A method and system for detecting malicious code based on memory forensics and deep learning

Abstract

This invention discloses a malicious code detection method and system based on memory forensics and deep learning, belonging to the field of computer malware detection technology. The method includes the following steps: collecting static executable malicious and benign samples; isolating and running them in a sandbox, then dumping the resulting system image; extracting all .exe and DLL files from the image using memory analysis and extraction techniques; scanning and detecting all extracted files to ensure the authenticity of the malicious samples; converting DLL files and .exe files into grayscale images and operation behavior sequences, then dividing them into benign and malicious datasets; and fusing and complementing a CNN-Attention model and a GNN-LSTM-Attention model using deep learning to improve the performance of malicious code detection. This method can detect not only ordinary executable files but also has good detection performance for "fileless" attacks.

Description

Technical Field

[0001] This invention relates to the field of computer malware detection technology, and in particular to a method and system for detecting malicious code based on memory forensics and deep learning. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the development of computer and internet technologies, an increasing number of software programs have been developed. While these programs provide practicality for people's work and lives, they also bring various negative problems. A single malware incident can lead to significant economic losses. Existing antivirus products offer some protection against malware, but they are generally unable to detect sophisticated malware that utilizes obfuscation and encryption techniques. Current antivirus technologies use signature-based methods, which are insufficient to defend against malware attacks because most environments have unique and invisible binary files, and millions of new malware samples are discovered every day. According to analyses by cybersecurity companies such as CrowdStrike and Rapid7, malware is characterized by its diverse types and rapidly evolving anti-detection technologies. Fileless malware attacks are used to breach security system detection, posing a serious threat and challenge to enterprise security. Fileless malware attacks are a method of penetrating victim organizations by executing code from memory without using malicious files or file fragments on the computer's disk, thereby hiding themselves and their attack traces. Rapid and accurate system analysis of unknown malware without source code has become a current research focus. Therefore, research on malware detection and defense technologies in dynamic files is of great significance for preventing fileless malware attacks, ensuring the secure operation of computer systems, and further improving network security protection capabilities.

[0004] Most newly generated malware is an improvement on existing malware. Mutated malware often incorporates features of multiple existing malware variants. Therefore, signature-based detection methods become increasingly ineffective against the large number of mutated malware variants. In contrast, deep learning-based malware detection methods demonstrate excellent performance against mutated malware. Deep learning can continuously update weights through data learning to learn the key features of malware. Even when faced with incomplete malware samples in memory and mutated malware, it can extract useful information and detect malware.

[0005] However, the inventors discovered that existing deep learning-based malware detection methods suffer from the following problems: First, in terms of sample acquisition, most methods do not check whether malicious behavior has been loaded into memory when extracting malicious files from memory, thus capturing samples without malicious behavior and reducing the authenticity of the data samples. Second, single learning models have poor performance in malware detection, failing to simultaneously achieve accurate feature extraction and close correlation, resulting in low accuracy. Furthermore, existing methods are mostly designed for ordinary executable files, and cannot achieve good detection results for attacks involving fileless malware. Summary of the Invention

[0006] To address the shortcomings of existing technologies, the present invention aims to provide a malicious code detection method and system based on memory forensics and deep learning. By creating benign and malicious memory datasets through memory forensics, the realism of model training is improved. Furthermore, by fusing two different models through deep learning, accurate detection of multiple categories of malicious code is achieved.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solution: The first aspect of this invention provides a malicious code detection method based on memory forensics and deep learning, comprising the following steps: Collect static executable files and process them to obtain a benign sample set and a real malicious sample set; The benign sample set and the real malicious sample set are preprocessed, and the preprocessed dataset is divided into training set and test set; Models were built using convolutional neural networks and graph neural networks respectively, and deep learning was used to fuse the models. The fused model was trained and adjusted using test sets and training sets to obtain a malicious code detection model. Input the data to be tested into the malware detection model and output the detection and classification results.

[0008] A second aspect of this invention provides a malicious code detection system based on memory forensics and deep learning, comprising: The data collection module is configured to collect static executable files and process them to obtain a benign sample set and a real malicious sample set. The sample processing module is configured to preprocess the benign sample set and the real malicious sample set, and divide the preprocessed dataset into a training set and a test set. The model building module is configured to build models using convolutional neural networks and graph neural networks respectively, and to fuse the models using deep learning. The fused model is then trained and adjusted using test and training sets to obtain a malicious code detection model. The malicious detection module is configured to input the data to be tested into the malicious code detection model and output the detection classification results.

