A method and system for detecting malicious program packers based on multidimensional weighting

Abstract

This invention relates to a multi-dimensional weighted method and system for detecting malicious program packers, belonging to the field of information security technology. This invention analyzes programs from three dimensions: file format, data disorder, and data content, providing a comprehensive comparison between packed and ordinary programs. It effectively combats the disguise of packed programs and solves the problem of low stability in single-angle feature detection. Features are quantified, allowing them to directly participate in mathematical calculations. Probabilistic formulas are used to standardize the features, giving the calculation results probabilistic meaning. The entropy weight method effectively avoids the influence of subjective factors on the weights of each feature, ensuring the objectivity of the detection system. Judgment through weight calculation eliminates the time and maintenance costs of feature matching and feature databases, optimizing the performance of the detection system.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a method and system for detecting malicious program packing based on multi-dimensional weighting. Background Technology

[0002] Malicious program detection effectively distinguishes between malicious and harmless programs, serving as a crucial means of maintaining cyberspace security. A typical malicious program detection system comprises three basic modules: feature extraction, feature filtering, and feature recognition. Therefore, changes in features, misselection, and misjudgment directly impact the system's effectiveness. Malicious programs using packing techniques differ significantly from the original program in file data, making it nearly impossible for the detection system to extract the original program's static features. Differences in behavioral characteristics between packed programs and the original program can also cause biases in dynamic feature extraction, reducing detection accuracy. Packer features marked as malicious can easily lead the detection system to misclassify harmless programs as malicious, increasing the false positive rate. If it's possible to determine in advance whether a program is packed, the original program can be obtained through unpacking techniques before detection, effectively avoiding the impact of packing techniques on the detection system and helping it to more accurately identify malicious programs. According to existing research, over 80% of malicious programs use packing techniques. Therefore, performing packing checks on programs before malicious program detection is both important and necessary.

[0003] Currently, the detection of packed programs primarily relies on feature detection, using file format characteristics and file entropy values. Packed programs often have file formats different from ordinary programs, such as abnormal section names and abnormal IAT tables. However, to evade detection, some malware developers modify the file format of packed programs, disguising them as unpacked programs. Traditional packing techniques encrypt and compress the original program data, making the data in packed programs more random and possessing a higher entropy value. However, with the development of packing techniques, file entropy values ​​alone are insufficient to accurately distinguish between packed and unpacked programs. Although previous detection methods used a variety of features, most were from the same analytical perspective, focusing on different feature points of the same type. A single perspective can severely influence detection results due to the influence of packing techniques. Furthermore, none of these methods incorporated the important feature of strings, yet based on past analytical experience, the string characteristics of packed and unpacked programs differ significantly. Therefore, a more comprehensive and multi-faceted feature set is needed for packing detection.

[0004] Most current systems for detecting packed programs include a program feature recognition module, which determines whether a program is packed based on the degree of feature matching. This module requires maintaining a feature database, and as the system is used over time, the maintenance costs of storing and updating the feature database increase significantly. Furthermore, this module is time-consuming. Therefore, a more direct and simpler method is needed to determine whether a program is packed. Summary of the Invention

[0005] (a) Technical problems to be solved

[0006] The technical problem to be solved by this invention is: how to stably, efficiently and accurately identify packed programs before malware detection.

[0007] (II) Technical Solution

[0008] To address the aforementioned technical problems, this invention provides a malicious program packing detection method based on multi-dimensional weighting, comprising the following steps:

[0009] The first step is to extract static features from the executable program based on the PE file loading principle, extracting features from multiple dimensions of the program.

[0010] The second step is to design a corresponding quantization method for each feature, quantify the extracted features so that the quantized features can be directly used for numerical calculations, and further standardize the quantized feature values ​​so that they have the meaning of expressing probability.

[0011] The third step is to use a sufficient number of packed and unpacked program samples, and obtain the normalized feature values ​​of all samples using the methods in the first and second steps, and then use the entropy weight method to calculate the weights of various features.

