Model construction method, malicious code identification method, storage medium and terminal
By combining static and dynamic features to construct a malicious code graph neural network, the problem of low recognition accuracy in existing technologies is solved, and more efficient malicious code detection is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- WUHAN ANTIY MOBILE SECURITY
- Filing Date
- 2022-12-29
- Publication Date
- 2026-06-02
AI Technical Summary
Existing technologies, when identifying malicious code, rely solely on static or dynamic features, which fail to fully utilize data, resulting in low accuracy and the ease with which obfuscation techniques can bypass detection.
By combining static and dynamic features, a malicious code graph neural network is established. Static features of samples are extracted as node edges, and dynamic features are extracted as node attributes to construct a sample relationship graph. The graph neural network model is then used for training to generate a malicious code identification model.
It improves the accuracy of malicious code identification, avoids errors caused by single feature identification, and enhances the ability to detect malicious code.
Smart Images
Figure CN115983342B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of malicious code analysis, and in particular to a model building method, a malicious code identification method, a storage medium, and a terminal. Background Technology
[0002] In recent years, the cybersecurity situation has become increasingly severe, with cybersecurity confrontations constantly escalating and new types of malware emerging in an endless stream, posing significant challenges to cybersecurity analysts. Massive malware analysis requires a foundation in big data technology, involving correlation analysis, clustering analysis, and lineage analysis of samples to connect known malware with unknown malware—essentially building malware graph neural networks for analysis.
[0003] Currently, a common approach to malicious application detection is through graph connections, forming a graph of applications with static features as edges. However, this method overlooks a crucial feature for application identification: the call relationships between application functions. With the emergence of new malicious applications, this method requires constant updating of the feature library, consuming significant manpower and time. Furthermore, modern obfuscation techniques can easily bypass such malicious detection methods by altering signature codes. Therefore, this method adds dynamic features—the call relationships between functions—to the static features, connecting the dynamic and static features to identify malicious applications. Summary of the Invention
[0004] This invention provides a model building method, a malicious code identification method, a storage medium, and a terminal, which combine static and dynamic features to establish a malicious code graph neural network, thereby improving the ability to identify malicious code.
[0005] In a first aspect, embodiments of the present invention provide a model construction method, including:
[0006] Extract static and dynamic features from several samples, treat the samples as nodes, use the static features as edges of related nodes, and use the dynamic features as attributes of related nodes to establish a sample relationship graph.
[0007] Each sample is labeled according to the malice of each sample in the sample relationship graph, and the label of each sample includes malicious and non-malicious;
[0008] The malicious code identification model is obtained by training the sample relationship graph and the label input graph neural network model of each sample in the sample relationship graph.
[0009] Secondly, embodiments of the present invention provide a method for identifying malicious code, including:
[0010] Extract the static and dynamic features of the target sample;
[0011] Based on the target sample, the static features, and the dynamic features, a malicious code identification model is used for detection to determine whether the target sample is malicious code; wherein, the malicious code identification model is obtained through the above-described model construction method.
[0012] Thirdly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described in the first or second aspect above.
[0013] Fourthly, embodiments of the present invention provide a terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in the first or second aspect above.
[0014] The model building method, malicious code identification method, storage medium, and terminal provided in this invention have the following technical effects:
[0015] This invention extracts static and dynamic features from several samples, treating these samples as nodes, static features as edges between related nodes, and dynamic features as attributes of related nodes to establish a sample relationship graph. Each sample is labeled according to its maliciousness in the graph, resulting in a label for each sample, which includes malicious and non-malicious attributes. The sample relationship graph and the labels of each sample in the graph are then input into a graph neural network model for training, resulting in a malware identification model. This malware identification model can detect single samples and identify whether they contain malicious code, avoiding errors caused by relying solely on static or dynamic features, thus improving the accuracy of malware identification.