[0009] The above one or more technical solutions have the following beneficial effects: (1) Compared with existing publicly available malicious code sample datasets, this invention modifies part of its source code through the Volatility memory analysis method, adds the function of printing file names, can clearly extract EXE files and DLL files, view file names, and verify the authenticity of the memory dataset through the Virus Total API, thus avoiding the capture of samples without malicious behavior when capturing running malicious programs because the malicious program is not loaded into memory, ensuring the authenticity of malicious samples. Most people do not check whether malicious behavior is loaded into memory when extracting malicious files from memory, thus reducing the authenticity of data samples. This invention detects this part, thereby improving the authenticity of model training.

[0010] Furthermore, this invention transforms the dataset into bytecode and operation behavior sequences, which can be more adapted to CNN-Attention-based models and GNN-LSTM-Attention-based models, respectively.

[0011] (2) Compared with existing deep learning and machine learning models, this invention analyzes the advantages and disadvantages of CNN and GNN as well as the characteristics of the data. CNN lacks long-term attention and has poor correlation effect for data with sequential correlation. GNN-LSTM-Attention is used to make up for the overall correlation of CNN-Attention model training. In GNN-LSTM-Attention, the main sequence nodes are selected as graph nodes when the model of this invention is constructed, which greatly simplifies the local correlation of the sequence. CNN is used to make up for the deficiency of local correlation of data, achieving a complementary effect to improve the performance of malicious code detection.

[0012] (3) Compared with existing malicious code detection methods, this invention integrates bytecode and operation behavior sequences through a deep learning framework to extract more useful features. The method of this invention can not only detect ordinary executable files, but also has good detection performance for "fileless" attacks.

[0013] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0014] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0015] Figure 1 This is a flowchart of the malicious code detection method based on memory forensics and deep learning in Embodiment 1 of the present invention; Figure 2 This is a structural diagram of the deep learning model built in Embodiment 1 of the present invention; Figure 3 This is an example diagram illustrating the conversion of bytecode into a grayscale image in Embodiment 1 of the present invention; Figure 4 This is an example diagram of the constructor dependency graph for the sequence of operation behaviors in Embodiment 1 of the present invention; Figure 5 This is an example diagram illustrating the simplified representation of functional dependencies using letters in Embodiment 1 of the present invention; Figure 6 This is a screenshot of the page layout for constructing a test document in Embodiment 1 of the present invention; Figure 7 This is a screenshot of the virtual system interface after the ransomware virus runs in Embodiment 1 of the present invention. Figure 8 This is a screenshot of the encrypted document interface in Embodiment 1 of the present invention; Figure 9 This is an example image of the malicious code detection results in Embodiment 1 of the present invention. Detailed Implementation

[0016] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0017] Terminology Explanation: Snapshot: A hardware programming technique for fast memory access.

[0018] Convolutional Neural Networks (CNNs) are a type of feedforward neural network that incorporates convolutional computations and has a deep structure.

[0019] Graph Neural Networks (GNNs) are a general term for algorithms that use neural networks to learn graph-structured data, extract and discover features and patterns in graph-structured data, and meet the needs of graph learning tasks such as clustering, classification, prediction, segmentation, and generation.

[0020] Long Short-Term Memory (LSTM) network: LSTM is a type of recurrent neural network designed to address the long-term dependency problem inherent in general RNNs (recurrent neural networks). All RNNs have a chain-like structure of repeating neural network modules.

[0021] Histogram of Oriented Gradients (HOG): HOG features are feature descriptors used in computer vision and image processing for object detection. HOG features are constructed by calculating and statistically analyzing the gradient orientation histograms of local image regions.

[0022] Example 1: Embodiment 1 of this invention provides a malicious code detection method based on memory forensics and deep learning, such as... Figure 1 As shown, it includes the following steps: Step 1: Collect static files and process them to obtain a benign sample set and a real malicious sample set.

[0023] Step 1.1: Static files include malicious files collected from websites and benign files collected from Microsoft. This embodiment collects statically executable malicious files from the malicious sample websites VirusShare and TheZoo; and downloads commonly used software installation packages, such as music, video, office, and entertainment software installation packages, from the Microsoft website as benign files. These files are combined to form a dataset as data files to be executed.

[0024] Step 1.2: Run and dump the dataset composed of static files.

