Sample homology detection method, device and equipment based on dynamic gene characteristics

Abstract

This application provides a method, apparatus, and device for sample homology detection based on dynamic gene features. The method includes: preprocessing several sub-codes contained in a code sample to obtain dynamic behavioral features corresponding to different behavioral categories for the sub-codes; identifying unique behavioral features corresponding to each behavioral category based on the degree of difference between dynamic behavioral features belonging to the same behavioral category; combining the unique behavioral features according to the execution order of each unique behavioral feature to generate gene behavioral features corresponding to the code sample; performing clustering processing on the gene behavioral features corresponding to the several code samples to obtain at least one dynamic gene feature cluster; and using the center point of each dynamic gene feature cluster as a dynamic gene feature to perform homology detection on the code to be detected based on the dynamic gene features. The technical solution of this application can improve the accuracy of code homology detection results.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus and device for detecting sample homology based on dynamic gene features. Background Technology

[0002] With the rapid development of the internet, large-scale automated malware attacks have become a major form of cyberattack, characterized by a large number of variants, rapid spread, and wide impact. Research has found that malware developed by the same author, organization, or software family shares certain coding similarities. Current technical solutions analyze the dynamic and static features of code samples using existing rules to determine software homology. However, these detection rules have poor universality and slow iteration updates, resulting in low accuracy. Therefore, improving the accuracy of code homology detection results has become an urgent technical problem to be solved. Summary of the Invention

[0003] In view of this, this application provides a method, apparatus, medium and equipment for detecting sample homology based on dynamic gene characteristics, which at least partially solves the problems existing in the prior art.

[0004] According to one aspect of the embodiments of this application, a sample homology detection method based on dynamic gene features is provided, the method comprising:

[0005] The code sample contains several sub-codes, which are preprocessed to obtain dynamic behavioral features of the sub-codes corresponding to different behavior categories.

[0006] Based on the degree of difference between dynamic behavioral characteristics belonging to the same behavioral category, the unique behavioral characteristics corresponding to each behavioral category are identified.

[0007] The unique behavioral features are combined according to the execution order of each unique behavioral feature to generate the gene behavioral features corresponding to the code sample;

[0008] Clustering is performed on the gene behavior features corresponding to several homologous code samples to obtain at least one dynamic gene feature cluster;

[0009] The center point of each of the dynamic gene feature clusters is taken as the dynamic gene feature corresponding to the source, so as to perform homology detection on the code to be detected based on the dynamic gene feature.

[0010] According to one aspect of the embodiments of this application, a sample homology detection device based on dynamic gene features is provided, the device comprising:

[0011] The preprocessing module is used to preprocess several sub-codes contained in the code sample to obtain dynamic behavior features of the several sub-codes corresponding to different behavior categories.

[0012] The identification module is used to identify the unique behavioral features corresponding to each behavioral category based on the degree of difference between dynamic behavioral features belonging to the same behavioral category.

[0013] The generation module is used to combine the unique behavioral features according to the execution order of each unique behavioral feature to generate the gene behavioral features corresponding to the code sample;

[0014] The clustering module is used to perform clustering based on the gene behavior features corresponding to several homologous code samples to obtain at least one dynamic gene feature cluster.

[0015] The processing module is used to take the center point of each of the dynamic gene feature clusters as the dynamic gene feature corresponding to the source, so as to perform homology detection on the code to be detected based on the dynamic gene feature.

[0016] According to one aspect of the embodiments of this application, an electronic device is provided, including a processor and a memory; the processor executes the steps of the method as described in the above embodiments by invoking a program or instructions stored in the memory.

[0017] According to one aspect of the embodiments of this application, a non-transitory computer-readable storage medium is provided, the non-transitory computer-readable storage medium storing a program or instructions that cause a computer to perform the steps of the method as described in the above embodiments.

