned software abnormal behavior analysis device may also include a processor and a memory. The above-mentioned reading unit 41, segmentation unit 42, statistics unit 43, analysis unit 44, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0107] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and abnormal software behavior can be monitored and analyzed by adjusting kernel parameters.

[0108] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0109] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein the analysis method for controlling the device where the computer-readable storage medium is located to perform any of the above-mentioned abnormal software behaviors is provided when the computer program is running.

[0110] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement any of the above-described methods for analyzing abnormal software behavior.

[0111] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having the following method steps: reading bit sequences from software behavior data to obtain a set of bit sequences, wherein the bits in each bit sequence are shifted; segmenting each bit sequence in the set of bit sequences to obtain N subsequences, wherein N is a positive integer greater than or equal to 1; respectively statistically analyzing the first measure statistical distribution result of the first sequence value and the second measure statistical distribution result of the second sequence value in each of the N subsequences, wherein the first sequence value indicates the static distribution characteristics of the software behavior data and the second sequence value indicates the dynamic distribution characteristics of the software behavior data; performing cluster analysis on the first measure statistical distribution result and the second measure statistical distribution result to obtain an abnormal behavior feature library, wherein the abnormal behavior feature library is used to provide detection of abnormal behaviors of malicious software.

[0112] Figure 5 This is a hardware structure block diagram of an electronic device (or mobile device) according to an embodiment of the present invention for analyzing abnormal software behavior. Figure 5 As shown, the electronic device may include one or more processors 502 (shown as 502a, 502b, ..., 502n in the figure) 502 (processor 502 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 504 for storing data. In addition, it may include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 5 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, the electronic device may also include components that are more... Figure 5 The more or fewer components shown, or having the same Figure 5 The different configurations shown.

[0113] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0114] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0115] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0116] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0117] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0118] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0119] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for analyzing abnormal software behavior, characterized in that, include: Reading bit sequences from software behavior data to obtain a set of bit sequences, wherein the bits in each bit sequence are shifted, includes: reading bit sequences from software behavior data generated by each software in the software set using a binary strategy; and shifting the bits in each bit sequence using a preset shift strategy to obtain the set of bit sequences. The bit sequence set is obtained by shifting bits in each bit sequence using a preset shift strategy, including: shifting each bit sequence in the target direction by a specified shift length k, where k is a positive integer greater than or equal to 1 and k is less than the total length of the bit sequence; and adding the last bit of the bit sequence that was removed after shifting to the beginning position of the bit sequence to obtain the bit sequence set. Each bit sequence in the set of bit sequences is segmented to obtain N subsequences, where N is a positive integer greater than or equal to 1; The statistical distribution results of the first measure of the first sequence value and the statistical distribution results of the second measure of the second sequence value in each of the N subsequences are statistically analyzed, wherein the first sequence value indicates the static distribution characteristics of the software behavior data and the second sequence value indicates the dynamic distribution characteristics of the software behavior data. Cluster analysis is performed on the statistical distribution results of the first measure to obtain an abnormal behavior feature library, wherein the abnormal behavior feature library is used to detect abnormal behaviors of malware.

2. The analytical method according to claim 1, characterized in that, The step of segmenting each bit sequence in the set of bit sequences to obtain N subsequences includes: Get the preset segment fixed length; Each bit sequence is segmented using the preset segmentation fixed length to obtain N subsequences of the same length.

3. The analytical method according to claim 1, characterized in that, The steps of statistically analyzing the first measure distribution of the first sequence value in each of the N subsequences include: For each bit sequence, assign a subsequence identifier to each segmented subsequence; Count the total number of times the value of the first sequence appears in each subsequence after each bit sequence is segmented, and obtain the numerical value corresponding to each subsequence; According to the identification order of the subsequence identifiers, the value corresponding to each subsequence is accumulated to obtain the first accumulated value; Based on the numerical value corresponding to each subsequence, statistically analyze the first probability distribution data of the bit sequence associated with the first sequence value; Based on the first accumulated value and the first probability distribution data, the statistical distribution result of the first measure is determined.

4. The analytical method according to claim 3, characterized in that, The steps of statistically analyzing the second measure distribution of the second sequence value in each of the N subsequences include: Count the total number of times the second sequence value appears in each subsequence after each bit sequence is segmented, and obtain the numerical value corresponding to each subsequence; According to the identification order of the subsequence identifiers, the numerical value corresponding to each subsequence is accumulated to obtain the second accumulated value; Based on the numerical value corresponding to each subsequence, statistically analyze the second probability distribution data of the bit sequence associated with the second sequence value; Based on the second accumulated value and the second probability distribution data, the statistical distribution result of the second measure is determined.

5. The analytical method according to claim 1, characterized in that, The steps for performing cluster analysis on the statistical distribution results of the first measure and the statistical distribution results of the first measure include: The K-means algorithm is used to perform cluster analysis on the statistical distribution results of the first measure and the statistical distribution results of the second measure.

6. A device for analyzing abnormal software behavior, characterized in that, include: The reading unit is used to read bit sequences from software behavior data to obtain a set of bit sequences, wherein the bits in each bit sequence are shifted. The reading unit includes: a first reading module, used to read bit sequences from software behavior data generated by each software in the software set using a binary strategy; and a first shifting module, used to shift bits in each bit sequence using a preset shifting strategy to obtain the bit sequence set. The first shift module includes: a first shift submodule, used to shift each bit sequence in the target direction according to a specified shift length k, wherein k is a positive integer greater than or equal to 1 and k is less than the total length of the bit sequence; and a first addition submodule, used to add the last bit of the bit sequence that was removed after shifting to the starting position of the bit sequence to obtain the set of bit sequences. A segmentation unit is used to segment each bit sequence in the set of bit sequences to obtain N subsequences, where N is a positive integer greater than or equal to 1; The statistical unit is used to respectively calculate the first measure statistical distribution result of the first sequence value and the second measure statistical distribution result of the second sequence value in each of the N subsequences, wherein the first sequence value indicates the static distribution characteristics of the software behavior data, and the second sequence value indicates the dynamic distribution characteristics of the software behavior data; The analysis unit is used to perform cluster analysis on the statistical distribution results of the first measure and the statistical distribution results of the second measure to obtain an abnormal behavior feature library, wherein the abnormal behavior feature library is used to detect abnormal behaviors of malware.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the software abnormal behavior analysis method according to any one of claims 1 to 5.

8. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the software abnormal behavior analysis method according to any one of claims 1 to 5.

Images