[0025] Step 1.2.1: Create isolated sandbox environments. Store malicious files collected from the website and benign files collected from Microsoft in two different sandbox environments and save snapshots.

[0026] Step 1.2.2: Subsequently, after running each static file in the dataset individually, the virtual system image is dumped to the local machine. In this embodiment, a snapshot is dumped every eight minutes, for a total of 15 dumps.

[0027] Step 1.2.3: After running a single file, restore the virtual system to the saved snapshot node, i.e., the sandbox environment before saving the snapshot; then run the next collected file and repeat the above process until all collected files have been executed.

[0028] In this embodiment, the dump is performed 15 times in order to capture as much malicious behavior as possible from the collected malicious samples. This is because malicious samples do not load all data into memory when they run, and multiple dumps can extract as many malicious behavior features as possible from the malicious files.

[0029] Step 1.3: Perform memory analysis, also known as dynamic file analysis, on the dumped dataset to obtain a benign sample set and a real malicious sample set. Static file analysis refers to analyzing files stored on the disk, while dynamic file analysis refers to dumping a memory image of an executable file during runtime and extracting the memory file for analysis. Detecting memory data, i.e., dynamic data rather than static data, can effectively detect "fileless" attacks and also has good detection performance for malicious files that cannot be detected in static files.

[0030] Step 1.3.1: Use the Volatility memory forensics plugin to perform memory analysis on the transferred snapshot file, i.e., the image file, and extract all the exe and DLL files in the memory snapshot file by modifying the plugin code.

[0031] During the extraction process, since the plugin cannot display the name of the state at the time of execution, this embodiment modifies the plugin source code by adding mod_name[:-4] to the dump_file parameter in the source code . / volatility-master / volatility / plugins / dlldump.py. This allows the specific file name at runtime to be printed, facilitating file extraction.

[0032] Step 1.3.2: Filter the obtained .exe and .DLL files to obtain benign and malicious sample sets. Specifically, benign files, being clean files downloaded from the official Microsoft website, are directly used as the benign sample set. Malicious files need to be detected to see if they inject malicious behavior into memory at runtime. Using the VirusTotal API and common antivirus detection platforms, malicious .exe and DLL files are scanned, and samples that are found to be malicious are saved as the real malicious sample set.

[0033] Step 2: Preprocess the benign sample set and the real malicious sample set, and divide the preprocessed dataset into training set and test set.

[0034] The preprocessing steps for the benign sample set and the real malicious sample set include: Step 2.1: Convert the benign sample set and the real malicious sample set into bytecode and operation behavior sequence; in this embodiment, the operation behavior sequence is compiled using the disassembler tool that comes with Visual Studio.

[0035] Step 2.2: For bytecode, construct grayscale images of equal size.

[0036] Step 2.2.1: Since the size of each sample set is not uniform, a uniform data size is required when training the neural network. Therefore, it is necessary to construct grayscale images of uniform size.

[0037] First, the bytecode sample set is converted into grayscale images with uniform width. After fixing the image width, it needs to be scaled to obtain grayscale images of uniform size. During image scaling, due to the inconsistent image sizes, some images need to be enlarged while others need to be reduced. Therefore, this embodiment uses the Lanczos interpolation algorithm for image scaling. Specifically, it takes a coordinate point and takes four points each above, below, left, and right of that point, then performs a weighted sum. Among all commonly used interpolation algorithms, the Lanczos interpolation algorithm has the widest range of points, making it more suitable for scaling images with significant size differences in this embodiment. As shown in the formula:

[0038] Where x, y represent the coordinate positions in the original grayscale image, S(x, y) represents the values ​​at the X and Y coordinate positions in the scaled image, L(x) is the reconstruction kernel of the filter, i, j represent the coordinate positions in the original grayscale image, and s ij This represents the grayscale value at that coordinate position in the original grayscale image, where 'a' represents the filter size parameter, which can also be considered a constant. The correspondence between X, Y and x, y is as follows:

[0039] Where w1 and w2 represent the width after scaling and the original width, respectively, and h1 and h2 represent the height after scaling and the original height, respectively.

[0040] The formula for L(x) is:

[0041] Since the images are of different sizes, we first choose to scale the images to a fixed value, such as 512*512 pixels. For grayscale images smaller than this pixel size, we enlarge them, and a=3 in the formula. For grayscale images larger than this pixel size, we shrink them, and a=2 in the formula.