[0012] The fourth step is to calculate the weighted average of the multi-dimensional feature values ​​of each sample to obtain the shelled feature value, and set the shelled threshold and the unshelled threshold based on the calculation results.

[0013] Fifth step: Based on the methods in the first and second steps, obtain the standardized feature values ​​of the program to be detected, use the entropy weight method to calculate the weight of each feature of the program to be detected, and combine the standardized feature values ​​and the corresponding weights to calculate the packing feature values ​​of the program to be detected. The packing status of the program is determined by comparing the values ​​with the two thresholds.

[0014] This invention also provides a malicious program packer detection system based on multi-dimensional weighting, including a feature extraction module, a feature standardization module, a weight calculation module, a threshold selection module, and a result output module; wherein,

[0015] The feature extraction module is used to perform static analysis on the program based on the PE file loading principle, extract program features and perform quantification processing. The extracted features include:

[0016] 1) File format characteristics: Number of imported functions, number of loaded DLL files, number of sections, number of non-standard sections, and number of executable sections in the IAT table;

[0017] 2) Data block entropy characteristics: mean entropy value of the data blocks, mean content of 0 in each block;

[0018] 3) String characteristics include: total number of strings, number of non-readable strings, and standard deviation of string length;

[0019] The feature normalization module is used to: first, take a sufficient number of program samples as input, extract their features through the feature extraction module, and calculate the mean and standard deviation of the features as parameters for the normal distribution formula; then, use the normal distribution formula to normalize the feature values ​​of all samples, and the processed feature values ​​range from [0,1], representing the probability of the feature appearing. Afterwards, when normalizing the features of the program to be detected, the mean and standard deviation parameters remain unchanged; for the i-th sample program, the feature value of its j-th feature is a. ij The normalized eigenvalue is p ij The characteristic mean is denoted as E. j The standard deviation of the eigenvalues ​​is denoted as σ. j Then the feature specification formula is:

[0020]

[0021] The weight calculation module is used to calculate the weight of a specific feature in a dimensional feature using the entropy weight method after obtaining all sample features using the feature extraction module and the feature standardization module. Then, it calculates the weight of each dimensional feature in the shell detection and finally outputs the weight value of each dimensional feature, i.e., the weight.

[0022] The threshold selection module first calculates the shell feature value for each sample according to the shell feature value calculation formula, then selects the minimum shell feature value of the shelled program sample as the shell threshold, and selects the maximum shell feature value of the unshelled program sample as the unshelled threshold; the three-dimensional features of the i-th sample are denoted as w. 1i w 2i w 3i Their weights are Q1, Q2, and Q3, respectively, and the shelled eigenvalue is denoted as z. i The calculation formula is as follows:

[0023] z i =Q1×w 1i +Q2×w 2i +Q3×w3i

[0024] Ideally, the packing threshold should be greater than the packing feature value of all unpacked program samples and less than the packing feature value of packed program samples; the unpacking threshold should be less than the packing feature value of packed program samples and greater than the packing feature value of unpacked program samples.

[0025] The result output module is used to make a final judgment on whether the program to be detected is packed. It takes the feature value of the program to be detected obtained by the feature extraction module and the feature standardization module as input, calculates its packing feature value as the packing probability according to the packing feature value calculation formula, and compares it with a threshold. If it exceeds the packing threshold, it is determined to be a packed program. If it is lower than the unpacked threshold, it is determined to be an unpacked program. If it is between the two thresholds, it is determined to be an unknown program that is difficult to judge. Finally, it outputs a tuple describing the packing situation.