[0018] In some embodiments of this application, the technical solutions involve preprocessing several sub-codes contained in a code sample to obtain dynamic behavioral features corresponding to different behavioral categories. Based on the degree of difference between dynamic behavioral features belonging to the same behavioral category, unique behavioral features corresponding to each behavioral category are identified. These unique behavioral features are then combined according to their execution order to generate gene behavioral features corresponding to the code sample. Furthermore, clustering is performed on the gene behavioral features corresponding to several code samples to obtain at least one dynamic gene feature cluster. The center point of each dynamic gene feature cluster is used as the dynamic gene feature to perform homology detection on the code to be detected. Therefore, by obtaining the dynamic gene features corresponding to the code sample for homology judgment, the detection dimensions are broader, the detection depth is deeper, and it is less susceptible to being bypassed by methods such as obfuscation or packing, ensuring the accuracy of the homology detection results.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 A schematic flowchart of a sample homology detection method based on dynamic gene features according to an embodiment of this application is shown;

[0022] Figure 2 A block diagram of a sample homology detection device based on dynamic gene features according to an embodiment of this application is shown. Detailed Implementation

[0023] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0024] It should be noted that, in the absence of conflict, the following embodiments and features can be combined with each other; and, based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0025] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0026] Figure 1 A flowchart illustrating a sample homology detection method based on dynamic gene features according to an embodiment of this application is shown. This method can be applied to terminal devices, including but not limited to one or more of smartphones, tablets, laptops, and desktop computers. It can also be applied to servers, which can be physical servers or cloud servers; this application does not impose any special limitations on this.

[0027] Reference Figure 1As shown, this sample homology detection method based on dynamic gene features includes at least steps S110 to S150, which are described in detail below (the following explanation uses an application to a terminal device as an example):

[0028] In step S110, several sub-codes contained in the code sample are preprocessed to obtain dynamic behavior features of the several sub-codes corresponding to different behavior categories.

[0029] The code samples can be pre-collected malware program code, such as scripts or software. Each code sample can contain several sub-codes, which can be part of the same software or script, or executable code fragments belonging to different software or scripts.

[0030] In this embodiment, the terminal device can preprocess several sub-codes contained in the code sample to determine the dynamic behavior characteristics of the sub-codes during execution. These dynamic behavior characteristics can be used to describe the actions of the sub-codes during execution, such as file behavior, network behavior, etc. These dynamic behavior characteristics can be represented by vectors or other forms.

[0031] Those skilled in the art can pre-classify various actions and behaviors into behavior categories. In one embodiment, behavior categories may include, but are not limited to, at least one of file behavior, network behavior, process behavior, registry behavior, runtime DLL loading behavior, mutex behavior, form operation behavior, and API call behavior. Therefore, by preprocessing several sub-codes, a set of dynamic behavior features corresponding to different behavior categories can be obtained. It should be noted that a single sub-code can extract one dynamic behavior feature, or it can extract multiple dynamic behavior features corresponding to different behavior categories; this is not specifically limited.

[0032] In one embodiment of this application, several sub-codes contained in a code sample are preprocessed to obtain dynamic behavioral features of the several sub-codes corresponding to different behavior categories, including:

[0033] The code sample contains several sub-codes, which are decompiled to obtain the dynamic behavior features of the sub-codes corresponding to different behavior categories.

[0034] In this embodiment, the terminal can decompile several sub-codes to convert them into a high-level programming language with a more readable format. The terminal can then extract dynamic behavioral characteristics corresponding to different behavior categories when executing these sub-codes based on the decompiled program code.

[0035] In another embodiment of this application, several sub-codes contained in the code sample are preprocessed to obtain dynamic behavioral features of the several sub-codes corresponding to different behavior categories, including:

[0036] Several sub-codes contained in the code sample are input into a sandbox to detect the dynamic behavioral characteristics of the sub-codes corresponding to different behavioral categories.

[0037] In this embodiment, the terminal can directly input several sub-codes contained in the code sample into the dynamic sandbox for execution, which can ensure security and also extract the dynamic behavior characteristics of the sub-codes during execution. The sub-codes can be classified according to the pre-divided behavior categories to obtain a set of dynamic behavior characteristics corresponding to different behavior categories.

[0038] Please continue to refer to this. Figure 1 In step S120, the unique behavioral features corresponding to each behavioral category are identified based on the degree of difference between dynamic behavioral features belonging to the same behavioral category.

[0039] In this embodiment, the terminal can identify unique behavioral features from dynamic behavioral features belonging to the same behavior category based on the degree of difference between the dynamic behavioral features. These unique behavioral features can be the relatively unique action behavior of the sub-code, which can be used to characterize the special characteristics of code from different sources.