[0042] Due to the sparsity of memory files, when viewing sample files with WinHex, many consecutive zeros appear in the memory files. This embodiment extracts Histogram of Oriented Gradients (HOG) features from the grayscale image converted from bytecode, simplifying the image by extracting useful information and discarding irrelevant information. Feature vectors are not useful for viewing grayscale images, but the feature vectors generated by these algorithms produce good results when input into neural network model classification algorithms.

[0043] The formulas for calculating the gradient g and direction θ of HOG are as follows:

[0044] in

[0045]

[0046] In the formula h x ,h y This represents the grayscale value at the x, y coordinates of the grayscale image. Then, a histogram of the grayscale image is calculated to obtain a grayscale image of the required size. In this embodiment, the angle is divided into 9 blocks to construct the histogram, and the gradient g is proportionally placed into each of the 9 blocks. These 9 blocks are treated as a single large block. The entire grayscale image is traversed to obtain a preliminary gradient orientation histogram. Then, the gradient orientation histogram is standardized using L2 normal form to reduce computational cost during training and prevent data overflow due to excessively large post-calculation data.

[0047] Step 2.3: Construct a graph from the sequence of operational behaviors to obtain a sequence that can be recognized by deep learning; Specifically, the decompiled sequence of operations is used as nodes in a graph, and the edges between nodes are set according to their chronological order. Then, a matrix of nodes and edges is constructed, and finally, it is encoded into a sequence that can be recognized by deep learning.

[0048] Step 2.3.1: First, construct the function call graph: In this embodiment, the code decompiled into a sequence of operation behaviors forms a basic hierarchical graph structure. The operation behaviors are divided into two categories: one is composed of local functions, i.e., functions defined by the programmer. Since the disassembled function does not display the local function name, the assembled code will use `sub-_ + unique number` to replace the original function name. The other is composed of external functions, i.e., system call functions. This embodiment creates a function call graph based on the function boundaries and call relationships identified by the disassembler, as shown in the attached diagram. Figure 4 As shown in the first block diagram.

[0049] Step 2.3.2: Constructing the Function Dependency Graph: Since the order of function calls within the same level is unknown, this embodiment scans the assembly file to find the order of function calls within the same level, constructing further connections in the graph, thus constructing the function dependency graph. The function dependency graph is a directed graph G, with vertex set V={v1, v2, ..., vn}, representing functions of the malware, and edge set E={<vi, vj> |vi, vj ∈V} corresponds to the functional dependencies between malware execution functions. (See attached...) Figure 4 As shown in the second block diagram.

[0050] Step 2.3.3: Next, construct the function dependency subgraph: Inner functions cannot be used as features of the graph because each programmer defines function names differently, but they will all call the same outer function. Therefore, it is necessary to optimize function dependencies, eliminate inner functions, and thus obtain the final function dependency subgraph. (See attached image) Figure 4 As shown in the third block diagram.

[0051] Step 2.3.4: Final construction of graph encoding: Encoding the binary dependencies in a graph yields the final sequence code, which involves transforming the set of all edges V into Gencode = {0, 1, 2, 3, 4, ..., n}, as shown in Table 1. A binary dependency refers to the sequential relationship between two nodes in the graph.

[0052] Table 1. Graph Coding Table for Binary Dependencies

[0053] The samples are then converted into effective sequence codes that can be trained using deep learning, thus enabling training and testing. See Table 2 for details.

[0054] Table 2. Samples converted into valid sequence codes.

[0055] Step 2.4: Divide the grayscale image obtained in 2.2 and the sequence that can be recognized by deep learning obtained in 2.3 into training set and test set in an 8:2 ratio.

[0056] Step 3: Build models using convolutional neural networks and graph neural networks respectively, and fuse the models using deep learning. Train and adjust the fused model using the test set and training set to obtain the malicious code detection model.

[0057] Step 3.1: First, the grayscale image obtained in 2.2 and the sequence that can be recognized by deep learning obtained in 2.3 are respectively enlarged by the embedding layer. In this invention, a single data is transformed into a 60-dimensional spatial vector, which can have more training parameters during training. Through parameter updates, better training results can be achieved.