[0026] (III) Beneficial Effects

[0027] This invention provides a multi-dimensional weighted method and system for detecting malicious program packers. It analyzes programs from three dimensions: file format, data disorder, and data content, providing a comprehensive comparison between packed and ordinary programs. This effectively combats the disguise of packed programs and solves the problem of low stability in single-angle feature detection. Features are quantified, allowing them to directly participate in mathematical calculations. Probabilistic formulas are used to standardize the features, giving the calculation results probabilistic meaning. The entropy weight method effectively avoids the influence of subjective factors on the weights of each feature, ensuring the objectivity of the detection system. Judging by weight calculation eliminates the time and maintenance costs of feature matching and feature databases, optimizing the performance of the detection system. Attached Figure Description

[0028] Figure 1 A diagram illustrating the application model of the malicious program packing detection method and system based on multidimensional weighting provided by this invention;

[0029] Figure 2 A framework diagram of a malicious program packer detection method and system based on multidimensional weighting provided by this invention;

[0030] Figure 3 The flowchart for detecting whether an unknown program is packed or not is provided in the method and system of this invention. Detailed Implementation

[0031] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0032] Single-perspective features tend to be biased when evaluating programs, resulting in low robustness of detection systems and difficulty in reliably and accurately determining whether a program is packed. Existing detection methods lack quantification and standardization in feature processing, and the calculated values ​​are not meaningful. Furthermore, there is a lack of objective calculation methods for setting feature weights. In detection, feature recognition methods based on feature matching require the creation and maintenance of a feature library, incurring significant time and space costs, and feature matching itself suffers from low efficiency. This invention provides a multi-dimensional weighted malicious program packing detection method and system. It aims to analyze programs from multiple perspectives using various types of features, enabling the quantified and standardized values ​​of features to express probabilistic meaning. It allows for the objective calculation of the weight of each feature and the determination of packing through weighted feature value calculation. This allows for stable, efficient, and accurate identification of packed programs before malicious program detection. Its application model is as follows: Figure 1 As shown.

[0033] This invention provides a multi-dimensional weighted malicious program packing detection method and system, which can analyze programs from multiple dimensions, objectively calculate the weight of each dimension's features in packing detection, and directly determine whether a program is packed through weight calculation, with the calculation results having probabilistic significance. The basic idea is as follows: First, static analysis of the program is performed based on the PE file loading principle, extracting features from three dimensions of the program, and quantifying and standardizing the features using statistical methods and mathematical formulas; then, the above analysis is applied to a sufficient number of packed and unpacked program samples, and the entropy weight method is used to calculate the sample feature data to obtain feature weights, and the packing feature value of each sample program is calculated according to the feature value calculation formula; next, the packing feature values ​​of the samples are analyzed and processed to obtain packing thresholds and unpacking thresholds; finally, static analysis is performed on the program to be detected to obtain its packing feature values, and the detection result of the program's packing status is given by comparing the packing feature values ​​with the thresholds.

[0034] The malicious program packing detection method of the present invention includes the following steps:

[0035] The first step is to extract static features from the executable program based on the PE file loading principle, extracting features from multiple dimensions of the program.

[0036] The second step is to design a corresponding quantization method for each feature, quantify the extracted features so that the quantized features can be directly used for numerical calculations, and further standardize the quantized feature values ​​so that they have the meaning of expressing probability.

[0037] The third step is to use a sufficient number of packed and unpacked program samples, and obtain the normalized feature values ​​of all samples using the methods in the first and second steps, and then use the entropy weight method to calculate the weights of various features.

[0038] The fourth step is to calculate the weighted average of the multi-dimensional feature values ​​of each sample to obtain the shelled feature value, and set the shelled threshold and the unshelled threshold based on the calculation results.

[0039] Fifth step: Based on the methods in the first and second steps, obtain the standardized feature values ​​of the program to be detected, use the entropy weight method to calculate the weight of each feature of the program to be detected, and combine the standardized feature values ​​and the corresponding weights to calculate the packing feature values ​​of the program to be detected. The packing status of the program is determined by comparing the values ​​with the two thresholds.

[0040] Furthermore, the program's multi-dimensional features include: file format features, data block entropy features, and string features, which analyze the program from three dimensions: file format, data disorder, and data content.