[0016] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description
[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0018] Figure 1 A flowchart of a model construction method provided in an embodiment of the present invention;
[0019] Figure 2 A flowchart of a malicious code identification method provided in an embodiment of the present invention;
[0020] Figure 3 This is a schematic diagram of the structure of a model building device provided in an embodiment of the present invention;
[0021] Figure 4 This is a schematic diagram of the structure of a malicious code identification device provided in an embodiment of the present invention;
[0022] Figure 5 This is a block diagram of a terminal provided in an embodiment of the present invention. Detailed Implementation
[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0024] In the following description, when referring to the accompanying drawings, the same numbers in different drawings denote the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.
[0025] In the description of this invention, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Those skilled in the art will understand the specific meaning of these terms in this invention based on the specific circumstances.
[0026] In recent years, the cybersecurity situation has become increasingly severe, with cybersecurity confrontations constantly escalating and new types of malware emerging in endless streams, posing significant challenges to cybersecurity analysts. Massive malware analysis requires a foundation in big data technologies, involving correlation analysis, clustering analysis, and lineage analysis of samples to connect known malware with unknown malware—essentially building malware graph neural networks for analysis. Relying solely on static or dynamic features for malware identification not only fails to fully utilize data but may also hinder in-depth malware mining due to data gaps.
[0027] To address the aforementioned problems, this invention provides a model building method, a malicious code identification method, a storage medium, and a terminal. The following will describe in more detail the various steps of the model building method and the malicious code identification method in the embodiments of this invention, with reference to the accompanying drawings and examples.
[0028] Figure 1 This is a flowchart illustrating a model construction method provided in an embodiment of the present invention. Figure 1 As shown, the method described in this embodiment of the invention may include the following steps:
[0029] S101, extract the static and dynamic features of several samples, use the several samples as nodes, use the static features as edges of related nodes, and use the dynamic features as attributes of related nodes to establish a sample relationship graph.
[0030] Optionally, to construct a graph model, it is necessary to select multiple variables and obtain the relationships between the variables, then use the multiple variables as nodes and the relationships between the variables as edges to construct a relationship graph between the multiple variables.
[0031] In this embodiment of the invention, a sample relationship graph is constructed, that is, a graph showing the relationships between samples, where samples are variables in the graph. Therefore, it is first necessary to obtain a number of samples. Since this invention is for malicious code identification, the samples in this embodiment are code. These samples can be obtained through legitimate channels, and the number of samples obtained can be determined based on the actual situation. For example, considering that a larger number of samples can improve the accuracy of the model during training, a larger number of samples can be selected, such as millions or tens of millions of pieces of code. Conversely, when the number of codes is limited, only tens of thousands or hundreds of thousands of pieces of code can be selected as samples; no limitation is made here. After determining the number of samples, the purpose of establishing the sample relationship graph is to train the malicious code identification model, thereby identifying whether unknown code is malicious. Therefore, to ensure the accuracy of the malware identification model, the selection of samples must not only guarantee quantity but also variety. Since this invention identifies malware, the samples need to include both malicious and normal code. Malware is further divided into various families, such as Virus, Worm, Trojan, G-Ware, and Tool. Furthermore, the malware needs to cover a wide range of malicious behaviors, such as privacy theft, remote control, malicious billing, malicious propagation, data consumption, system damage, deception, and rogue behavior. Therefore, the malware in the samples must include multiple categories to ensure sufficient training for all malware types. Specific types can be freely chosen as needed and are not limited here.
[0032] Optionally, based on the above conditions, after selecting a number of samples, further obtain the static and dynamic features of the samples, and use the samples as nodes, the static features as edges of the relevant nodes, and the dynamic features as attributes of the relevant nodes to establish a sample relationship graph.