[0058] Step 3.2: Because CNNs possess translation invariance, a local feature in the data can be detected regardless of its location in the image, exhibiting strong local correlation but lacking overall correlation. Therefore, this embodiment designs a fusion model of Graph Neural Network-Long Short-Term Memory (LSTM)-Attention mechanism (GNN-LSTM-Attention). The constructed GNN-LSTM-Attention model is used for training to increase the overall correlation of the data. The CNN-Attention model has a three-layer architecture, with each layer consisting of convolution, pooling, and ReLU. A dropout layer is added between the first and second layers to prevent overfitting. Finally, three linear layers are stacked to construct the attention mechanism, which increases the influence of the main neurons after neural network training. In the fused GNN-LSTM-Attention, this embodiment uses two GCN layers and one LSTM layer, stacked with three linear layers to construct the attention mechanism.

[0059] The two outputs from the attention layer in section 3.2 are then fused together using softmax to achieve the purpose of detection and classification.

[0060] In this embodiment, the attention mechanism used is Scaled dot-product Attention:

[0061]

[0062] Where x1, x2, and x3 represent three linear layers, Q represents the query value in the attention mechanism parameters, K and V represent key and value, and y is the output neuron.

[0063] The steps for training and tuning the fused model using the test set and training set include: Step 3.3: Determine the classification metrics: For malware detection, this embodiment uses four classification evaluation metrics: accuracy, precision, F-measure, and recall. The F-measure indicates that a single metric can simultaneously reflect both accuracy and recall.

[0064]

[0065] Wherein, TP represents the number of samples that are predicted to be malicious among the real malicious samples; FP represents the number of real benign samples that are predicted to be malicious; TN represents the number of real benign samples that are predicted to be benign; and FN represents the real samples that are malicious and the predicted samples that are benign.

[0066] Step 3.4: Train and adjust the fused model using the test set and training set, select the model parameters with the highest classification index evaluation and save them to obtain the malicious code detection model.

[0067] Step 4: Input the data to be tested into the malware detection model and output the detection and classification results.

[0068] This invention discloses a malicious code detection method based on memory forensics and deep learning. In this embodiment, a benign and malicious memory dataset is created through memory forensics. The data is then preprocessed into grayscale images and operation behavior sequences. The grayscale images are extracted using HOG features and then fed into a CNN-Attention model. Because CNNs have translation invariance, any feature in the data can be detected regardless of its location in the image, exhibiting strong local correlation but lacking overall correlation. Therefore, GNN-LSTM-Attention is integrated. The constructed graph matrix is ​​input into the GNN-LSTM-Attention model for training, increasing the overall correlation of the data. The shallow features of the data are transformed into high-level semantics through neural network training, achieving accurate multi-class detection of malicious code. Finally, the training results are output, and the weight parameters of the trained model are saved for malicious code detection. To better understand the technical solution of this invention, the following specific implementation process is illustrated: 1. Collect static samples of malicious and benign files and run them in a sandbox: (1) The collected static benign samples and malicious samples are labeled A1 and A2 respectively. A virtual environment is created in the sandbox, and A1 and A2 are placed in two different virtual machines. A snapshot of the virtual machine is saved.

[0069] (2) Run the samples in A1 one by one in the virtual machine. After each sample is run, the memory image is dumped every eight minutes, for a total of fifteen dumps.

[0070] (3) Run the dump for each sample in A1 in the manner described in (2) until all samples in A1 have been run. Record the dumped memory image file as B1.

[0071] (4) Run each sample in A2 in a virtual machine. After running each sample, dump the memory image every eight minutes, for a total of fifteen dumps. After the dump is complete, restore the virtual machine state to the node state of the snapshot in (1). Avoid interference from other malicious samples.

[0072] (5) Run the dump for each sample in A2 in the manner described in (4) until all samples in A2 have been run. Record the dumped memory image file as B2.

[0073] 2. Extract the DLL and EXE files from all the image files dumped in B1 and B2: (1) Extract all the exe and DLL files in B1 and B2 to the local disk using the memory forensics plugin, and label them as B3 and B4 respectively.

[0074] (2) Since the plugin has been modified to display file names, this embodiment retrieves all executed samples by file name in B3, as well as the DLL files called by the samples, denoted as D1.

[0075] (3) After extracting B4 in the manner described in (2), scan the extracted file through the VirusTotal API interface and the antivirus platform, save the file containing malicious code to the disk to ensure that it is a real malicious sample, and record it as D2.

[0076] 3. Convert the sample sets in D1 and D2 into two different files: a bytecode file and an operation behavior sequence file. (1) Since the files after the plugin dump are binary files, make a copy of files D1 and D2, write a program to batch change their file extensions to .bytes, and record them as D3 and D4 as the bytecode of the sample.