[0040] In one embodiment of this application, the unique behavioral features corresponding to each behavioral category are identified based on the degree of difference between dynamic behavioral features belonging to the same behavioral category, including:

[0041] Clustering is performed on dynamic behavioral features belonging to the same behavioral category to identify unique behavioral features that conform to predetermined rules from the dynamic behavioral features belonging to the same behavioral category.

[0042] In this embodiment, the terminal can use the K-means clustering algorithm to cluster dynamic behavior features belonging to the same behavior category. Based on the clustering results, action behavior features that are less than a certain threshold in number and have a large distance (e.g., greater than a certain threshold) from other clusters can be regarded as unique behavior features.

[0043] Specifically, for dynamic behavioral features belonging to the same behavioral category, k feature points can be randomly selected as initial cluster centers. The position of each feature point (i.e., dynamic behavioral feature) relative to the cluster center is calculated, and the feature point is assigned to the cluster containing the nearest cluster center. For the adjusted clusters, new cluster centers are calculated. If there is no change in the clustering results between two consecutive clustering operations, it indicates that the clustering criterion function has converged, achieving the final clustering. Based on the clustering results, features closer to the cluster center are considered normal features, while features farther from the cluster center are considered unique behavioral features that distinguish them from general behaviors, thus ensuring the accuracy of the unique behavioral feature determination results.

[0044] It should be noted that those skilled in the art may also use other methods to identify unique behavioral characteristics that distinguish action behavior from other characteristics, and this application does not impose any special limitations on this.

[0045] Please continue to refer to this. Figure 1 In step S130, the unique behavioral features are combined according to the execution order of each unique behavioral feature to generate the gene behavioral features corresponding to the code sample.

[0046] In this embodiment, those skilled in the art can pre-set the execution order corresponding to each behavior category. After determining the unique behavior features corresponding to each behavior category, the terminal can combine and sort the determined unique behavior features according to the execution order of its corresponding behavior category to obtain the gene behavior features corresponding to the code sample. In one example, the gene behavior feature can be a behavior string composed of multiple unique behavior features.

[0047] In one example, if a certain behavior category has multiple unique behavior features, multiple gene behavior features can be generated based on the unique behavior features of the same behavior category. That is, within the same gene behavior feature, there is only one unique behavior feature of the same behavior category.

[0048] In other examples, within a single gene behavioral trait, specific behavioral traits belonging to the same behavioral category can be arranged together according to the execution order corresponding to that behavioral category. This ensures the integrity of the information carried by the gene behavioral traits.

[0049] It should be understood that those skilled in the art can determine the generation method of the corresponding gene behavioral characteristics based on prior experience, and this application does not impose any special limitations on this.

[0050] In step S140, clustering is performed based on the gene behavior features corresponding to several code samples to obtain at least one dynamic gene feature cluster.

[0051] In this embodiment, the terminal can cluster the gene behavior features corresponding to several code samples to obtain at least one dynamic gene feature cluster. It should be understood that a code sample can correspond to one, two, or more gene behavior features of any number; this application does not impose any special limitations on this.

[0052] In one embodiment of this application, clustering is performed based on the gene behavior features corresponding to several code samples to obtain at least one dynamic gene feature cluster, including:

[0053] The k-nearest neighbor classification algorithm is used to cluster the gene behavior features corresponding to several code samples to obtain at least one dynamic gene feature cluster.

[0054] In this embodiment, the terminal can employ a k-nearest neighbor (kNN) classification algorithm to cluster several gene behavior features to obtain at least one dynamic gene feature cluster. Based on this kNN classification algorithm, if most of the k most similar (i.e., nearest) samples in the feature space for a given sample (i.e., gene behavior feature) belong to a certain category, then the sample also belongs to that category. This allows for better classification of gene behavior features, ensuring the accuracy of the resulting dynamic gene feature cluster.

[0055] In step S150, the center point of each of the dynamic gene feature clusters is taken as a dynamic gene feature, so as to perform homology detection on the code to be detected based on the dynamic gene feature.

[0056] In this embodiment, the terminal can use the center point of the dynamic gene feature cluster obtained by classification as the dynamic gene feature. When there is code to be detected that needs to be homologous, it can perform homologous detection based on the dynamic gene feature and the code to be detected, so as to determine which dynamic gene feature cluster the code to be detected is homologous to based on the comparison results.