[0041] Since all the features used are discrete, in the second step, based on statistical principles, the features are first quantified using quantities, ratios, etc., and then further standardized using the mathematical formula of the normal distribution, controlling the range of values ​​to [0,1], so that the feature value can represent the normal distribution probability of the feature.

[0042] The method of using entropy weight to calculate the weights of various features is as follows: each dimension of features contains a variety of more detailed sub-features. Therefore, the entropy weight method is first used to calculate the weights of the sub-features, and then the entropy weight method is used to calculate the weights of each dimension of features, thereby ensuring the objectivity of the weight calculation.

[0043] The packing feature value is a weighted average of the feature values ​​of each dimension. It is a value that measures the probability of a program being packed. Its value range is [0,1]. Its relationship with the program is as follows: the packing feature value of a packed program is closer to 1, and the packing feature value of an unpacked program is closer to 0.

[0044] The packed and unpacked thresholds are numerical criteria for determining whether a program is packed based on packed feature values. It is necessary to first calculate the packed feature values ​​of a sufficient number of packed and unpacked program samples, and then analyze and process the packed and unpacked feature values ​​of the packed and unpacked programs respectively to select an appropriate threshold.

[0045] When determining the program's packing status by comparing it with the two thresholds, the program packing status is described as a tuple containing the determination result and the packing probability. Programs with packing feature values ​​exceeding the packing threshold are determined to be packed programs, programs with packing feature values ​​below the unpacked threshold are determined to be unpacked programs, and programs between the two thresholds are determined to be unknown programs.

[0046] To achieve the above solution, this invention also provides a malicious program packing detection system including a feature extraction module, a feature standardization module, a weight calculation module, a threshold selection module, and a result output module, the system framework diagram of which is shown below. Figure 2 As shown, the system detection process is as follows: Figure 3 As shown below, the function of each module is described in detail.

[0047] (1) Feature extraction module

[0048] The feature extraction module performs static analysis on the program based on the PE file loading principle, extracts program features, and quantifies them. The extracted features include:

[0049] 1) File format characteristics: number of imported functions, number of loaded DLL files, number of sections, number of non-standard sections, and number of executable sections in the IAT table.

[0050] 2) Data block entropy characteristics (data disorder characteristics): the average entropy value of the data blocks and the average content of 0 data in each block. Each block consists of 512 bytes.

[0051] 3) String characteristics include: total number of strings, number of non-readable strings, and standard deviation of string length.

[0052] (2) Feature specification module

[0053] The feature normalization module first takes a sufficient number of program samples as input, extracts their features through the feature extraction module, and calculates the mean and standard deviation of these features as parameters for the normal distribution formula. Then, the normal distribution formula is used to normalize the feature values ​​of all samples, resulting in feature values ​​ranging from [0,1], representing the probability of feature occurrence. Subsequently, when normalizing the features of the program to be detected, the mean and standard deviation parameters remain unchanged. For the i-th sample program, the feature value of its j-th feature is a. ij The normalized eigenvalue is p ij The characteristic mean is denoted as E. j The standard deviation of the eigenvalues ​​is denoted as σ. j Then the feature specification formula is:

[0054]

[0055] (3) Weight Calculation Module

[0056] After obtaining all sample features using the feature extraction and feature standardization modules, the weight calculation module first uses the entropy weight method to calculate the weight of a specific feature in the dimensional features, then calculates the weight of each dimensional feature in the shell detection, and finally outputs the weight value of each dimensional feature, i.e., the weight.