[0077] (2) Use a disassembler to decompile the D1 and D2 files into a sequence of operation behaviors, and write a program to extract the operation behavior instructions, which are denoted as D5 and D6.

[0078] IV. Convert the bytecode file into a feature vector extracted using HOG: (1) Use Python to convert the bytecode in D3 and D4 into grayscale images of the same width, setting the width to 512. Due to the different file sizes, use the Lanczos interpolation algorithm to scale the images to the same size grayscale images, setting the image size to 512*512. Denote the converted grayscale images as D7 and D8.

[0079] (2) Convert the grayscale images D7 and D8 into feature vectors using the HOG algorithm, and denote them as E1 and E2 respectively.

[0080] V. Construct the graph encoding sequence from D5 and D6: (1) The function boundaries identified through disassembly are used as the hierarchical structure of the graph to construct a function call graph. The attached diagram shows only a portion of the function calls, for illustrative purposes only. The graph structures after the transformation of D5 and D6 are denoted as G1 and G2 respectively, as follows: Figure 4 As shown in the first block diagram.

[0081] (2) By scanning the assembly file, view the function dependencies between the same level, and construct the function dependency graph according to the order of scanning, denoted as G3, G4, etc. Figure 4 The second block diagram is shown.

[0082] (3) Eliminate nodes of the inner function, add the child nodes of the inner function to the parent node of the inner function, and construct a subgraph that depends on the inner function, denoted as G5 and G6. The node set and edge set of the graph are V={v1, v2, ..., vn} and E={<vi, vj> |vi, vj ∈V}. For example... Figure 4 The third block diagram is shown.

[0083] (4) Combined with the appendix Figure 5 As shown in Table 1, the set V of all edges for encoding the binary relations of the graph is transformed into Gencode={0, 1, 2, 3, 4, n}.

[0084] (6) All edge sets in G5 and G6 are encoded into deep learning effective sequence codes as shown in Table 2, and are denoted as E3 and E4.

[0085] 6. Add E1 and E2 to the deep learning part of CNN-Attention, and add E3 and E4 to the GNN-LSTM-Attention part for training: (1) E1 and E2 are single-channel two-dimensional feature vectors extracted by HOG. The embedding layer increases the dimension of the vectors, that is, each vector is represented by a 60-dimensional vector. These 60-dimensional vectors are used as the number of channels in the input neural network model, that is, the single channel is transformed into 60 channels. In the model of this embodiment, the kernel sizes of the three convolutional layers are 6, 7, and 8, respectively; the size of the three pooling layers is set to 10. The dropout layer parameter is set to 0.5. Since the input parameters of the flatten layer need to be calculated manually, the calculation formula is obtained after observation in this embodiment:

[0086] `falttenin` represents the input length of the fully connected layer, `samplelen` represents the input sample length, `maxpool_size` represents the size of the pooling layer, and `conv_channel` represents the output channel size of the last convolutional layer. Finally, three linear layers are stacked to construct the attention mechanism.

[0087] (2) E3 and E4 are also single-channel data. They are transformed into 60-channel data using embedding and trained through a network with two GCN layers and one LSTM layer. The input and output channels of the two GCNs are 60 and 40, and 40 and 60, respectively. Finally, three linear layers are stacked to construct an attention mechanism.

[0088] (3) Finally, (1) and (2) are fused using softmax to achieve the classification task.

[0089] 7. Through continuous model training and adjustment of the aspect ratio of grayscale images, the model is evaluated using classification metrics to find the best-performing state and save the trained model. This model is then used to complete the task of classifying and detecting malicious code.

[0090] In this embodiment, experiments were conducted to verify that the model of the present invention can detect "fileless" attacks. A "fileless" malware attack is a method of infiltrating a victim organization and executing code from memory without using malicious files or file fragments on the computer's disk, thereby hiding itself and its attack traces. Sending emails is also a form of "fileless" attack. In this embodiment, experiments were conducted using an email ransomware virus. Professional analysis determined that malicious code was injected into the cmd.exe process. By extracting cmd.exe from the process and cmd.exe from the disk, and inputting them into the model trained by the present invention, it was verified that the model of the present invention can detect malicious files that cannot be detected in static files.