[0033] Optionally, when using several samples as nodes in a relationship graph, specific data is needed for mapping. Static features generally include basic information about the samples, so a specific piece of information from the static features can be selected as the mapping data. However, when mapping several samples to nodes in a relationship graph, each sample needs a unique identifier to distinguish it. Among the basic information of a sample, the sample hash can uniquely identify it. Therefore, the sample hash is selected as the mapping data to map several samples to nodes in the relationship graph. Thus, static features include sample hashes.
[0034] Optionally, after mapping each sample to a node in the relational graph through sample hashing, it is necessary to further utilize static features as edges of related nodes to connect the nodes. Therefore, static features may also include at least one of the following: file name, file size, file format, certificate signature, sub-package path, IP, domain, URL, email, and behavior name.
[0035] Optionally, sample hashes can uniquely identify samples, but they cannot be used to express sample characteristics or connect samples as edges. Therefore, filenames, file sizes, and file formats can be selected as static features to give users a basic understanding of the samples. For example, malicious code has standardized naming rules; the filename can indicate the type of malicious code, the target platform, etc. File size and format can reflect the storage and saving status of the samples. Furthermore, filenames, file sizes, and file formats can be used to link samples. When two samples have the same filename, it indicates a connection between them. Similarly, when two samples have the same file size or file format, it indicates a connection between them.
[0036] Optionally, each app must be certified before packaging and distribution to run, and since a sample is also an app to some extent, it also has its own corresponding certificate. The certificate contains a lot of information about the sample, some of which can be used to distinguish different certificates, identify the sample's developer, and link samples together. This includes certificate signature, certificate keyhash, certificate MD5, and certificate serial number. The certificate signature is obtained by the developer through digital signing, while the certificate keyhash, certificate MD5, and certificate serial number are generated using tools and are unique. Some large companies, for ease of management, will issue the same certificate to multiple samples. In this case, the certificates of these multiple samples contain the same information, and the developers are the same. However, some malicious developers, to evade supervision, will issue different certificates to each sample. In this case, the certificate keyhash, certificate MD5, and certificate serial number in these sample certificates may be different. Preferably, each sample needs to be digitally signed by the developer before distribution to obtain a certificate signature. The same developer may obtain the same certificate signature when digitally signing different samples. Therefore, the developer of a sample can be identified through certificate signature, and the relationship between samples can be established. When two samples have the same certificate signature, it means that they have the same developer. Therefore, the certificate signature of a sample can be selected as a static feature.
[0037] Optionally, during the execution of a sample, some sub-files may be generated, and these sub-files will be stored in the execution directory. The execution directories of the sub-files generated by different samples may be different. When the execution directories of the sub-files generated by two samples are the same, it indicates that there is some relationship between the two. Therefore, the sub-package path of the sample can be selected as a static feature.
[0038] Optionally, the sample code may contain information such as IP address, domain, URL, and email address as data feedback nodes or servers, representing the assets of the developer behind the sample and serving as important features for sample source tracing analysis. When two samples share any information in their IP address, domain, URL, or email address, it indicates that they may share the same developer. Therefore, the IP address, domain, URL, and email address contained in the samples are selected as static features.
[0039] Optionally, the samples may perform certain behaviors during operation, such as obtaining users' personal information, stealing user traffic, clicking on the app, etc. These behaviors have corresponding behavior names. Each sample will perform some fixed behaviors according to its program settings. Therefore, when two samples perform the same behavior, it indicates that there may be some connection between them. Thus, the behavior name of the sample can be selected as a static feature.
[0040] Optionally, the above-mentioned static features are selected based on analyst experience, focusing on key information. Other sample information can also be selected as static features. For example, API hash (the hash value of the API sequence in the sample); encryption algorithm (the encryption algorithm used by the sample); and sample package name (the name given to the sample when it was created). All of the above information can be used as static features of the sample, and this invention is not limited to these.