[0057] based on Figure 1The illustrated embodiment preprocesses several sub-codes contained in the code sample to obtain dynamic behavioral features corresponding to different behavior categories. Based on the degree of difference between dynamic behavioral features belonging to the same behavior category, unique behavioral features corresponding to each behavior category are identified. These unique behavioral features are then combined according to their execution order to generate gene behavioral features corresponding to the code sample. Clustering is then performed on the gene behavioral features corresponding to several code samples to obtain at least one dynamic gene feature cluster. The center point of each dynamic gene feature cluster is used as the dynamic gene feature to perform homology detection on the code to be detected. Therefore, by obtaining the dynamic gene features corresponding to the code sample for homology judgment, the detection dimensions are broader, the detection depth is deeper, and it is less susceptible to being bypassed by methods such as obfuscation or packing, ensuring the accuracy of the homology detection results.

[0058] In one embodiment of this application, the sample homology detection method based on dynamic gene features further includes:

[0059] Obtain the code to be detected and determine the dynamic gene features corresponding to the code to be detected;

[0060] The dynamic gene features corresponding to the code to be detected are compared with the dynamic gene features of each pre-determined dynamic gene feature cluster to determine their homology.

[0061] In this embodiment, when it is necessary to perform homology detection on the code, the terminal can obtain the code to be detected and determine the dynamic gene features corresponding to the code to be detected using the method described in the previous embodiment. Then, the dynamic gene features corresponding to the code to be detected are compared with the dynamic gene features corresponding to each pre-determined dynamic gene feature cluster. Based on the similarity between the two, it is determined which dynamic gene feature cluster the code to be detected is homologous to.

[0062] In one example, the Euclidean distance between two dynamic gene features can be calculated to determine if the code to be detected is homologous to the dynamic gene feature cluster whose corresponding Euclidean distance is less than a certain threshold and is the smallest. It should be understood that those skilled in the art can also choose the appropriate alignment method according to actual implementation needs, and this application does not impose any special limitations on this.

[0063] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0064] Please refer to Figure 2In one embodiment of this application, a sample homology detection device based on dynamic gene characteristics is also provided, the device comprising:

[0065] The preprocessing module is used to preprocess several sub-codes contained in the code sample to obtain dynamic behavior features of the several sub-codes corresponding to different behavior categories.

[0066] The identification module is used to identify the unique behavioral features corresponding to each behavioral category based on the degree of difference between dynamic behavioral features belonging to the same behavioral category.

[0067] The generation module is used to combine the unique behavioral features according to the execution order of each unique behavioral feature to generate the gene behavioral features corresponding to the code sample;

[0068] The clustering module is used to perform clustering based on the gene behavior features corresponding to several code samples to obtain at least one dynamic gene feature cluster.

[0069] The processing module is used to take the center point of each of the dynamic gene feature clusters as the corresponding dynamic gene feature, so as to perform homology detection on the code to be detected based on the dynamic gene feature.

[0070] In one embodiment of this application, the identification module is used for:

[0071] Clustering is performed on dynamic behavioral features belonging to the same behavioral category to identify unique behavioral features that conform to predetermined rules from the dynamic behavioral features belonging to the same behavioral category.

[0072] In one embodiment of this application, the preprocessing module is used to: decompile several sub-codes contained in the code sample to obtain dynamic behavior features of the several sub-codes corresponding to different behavior categories; or input several sub-codes contained in the code sample into a sandbox to detect and obtain dynamic behavior features of the several sub-codes corresponding to different behavior categories.

[0073] In one embodiment of this application, the clustering module is used to: use the k-nearest neighbor classification algorithm to cluster the gene behavior features corresponding to several code samples to obtain at least one dynamic gene feature cluster.

[0074] In one embodiment of this application, the processing module is further configured to: acquire a code to be detected and determine the dynamic gene features corresponding to the code to be detected; compare the dynamic gene features corresponding to the code to be detected with the dynamic gene features of each pre-determined dynamic gene feature cluster to determine their homology.

[0075] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0076] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0077] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0078] An electronic device according to this embodiment of the present application. The electronic device is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of this application.

[0079] Electronic devices are manifested in the form of general-purpose computing devices. Components of an electronic device may include, but are not limited to: at least one processor, at least one memory, and buses connecting different system components (including memory and processor).

[0080] The storage device stores program code that can be executed by the processor to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of this application.

[0081] The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).