[0057] (4) Threshold selection module

[0058] The threshold selection module first calculates the packed feature value for each sample according to the packed feature value calculation formula. Then, it selects the minimum packed feature value of the packed program sample as the packed threshold and the maximum packed feature value of the unpacked program sample as the unpacked threshold. Let w be the three-dimensional feature of the i-th sample. 1i w 2i w 3i Their weights are Q1, Q2, and Q3, respectively, and the shelled eigenvalue is denoted as z. i The calculation formula is as follows:

[0059] z i =Q1×w 1i +Q2×w 2i +Q3×w 3i

[0060] Ideally, the packing threshold should be greater than the packing feature value of all unpacked program samples, and less than the packing feature value of packed program samples; conversely, the unpacking threshold should be less than the packing feature value of packed program samples, and greater than the packing feature value of unpacked program samples. However, in practice, a very small number of samples may interfere with the threshold selection. These samples are removed using clustering methods. The execution steps are as follows:

[0061] S1. Classify the shelled feature values ​​into two categories: shelled and unshelled.

[0062] S2. Use clustering methods to classify the shelled feature values ​​once, and label the classification results;

[0063] S3. Compare the classification results with the original categories and remove data that do not match the categories;

[0064] S4. Select a threshold. If the ideal situation is achieved, the process ends; otherwise, return to step S2.

[0065] (5) Result Output Module

[0066] The output module is responsible for making the final judgment on whether the program to be detected is packed. It takes the feature values ​​of the program to be detected obtained from the feature extraction and feature standardization modules as input, calculates the packed feature value as the packing probability according to the packing feature value calculation formula, and compares it with a threshold. If it exceeds the packing threshold, it is determined to be a packed program; if it is below the unpacked threshold, it is determined to be an unpacked program; if it is between the two thresholds, it is determined to be an unknown program that is difficult to judge. Finally, it outputs a tuple describing the packing situation. The judgment result is denoted as R. program If the program to be tested is denoted as Program, then its packing status output will be:

[0067] (R program ,Program).

[0068] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for detecting malicious program packers based on multi-dimensional weighting, characterized in that, Includes the following steps: The first step is to extract static features from the executable program based on the PE file loading principle, extracting features from multiple dimensions of the program. These features include the program's file format features, data block entropy features, and string features, with each dimension containing a variety of more detailed sub-features. The second step is to design a corresponding quantization method for each feature, quantify the extracted features so that the quantized features can be directly used for numerical calculations, and further standardize the quantized feature values ​​so that they have the meaning of expressing probability. The third step involves using a sufficient number of packed and unpacked program samples, and employing the methods from the first and second steps to obtain the normalized features of all samples. Then, the entropy weight method is used to calculate the weights of various features. Specifically, the entropy weight method is used to calculate the weight of each feature within a dimensional feature, then the weight of each dimensional feature in packing detection is calculated, and finally, the weight values ​​of each dimensional feature are output. The fourth step is to calculate the weighted average of the multi-dimensional feature values ​​of each sample to obtain the shelled feature value, and set the shelled threshold and the unshelled threshold based on the calculation results. Fifth step: Based on the methods in the first and second steps, obtain the standardized feature values ​​of the program to be detected, use the entropy weight method to calculate the weight of each feature of the program to be detected, and combine the standardized feature values ​​and the corresponding weights to calculate the packing feature values ​​of the program to be detected. The packing status of the program is determined by comparing the values ​​with the two thresholds.

2. The method as described in claim 1, characterized in that, In the second step, based on statistical principles, the feature is first quantified using quantity and ratio, and then further standardized using the mathematical formula of normal distribution, controlling the value range to [0,1] so that the feature value can represent the normal distribution probability of the feature.

3. The method as described in claim 1, characterized in that, The packing feature value is a weighted average of the feature values ​​of each dimension. It is a value that measures the probability of a program being packed. Its value range is [0,1]. Its relationship with the program is as follows: the packing feature value of a packed program is closer to 1, and the packing feature value of an unpacked program is closer to 0.

4. The method as described in claim 3, characterized in that, The packed and unpacked thresholds are numerical criteria for determining whether a program is packed based on packed feature values. It is necessary to first calculate the packed feature values ​​of a sufficient number of packed and unpacked program samples, and then analyze and process the packed and unpacked feature values ​​of the packed and unpacked programs respectively to select an appropriate threshold.