[0041] Optionally, all of the above information can be obtained by parsing the samples using a static engine. After obtaining the static features of the samples, they can be stored in the following way:
[0042]
[0043] Based on any of the above embodiments, after obtaining the static features of each sample, the static features are used as edges of related nodes to connect the sample nodes. The specific steps include:
[0044] If any two samples among the samples have the same static features, then it is determined that there is one or more edges between the nodes corresponding to the two samples, and the number of edges is determined by the number of samples with the same static features.
[0045] In this embodiment of the invention, after mapping several samples to nodes in a relational graph using sample hashing, the number of edges between any two samples is determined using static features. When any two samples have the same static features, there are one or more edges between them, and the number of edges is determined by the number of samples with the same static features.
[0046] Optionally, if two samples share one static feature, such as identical certificate signatures, then there is one edge between them. If two samples share two static features, such as identical certificate signatures and sub-package paths, then there are two edges between them. Similarly, all static features between any two samples can be compared, and the number of edges between them can be determined based on the number of identical static features. It should be noted that for each sample, only one of the static features (filename, file size, file format, and certificate signature) is present; therefore, if two samples share one of these static features, there is one edge between them. However, for other static features (sub-package path, IP address, domain, URL, email address, and action name), each sample may contain multiple features. For example, sample A may contain 3 sub-package paths, and sample B may contain 2. If sample A and sample B share at least one sub-package path, then sample A and sample B are considered to have the same sub-package path, and there is one edge between them. The same method can be used to determine the similarity of other static features.
[0047] Based on any of the above embodiments, after obtaining the static features of each sample and using the static features as edges of related nodes, the dynamic features of each sample are further obtained and used as attributes of related nodes. The specific steps include:
[0048] Extract the call relationships between functions in each sample, and construct a call relationship matrix for each sample based on the call relationships;
[0049] The calling relationship matrix of each sample is reduced in dimensionality to obtain the dynamic feature vector corresponding to each sample, and the dynamic feature vector is used as the attribute of the corresponding sample node.
[0050] In this embodiment of the invention, after connecting samples through static features, the call relationship between functions in the samples is also an important feature describing the samples. Therefore, the call relationship between functions in each sample is further extracted, and the dynamic features of each sample are obtained through the call relationship, which serve as the attributes of the corresponding node of the sample.
[0051] Optionally, after obtaining the call relationships for each sample, a call relationship matrix for the corresponding sample is constructed based on the call relationships. Each sample may contain multiple functions, and these functions may have call relationships with each other. For example, a sample may contain three functions A, B, and C, where there is a call relationship between A and B, and a call relationship between B and C. A value of 1 can be assigned to functions with existing call relationships, and a value of 0 can be assigned to functions without existing call relationships. The call relationships between A, B, and C can then be transformed into the following call relationship matrix:
[0052]
[0053] The function call relationships in each sample can be transformed into a corresponding call relationship matrix in the manner described above.
[0054] Optionally, after converting the function call relationships in each sample into a corresponding call relationship matrix, the call relationship matrix cannot directly describe the call relationship characteristics of the samples as an attribute, and it is also not convenient to compare the call relationships between two samples to determine similarity. Therefore, the call relationship matrix is further reduced in dimensionality, transforming it into a one-dimensional feature vector. For example, the call relationship matrix can be input into the pre-trained model of the GNN to obtain the corresponding embedding feature vector. The advantage of this method is that it can reduce the call relationship matrix to a one-dimensional feature vector while retaining the characteristics of the call relationship matrix. When two call relationship matrices are similar, the two embedding feature vectors obtained by this method are still similar. Of course, other methods can also be used to reduce the call relationship matrix to a one-dimensional feature vector, which is not limited here. By reducing the dimensionality of the call relationship matrix of each sample using a preset method, a dynamic feature vector corresponding to each sample is obtained, and the dynamic feature vector is used as an attribute of the corresponding sample node.
[0055] Based on any of the above embodiments, in S102, each sample is labeled according to the malice of each sample in the sample relationship graph to obtain a label for each sample, wherein the label includes malicious and non-malicious;
[0056] S103, train the neural network model of the sample relationship graph and the label input graph of each sample in the sample relationship graph to obtain the malicious code identification model.