[0082] The storage may also include programs / utilities having a set (at least one) of program modules, including but not limited to: an operating system, one or more applications, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0083] A bus can represent one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus that uses any of the various bus architectures.

[0084] The electronic device can also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., routers, modems, etc.). This communication can be performed via input / output (I / O) interfaces. Furthermore, the electronic device can communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter. The network adapter communicates with other modules of the electronic device via a bus. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0085] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0086] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible implementations, various aspects of this application may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of this application described in the "Exemplary Methods" section above.

[0087] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0088] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0089] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0090] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0091] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this application, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0092] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0093] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting homology of samples based on dynamic gene features, characterized in that, The method includes: The code sample contains several sub-codes, which are preprocessed to obtain dynamic behavioral features of the sub-codes corresponding to different behavior categories. Based on the degree of difference between dynamic behavioral characteristics belonging to the same behavioral category, the unique behavioral characteristics corresponding to each behavioral category are identified. The unique behavioral features are combined according to the execution order of each unique behavioral feature to generate the gene behavioral features corresponding to the code sample; Clustering is performed on the gene behavior features corresponding to several code samples to obtain at least one dynamic gene feature cluster. The center point of each of the dynamic gene feature clusters is used as a dynamic gene feature to perform homology detection on the code to be detected based on the dynamic gene feature.

2. The method according to claim 1, characterized in that, The code sample contains several sub-codes, which are preprocessed to obtain dynamic behavioral features of the sub-codes corresponding to different behavior categories, including: The code sample contains several sub-codes, which are decompiled to obtain the dynamic behavior features of the sub-codes corresponding to different behavior categories. or Several sub-codes contained in the code sample are input into a sandbox to detect the dynamic behavioral characteristics of the sub-codes corresponding to different behavioral categories.

3. The method according to claim 1, characterized in that, Based on the degree of difference between dynamic behavioral characteristics belonging to the same behavioral category, the unique behavioral characteristics corresponding to each behavioral category are identified, including: Clustering is performed on dynamic behavioral features belonging to the same behavioral category to identify unique behavioral features that conform to predetermined rules from the dynamic behavioral features belonging to the same behavioral category.

4. The method according to claim 1, characterized in that, Clustering is performed based on the gene behavior features corresponding to several code samples to obtain at least one dynamic gene feature cluster, including: The k-nearest neighbor classification algorithm is used to cluster the gene behavior features corresponding to several code samples to obtain at least one dynamic gene feature cluster.

5. The method according to any one of claims 1-4, characterized in that, The behavior categories include at least one of the following: file behavior, network behavior, process behavior, registry behavior, runtime DLL loading behavior, mutex behavior, form operation behavior, and API call behavior.

6. The method according to any one of claims 1-4, characterized in that, The method further includes: Obtain the code to be detected and determine the dynamic gene features corresponding to the code to be detected; The dynamic gene features corresponding to the code to be detected are compared with the dynamic gene features of each pre-determined dynamic gene feature cluster to determine their homology.

7. A sample homology detection device based on dynamic gene characteristics, characterized in that, include: The preprocessing module is used to preprocess several sub-codes contained in the code sample to obtain dynamic behavior features of the several sub-codes corresponding to different behavior categories. The identification module is used to identify the unique behavioral features corresponding to each behavioral category based on the degree of difference between dynamic behavioral features belonging to the same behavioral category. The generation module is used to combine the unique behavioral features according to the execution order of each unique behavioral feature to generate the gene behavioral features corresponding to the code sample; The clustering module is used to perform clustering based on the gene behavior features corresponding to several code samples to obtain at least one dynamic gene feature cluster. The processing module is used to take the center point of each of the dynamic gene feature clusters as the corresponding dynamic gene feature, so as to perform homology detection on the code to be detected based on the dynamic gene feature.

8. The apparatus according to claim 7, characterized in that, The identification module is used for: Clustering is performed on dynamic behavioral features belonging to the same behavioral category to identify unique behavioral features that conform to predetermined rules from the dynamic behavioral features belonging to the same behavioral category.

9. An electronic device, characterized in that, Including processor and memory; The processor executes the steps of the method as described in any one of claims 1 to 6 by invoking programs or instructions stored in the memory.

10. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores a program or instructions that cause a computer to perform the steps of the method as described in any one of claims 1 to 6.

Images