5. The method as described in claim 4, characterized in that, When determining the program's packing status by comparing it with the two thresholds, the program packing status is described as a tuple containing the determination result and the packing probability. Programs with packing feature values ​​exceeding the packing threshold are determined to be packed programs, programs with packing feature values ​​below the unpacked threshold are determined to be unpacked programs, and programs between the two thresholds are determined to be unknown programs.

6. A malicious program packer detection system based on multi-dimensional weighting, characterized in that, It includes a feature extraction module, a feature normalization module, a weight calculation module, a threshold selection module, and a result output module; among which, The feature extraction module is used to perform static analysis on the program based on the PE file loading principle, extracting features in three dimensions: file format features, data block entropy features, and string features, and then quantifying these features. The specific features in these three dimensions are as follows: 1) File format characteristics: Number of imported functions, number of loaded DLL files, number of sections, number of non-standard sections, and number of executable sections in the IAT table; 2) Data block entropy characteristics: mean entropy value of the data blocks, mean content of 0 in each block; 3) String characteristics include: total number of strings, number of non-readable strings, and standard deviation of string length; The feature normalization module is used to: first, take a sufficient number of program samples as input, extract their features through the feature extraction module, and calculate the mean and standard deviation of the features as parameters for the normal distribution formula; then, use the normal distribution formula to normalize the feature values ​​of all samples, and the processed feature values ​​range from [0,1], representing the probability of the feature appearing. Afterwards, when normalizing the features of the program to be detected, the mean and standard deviation parameters remain unchanged; for the i-th sample program, the feature value of its j-th feature is a. ij The normalized eigenvalue is p ij The characteristic mean is denoted as E. j The standard deviation of the eigenvalues ​​is denoted as σ. j Then the feature specification formula is: The weight calculation module is used to calculate the weight of a specific feature in a dimensional feature using the entropy weight method after obtaining all sample features using the feature extraction module and the feature standardization module. Then, it calculates the weight of each dimensional feature in the shell detection and finally outputs the weight value of each dimensional feature, i.e., the weight. The threshold selection module first calculates the shell feature value for each sample according to the shell feature value calculation formula, then selects the minimum shell feature value of the shelled program sample as the shell threshold, and selects the maximum shell feature value of the unshelled program sample as the unshelled threshold; the three-dimensional features of the i-th sample are denoted as w. 1i w 2i w 3i Their weights are Q1, Q2, and Q3, respectively, and the shelled eigenvalue is denoted as z. i The calculation formula is as follows: With i =Q1×w 1i +Q2×w 2i +Q3×w 3i Ideally, the packing threshold should be greater than the packing feature value of all unpacked program samples and less than the packing feature value of packed program samples; the unpacking threshold should be less than the packing feature value of packed program samples and greater than the packing feature value of unpacked program samples. The result output module is used to make a final judgment on whether the program to be detected is packed. It takes the feature value of the program to be detected obtained by the feature extraction module and the feature standardization module as input, calculates its packing feature value as the packing probability according to the packing feature value calculation formula, and compares it with a threshold. If it exceeds the packing threshold, it is determined to be a packed program. If it is lower than the unpacked threshold, it is determined to be an unpacked program. If it is between the two thresholds, it is determined to be an unknown program that is difficult to judge. Finally, it outputs a tuple describing the packing situation.

7. The system as described in claim 6, characterized in that, The threshold selection module, when performing threshold selection, also uses clustering to remove samples that interfere with the threshold selection. The execution steps are as follows: S1. Classify the shelled feature values ​​into two categories: shelled and unshelled. S2. Use clustering methods to classify the shelled feature values ​​once, and label the classification results; S3. Compare the classification results with the original categories and remove data that do not match the categories; S4. Select a threshold. If the ideal situation is achieved, the process ends; otherwise, return to step S2.

8. The system as described in claim 6, characterized in that, The determination result is denoted as R. program If the program to be tested is denoted as Program, then the tuple describing the packing situation output by the result output module is: (R program ,Program).

Images