[0057] In this embodiment of the invention, by using several samples as nodes, static features as edges of related nodes, and dynamic features as attributes of related nodes, a sample relationship graph is established. Based on this graph, a graph neural network model can be trained to obtain a malicious code identification model. However, the samples in the sample relationship graph include both normal and malicious code. When mapping samples to nodes in the relationship graph, sample hashes are used as mapping data. Therefore, if the sample relationship graph is input into the graph neural network model alone, the model cannot distinguish the maliciousness of each sample in the graph, i.e., whether it is normal or malicious code.
[0058] Optionally, before inputting the sample relationship graph into the neural network model, each sample is labeled according to its maliciousness in the sample relationship graph, resulting in a label for each sample. If the sample contains malicious code, it is labeled as malicious; if the sample contains normal code, it is labeled as non-malicious. To facilitate calculation, the labels can be further quantified by assigning values, such as assigning a value of 1 to a malicious label and a value of 0 to a non-malicious label.
[0059] Optionally, after obtaining the label of each sample in the sample relationship graph, the sample relationship graph and the label of each sample in the sample relationship graph are input into the graph neural network model for training to obtain the malicious code identification model. The specific steps include:
[0060] S103.1, Based on the static features of all samples, the sample relationship diagram is converted into one or more sample matrices, the number of sample matrices being determined by the number of static features;
[0061] S103.2, train the neural network model of the dynamic features of all samples, the one or more sample matrices, and the label input graph of each sample in the sample relationship graph to obtain the malicious code identification model.
[0062] In this embodiment of the invention, after establishing the sample relationship graph, the sample relationship graph is not quantified data and cannot be directly input into the graph neural network model for calculation. It is necessary to transform the sample relationship graph into specific data. Based on the static features of all samples, the sample relationship graph can be transformed into one or more sample matrices. The number of sample matrices is determined by the number of static features, where the number of static features is the number of static features used as edges.
[0063] Optionally, as described above, the static features used as edges in this invention include at least one of the following: filename, file size, file format, certificate signature, sub-package path, IP address, domain name, URL, email address, and behavior name. When a static feature contains one type of information, the transformed sample relationship graph has one sample matrix; when a static feature contains two types of information, the transformed sample relationship graph has two sample matrices, with each static feature corresponding to one sample matrix.
[0064] Optionally, when transforming the sample relationship graph into a sample matrix, the sample relationship graph contains several samples, and these samples may have mutual calling relationships for each static feature. For example, if the sample relationship graph contains three samples A, B, and C, and for the static feature of filename, there is an edge between A and B, and another edge between A and C, we can assign a value of 1 to the existence of an edge between two samples, and a value of 0 to the absence of an edge. The static feature of filename corresponding to A, B, and C can then be transformed into the following corresponding sample matrix:
[0065]
[0066] The relationship between each static feature of all samples in the sample relationship graph can be transformed into a corresponding sample matrix in the manner described above.
[0067] Optionally, after converting the sample relationship graph into one or more sample matrices, the dynamic features of each sample in the sample relationship graph, the aforementioned one or more sample matrices, and the label of each sample in the sample relationship graph are input into the graph neural network model for training to obtain the malicious code identification model. The graph neural network model used can be an existing neural network model such as Graph Convolutional Neural Network (GCN), GraphSage, and Graph Attention Network (GAT), or it can be another newly emerging graph neural network model suitable for this invention, which is not limited here. Preferably, during model training, to ensure the accuracy of the model, a portion of the data can be divided as a test set to test the model, and the model parameters can be continuously adjusted based on the test results until the optimal value is reached.