[0091] The specific steps are as follows: 1. Build a 64-bit Windows 7 operating system in a VM16 virtual machine and connect it to the internet. Build test documentation is as follows: Figure 6 As shown.

[0092] 2. Send the ransomware "Vaccine Appointment Information Confirmation.docx.exe" to the virtual machine email address created in step 1. Since the ransomware was not downloaded, it cannot be detected on the virtual machine disk at this time.

[0093] 3. Click to open "Vaccine Appointment Information Confirmation.docx.exe" in the email. The system desktop will then change as shown below. Figure 7The interface shown illustrates how the ransomware encrypts the test document constructed in this embodiment, as follows: Figure 8 As shown. A memory image showing the current state of the dump.

[0094] 4. By analyzing registry information and comparing newly added and deleted files, the ransomware process was discovered. By running Process Explorer to view process status information, a suspicious process, cmd.exe, was identified. The cmd.exe file located in the virtual machine disk directory C:\Windows\System32 was saved to the folder to be detected and named 1.bytes. In this example, the cmd.exe process was dumped using Volatility and named 2.bytes, revealing a crucial piece of information that identified the file type encrypted by the ransomware.

[0095] 5. Preprocess files 1.bytes and 2.bytes using the method described in step 2, then use the model saved in step 3 to make predictions. The prediction results are as follows: Figure 9 As shown, cmd.exe, which contained ransomware, was found to contain malicious code, while no malicious code was found in the static files.

[0096] The above steps verify that the present invention has good detection performance against "fileless" attacks.

[0097] Example 2: Embodiment 2 of the present invention provides a malicious code detection system based on memory forensics and deep learning, comprising: The data collection module is configured to collect static executable files and process them to obtain a benign sample set and a real malicious sample set. The sample processing module is configured to preprocess the benign sample set and the real malicious sample set, and divide the preprocessed dataset into a training set and a test set. The model building module is configured to build models using convolutional neural networks and graph neural networks respectively, and to fuse the models using deep learning. The fused model is then trained and adjusted using test and training sets to obtain a malicious code detection model. The malicious detection module is configured to input the data to be tested into the malicious code detection model and output the detection classification results.

[0098] The steps and methods involved in the above embodiment two correspond to those in embodiment one. For specific implementation details, please refer to the relevant description section of embodiment one.

[0099] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0100] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A method for malicious code detection based on memory forensics and deep learning, characterized in that, Includes the following steps: Collect static executable files and process them to obtain a benign sample set and a real malicious sample set; Run the static executable file in a sandbox, dump the memory image, and use a memory forensics plugin to extract the exe and DLL files in memory; The exe and DLL files extracted from benign static executable files are used as a benign sample set; Using the VirusTotal API interface and commonly used antivirus detection platforms, malicious exe and DLL files are scanned and extracted. Samples that are found to be malicious are saved as a set of real malicious samples. The preprocessing steps for the benign sample set and the real malicious sample set include: Transform benign sample sets and real malicious sample sets into bytecode and operation behavior sequences; For bytecode, construct grayscale images of equal size; The process of constructing a graph from the sequence of operational actions yields a sequence that can be recognized by deep learning. Specific steps include: Function boundaries and call relationships identified through disassembly; constructor call graph. Function boundaries identified through disassembly are used as the hierarchical structure of the graph; By scanning the assembly file, the order of function calls at the same level is found, and further connections are constructed in the graph, thus constructing a function dependency graph; Optimize functional dependencies and eliminate inner functions to obtain the final functional dependency subgraph; The binary dependencies of the graph are encoded to obtain the final sequence encoding of the graph; The obtained grayscale images and the sequences that can be recognized by deep learning are divided into training and test sets; Models were built using convolutional neural networks and graph neural networks respectively, and deep learning was used to fuse the models. The fused model was trained and adjusted using test sets and training sets to obtain a malicious code detection model. The convolutional neural network model is a CNN-Attention model; the graph neural network model is a fusion model based on graph neural network-long short-term memory network-attention mechanism: GNN-LSTM-Attention model, which includes two layers of graph convolutional network (GCN) and one layer of LSTM, and three linear layers are stacked to construct the attention mechanism; and the outputs of the two models are fused through softmax. The grayscale image is converted into a feature vector using the HOG algorithm; The feature vector of the grayscale image is added to the deep learning part of CNN-Attention, and the final sequence encoding of the image is added to the part of GNN-LSTM-Attention for training. Input the data to be tested into the malware detection model and output the detection and classification results. 2.The memory forensics and deep learning based malicious code detection method of claim 1, wherein, Static files include malicious files collected from websites and benign files collected by Microsoft. 3.The memory forensics and deep learning based malicious code detection method of claim 2, wherein, The specific steps for collecting and processing static files to obtain a benign sample set and a real malicious sample set are as follows: Run and dump datasets composed of static files; The dumped dataset was analyzed in memory to obtain a benign sample set and a real malicious sample set. 4.The memory forensics and deep learning based malicious code detection method of claim 3, wherein, The specific steps for running and dumping a dataset composed of static files are as follows: Create isolated sandbox environments, storing malicious files collected from the website and benign files collected by Microsoft in two separate sandbox environments, and save snapshots; Then, after running each static file in the dataset individually, the virtual system image is dumped to the local machine; After each file is executed, the virtual system is restored to the sandbox environment before the snapshot was saved; then the next collected file is run, until all collected files have been executed. 5.The memory forensics and deep learning based malicious code detection method of claim 4, wherein, The specific steps for performing memory analysis on the dumped dataset to obtain a benign sample set and a real malicious sample set are as follows: The memory forensics plugin is used to perform memory analysis on the transferred snapshot file, and all exe and DLL files in the memory snapshot file are extracted by modifying the plugin code; The obtained exe and DLL files are filtered to obtain benign and malicious sample sets. 6.The memory forensics and deep learning based malicious code detection method of claim 1, wherein, When constructing a graph from the sequence of operational behaviors to obtain a sequence that can be recognized by deep learning, the decompiled sequence of operational behaviors is used as the nodes of the graph, and the nodes are arranged in the order of their appearance as the set of edges between the nodes. Then, a matrix of nodes and edges of the graph is constructed, and finally encoded into a sequence that can be recognized by deep learning.