[0068] In summary, this invention provides a model construction method. By extracting static and dynamic features from several samples, and using these samples as nodes, static features as edges between related nodes, and dynamic features as attributes of related nodes, a sample relationship graph is established. Each sample is labeled according to its maliciousness in the sample relationship graph, resulting in a label for each sample, which includes malicious and non-malicious labels. The sample relationship graph and the labels of each sample in the graph are then input into a graph neural network model for training, resulting in a malicious code identification model. This malicious code identification model can detect single samples and identify whether they are malicious code, avoiding errors caused by relying solely on static or dynamic features, thus improving the accuracy of malicious code identification.
[0069] After constructing the malicious code identification model using the above method, the model can be used to detect a single sample and identify whether the single sample is malicious code. The following are embodiments of the malicious code identification method provided by this invention. Figure 2 This is a flowchart illustrating a malicious code identification method provided in an embodiment of the present invention. Figure 2 As shown, the method described in this embodiment of the invention may include the following steps:
[0070] S201, extract the static and dynamic features of the target sample;
[0071] S202, based on the target sample, the static features, and the dynamic features, a malicious code identification model is used to detect and determine whether the target sample is malicious code; wherein, the malicious code identification model is obtained according to the above model construction method.
[0072] In this embodiment of the invention, when it is necessary to detect a target sample, the static and dynamic features of the target sample are first extracted. Then, based on the target sample, its static and dynamic features, a malicious code identification model is used to detect whether the target sample is malicious code. The specific steps include:
[0073] S202.1, compare the target sample with the static features of all nodes in the sample relationship graph;
[0074] S202.2, if the target sample has the same static feature as any node in the sample relationship graph, then it is determined that there is one or more edges between the node corresponding to the target sample and any node, and the number of edges is determined by the number of nodes with the same static feature;
[0075] S202.3, based on one or more edges between the node corresponding to the target sample and any node, update the sample relationship graph to obtain the target sample relationship graph; and update the sample matrix according to the target sample relationship graph to obtain the target sample matrix;
[0076] S202.4, Input the dynamic features and the target sample matrix into the malicious code identification model for detection.
[0077] Optionally, the static features of the target sample must first be compared with the static features of all nodes in the sample relationship graph in the above model construction method. If the target sample shares the same static feature as a node in the sample relationship graph, then it is determined that there is one or more edges between the node corresponding to the target sample and that node. The number of edges is determined by the number of nodes with the same static features. If the target sample and the node share one static feature, then there is one edge between them. If the target sample and the node share two static features, then there are two edges between them. The above method is used to determine whether there are edges connecting the target sample to all nodes in the sample relationship graph and the number of edges.
[0078] Optionally, after obtaining the number of edges between the target sample and all nodes in the sample relationship graph, the target sample is mapped to a node in the sample relationship graph using a target sample hash. Then, the target sample is connected to all nodes in the sample relationship graph using the number of edges between them, resulting in the target sample relationship graph. The sample matrix is then updated based on the target sample relationship graph by adding the node corresponding to the target sample and its edges to nodes corresponding to other samples in one or more sample matrices from the model construction method described above, resulting in one or more target sample matrices.
[0079] Optionally, after converting the target sample relationship graph into one or more target sample matrices, the dynamic features of the target samples and the aforementioned one or more target sample matrices are input into a malware detection model for detection to determine whether the target sample is malware. The malware detection model can determine the maliciousness of the target sample by combining the connection between the target sample and all sample edges in the sample relationship graph, as well as the dynamic feature vector of the target sample and the dynamic feature vectors of all samples in the sample relationship graph. If the target sample has many edges connected to samples labeled as malicious in the sample relationship graph, and its dynamic features are more similar, the probability that the target sample is malware is higher. The malware detection model can determine the maliciousness of the target sample by combining the connection between the target sample and all sample edges in the sample relationship graph, as well as the similarity between the dynamic feature vector of the target sample and the dynamic feature vectors of all samples in the sample relationship graph.
[0080] In summary, the embodiments of the present invention provide a malicious code identification method. Based on the static and dynamic features of the target sample, the malicious code identification model can be used to detect the target sample and identify whether the target sample is malicious code. This avoids the errors caused by identifying malicious code only through static features or only through dynamic features, and improves the accuracy of malicious code identification.
[0081] The following are embodiments of the apparatus of the present invention, which can be used to execute embodiments of the method of the present invention. For details not disclosed in the embodiments of the apparatus of the present invention, please refer to the embodiments of the method of the present invention.
[0082] Please see Figure 3 This is a schematic diagram of a model building device provided in an embodiment of the present invention.
[0083] The model building device 300 in this embodiment of the invention includes: a sample relationship graph construction module 301, a label determination module 302, and a model building module 303.
[0084] The sample relationship graph construction module is used to extract the static and dynamic features of several samples, use the samples as nodes, use the static features as edges of related nodes, and use the dynamic features as attributes of related nodes to build a sample relationship graph.
[0085] The label determination module is used to label each sample according to the malice of each sample in the sample relationship graph, and obtain the label of each sample, wherein the label includes malicious and non-malicious;
[0086] The model building module is used to train the neural network model of the sample relationship graph and the label input graph of each sample in the sample relationship graph to obtain the malicious code identification model.
[0087] It should be noted that the model building apparatus provided in the above embodiments is only illustrated by the division of the above functional modules when executing the model building method. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the model building apparatus and the model building method embodiments provided in the above embodiments belong to the same concept. Therefore, for details not disclosed in the device embodiments of the present invention, please refer to the above embodiments of the model building method of the present invention, which will not be repeated here.
[0088] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.
[0089] Please see Figure 4 This is a schematic diagram of the structure of a malicious code identification device provided in an embodiment of the present invention.
[0090] The malicious code identification device 400 in this embodiment of the invention includes: a data extraction module 401 and a detection module 402.
[0091] The data extraction module is used to extract the static and dynamic features of the target sample;
[0092] The detection module is used to detect, based on the target sample, the static features, and the dynamic features, using a malicious code identification model to determine whether the target sample is malicious code; wherein, the malicious code identification model is obtained according to the above model construction method.
[0093] It should be noted that the malicious code identification device provided in the above embodiments is only illustrated by the division of the above functional modules when executing the model construction method. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the malicious code identification device and the malicious code identification method embodiments provided in the above embodiments belong to the same concept. Therefore, for details not disclosed in the device embodiments of the present invention, please refer to the embodiments of the malicious code identification method of the present invention described above, which will not be repeated here.
[0094] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.
[0095] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of any of the methods described in the foregoing embodiments. The computer-readable storage medium may include, but is not limited to, any type of disk, including floppy disks, optical disks, DVDs, CD-ROMs, microdrives, as well as magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic cards or optical cards, nanosystems (including molecular memory ICs), or any type of medium or device suitable for storing instructions and / or data.
[0096] This invention also provides a terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the methods described above.
[0097] Figure 5 This is a block diagram of a terminal provided for an embodiment of the present invention. Please refer to [link / reference]. Figure 5 This invention provides a terminal 500, including a processor 501, a communication interface 502, a memory 503, and a communication bus 504. The processor 501, communication interface 502, and memory 503 communicate with each other via the communication bus 504. The processor 501 can call logical instructions in the memory 503 to execute the following method: extracting static and dynamic features of several samples; using the samples as nodes, the static features as edges of related nodes, and the dynamic features as attributes of related nodes to establish a sample relationship graph; labeling each sample according to the maliciousness of each sample in the sample relationship graph to obtain a label for each sample, the label including malicious and non-malicious; and training a graph neural network model by inputting the sample relationship graph and the labels of each sample in the sample relationship graph to obtain a malicious code recognition model.