7. The memory forensics and deep learning based malicious code detection method of claim 1, wherein, The specific steps for training and adjusting the fused model using the test set and training set to obtain the malware detection model include: Determine the classification indicators; The fused model is trained and adjusted using the test set and training set. The model parameters with the highest classification index are selected and saved to obtain the malicious code detection model. 8.A malicious code detection system based on memory forensics and deep learning, characterized by, include: The data collection module is configured to collect static files and process them to obtain a benign sample set and a real malicious sample set. Run the static executable file in a sandbox, dump the memory image, and use a memory forensics plugin to extract the exe and DLL files in memory; The exe and DLL files extracted from benign static executable files are used as a benign sample set; malicious exe and DLL files are scanned using the VirusTotal API interface and commonly used antivirus detection platforms, and samples that are found to be malicious are saved as a real malicious sample set. The sample processing module is configured to preprocess benign sample sets and real malicious sample sets, including the following steps: Transform benign sample sets and real malicious sample sets into bytecode and operation behavior sequences; For bytecode, construct grayscale images of equal size; The process of constructing a graph from the sequence of operational actions yields a sequence that can be recognized by deep learning. Specific steps include: Function boundaries and call relationships identified through disassembly; constructor call graph. Function boundaries identified through disassembly are used as the hierarchical structure of the graph; By scanning the assembly file, the order of function calls at the same level is found, and further connections are constructed in the graph, thus constructing a function dependency graph; Optimize functional dependencies and eliminate inner functions to obtain the final functional dependency subgraph; The binary dependencies of the graph are encoded to obtain the final sequence encoding of the graph; The obtained grayscale images and the sequences that can be recognized by deep learning are divided into training and test sets; The model building module is configured to build models using convolutional neural networks and graph neural networks respectively, and then fuse these models using deep learning. The fused model is trained and adjusted using a test set and a training set to obtain a malicious code detection model. Specifically, the convolutional neural network model is a CNN-Attention model; the graph neural network model is a fusion model based on graph neural network-long short-term memory network-attention mechanism: GNN-LSTM-Attention model. The GNN-LSTM-Attention model includes two layers of graph convolutional networks (GCN) and one layer of LSTM, with three linear layers superimposed to construct the attention mechanism. The outputs of the two models are fused using softmax. The grayscale image is converted into a feature vector using the HOG algorithm. The feature vector converted from the grayscale image is added to the deep learning part of the CNN-Attention model, and the final sequence encoding of the graph is added to the GNN-LSTM-Attention part for training. The malicious detection module is configured to input the data to be tested into the malicious code detection model and output the detection classification results.

Images