[0098] Alternatively, the following method can be performed: extract static and dynamic features of the target sample; based on the target sample, the static features, and the dynamic features, use a malicious code identification model to detect and determine whether the target sample is malicious code; wherein, the malicious code identification model is obtained according to the above model construction method.
[0099] The terminal structure block diagram shown in the embodiments of the present invention does not constitute a limitation on the terminal 500. The terminal 500 may include more or fewer components than shown, or combine certain components, or use different component arrangements.
[0100] This invention discloses a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, which, when executed by a computer, enable the computer to perform the methods provided in the above-described method embodiments. For example, the methods may include: extracting static and dynamic features of several samples; using the samples as nodes, the static features as edges of related nodes, and the dynamic features as attributes of related nodes to establish a sample relationship graph; labeling each sample according to the maliciousness of each sample in the sample relationship graph to obtain a label for each sample, where the label includes malicious and non-malicious; and inputting the sample relationship graph and the labels of each sample in the sample relationship graph into a graph neural network model for training to obtain a malicious code identification model. Alternatively, the methods may include: extracting static and dynamic features of a target sample; and, based on the target sample, the static features, and the dynamic features, using the malicious code identification model to detect and determine whether the target sample is malicious code; wherein the malicious code identification model is obtained according to the above-described model construction method.
[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A model construction method, characterized in that, include: Extract static and dynamic features from several samples, treat the samples as nodes, use the static features as edges of related nodes, and use the dynamic features as attributes of related nodes to establish a sample relationship graph. Each sample is labeled according to the malice of each sample in the sample relationship graph, and the label of each sample includes malicious and non-malicious; The sample relationship graph and the label of each sample in the sample relationship graph are used to train a graph neural network model to obtain a malicious code identification model; The static features include the sample hash; The static features also include at least one of the following: filename, file size, file format, certificate signature, sub-package path, IP address, domain name, URL, email address, and behavior name; The step of using the static features as edges of related nodes includes: If any two samples among the given samples have the same static features, then it is determined that there is one or more edges between the nodes corresponding to the two samples, and the number of edges is determined by the number of samples with the same static features; The step of using the dynamic features as attributes of related nodes includes: Extract the call relationships between functions in each sample, and construct a call relationship matrix for each sample based on the call relationships; The calling relationship matrix of each sample is reduced in dimensionality to obtain the dynamic feature vector corresponding to each sample, and the dynamic feature vector is used as the attribute of the corresponding sample node.
2. The method according to claim 1, characterized in that, The step of training a malicious code identification model by inputting the sample relationship graph and the label input graph neural network model of each sample in the sample relationship graph includes: Based on the static features of all samples, the sample relationship graph is converted into one or more sample matrices, the number of which is determined by the number of static features. The malicious code identification model is obtained by training a neural network model with the dynamic features of all samples, the one or more sample matrices, and the label of each sample in the sample relationship graph.
3. A method for identifying malicious code, characterized in that, include: Extract the static and dynamic features of the target sample; Based on the target sample, the static features, and the dynamic features, a malicious code identification model is used for detection to determine whether the target sample is malicious code; wherein, the malicious code identification model is obtained according to the method described in claim 1 or 2.
4. The method according to claim 3, characterized in that, The detection based on the target sample, the static features, and the dynamic features, using a malicious code identification model, includes: The target sample is compared with the static features of all nodes in the sample relationship graph; If the target sample has the same static feature as any node in the sample relationship graph, then it is determined that there is one or more edges between the node corresponding to the target sample and any node, and the number of edges is determined by the number of nodes with the same static feature. Based on one or more edges between the node corresponding to the target sample and any node, update the sample relationship graph to obtain the target sample relationship graph; and update the sample matrix according to the target sample relationship graph to obtain the target sample matrix; The dynamic features and the target sample matrix are input into the malicious code identification model for detection.
5. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in claim 1 or 2, or the method as described in claim 3 or 4.
6. A terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in claim 1 or 2, or the method as described in claim 3 or 4.