Malicious code detection method and device, storage medium and electronic equipment

Abstract

The application discloses a malicious code detection method and device, a storage medium and electronic equipment. First, the operation code sequence corresponding to the method is parsed; then, the hash value sequence corresponding to the operation code sequence is calculated; then, the feature value corresponding to the operation code sequence is calculated according to the hash value sequence; finally, the similarity between the feature value and the malicious feature value in the malicious feature library is calculated to determine whether the to-be-tested sample contains malicious code. Since the feature value in the present scheme can represent the feature of the operation code sequence and can reflect the similarity between the feature value of the operation code sequence and the malicious feature value in the malicious feature library, whether the to-be-tested sample contains malicious code can be determined according to the similarity. The malicious code detection method with strong change resistance can effectively detect malicious code that is maliciously changed, reduces the number of feature rules in the malicious feature library, improves the heuristic of malicious detection, and brings convenience to technicians in the related field.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a method, apparatus, storage medium, and electronic device for detecting malicious code. Background Technology

[0002] With the development of the Internet and the popularization of mobile smart electronic devices, a large amount of users' important information is stored in the network environment. The open network environment allows some malware developers to steal, tamper with, and other operations that endanger user information security through malicious code. Moreover, after being encrypted and obfuscated, the malicious code makes it difficult for security software to identify and distinguish the malicious behavior in the code, increasing the difficulty for security software to detect malicious code. Summary of the Invention

[0003] This application provides a method, apparatus, storage medium, and electronic device for detecting malicious code, which can solve the technical problem of weak resistance to change when detecting malicious code that has been maliciously modified in related technologies.

[0004] In a first aspect, embodiments of this application provide a method for detecting malicious code, the method comprising:

[0005] Based on the code segment content corresponding to the method in the sample to be tested, obtain the opcode sequence corresponding to the method;

[0006] The opcode byte string in the opcode sequence is grouped, and the hash value corresponding to each group in the opcode sequence is calculated to obtain the hash value sequence corresponding to the opcode sequence.

[0007] Calculate the feature value corresponding to the opcode sequence based on the hash value sequence;

[0008] Calculate the similarity between the feature value and the malicious feature value in the malicious feature library. If the similarity is higher than a preset similarity threshold, then the sample to be tested is determined to contain malicious code.

[0009] Optionally, grouping the opcode byte strings in the opcode sequence includes: traversing each opcode byte string in the opcode sequence, and performing concatenation and grouping operations on the opcode byte strings in the opcode sequence according to a preset grouping rule to obtain an opcode grouping list corresponding to the opcode sequence.

[0010] Optionally, each opcode byte string in the opcode sequence includes an opcode and / or opcode operation data; the step of concatenating and grouping the opcode byte strings in the opcode sequence according to a preset grouping rule includes: identifying whether the current opcode byte string includes opcode operation data, and performing concatenation and grouping operations based on whether the current opcode byte string includes opcode operation data.

[0011] Optionally, the step of concatenating and grouping based on whether the current opcode byte string includes opcode operation data includes: if the current opcode byte string does not include opcode operation data, then concatenating the current opcode byte string with the opcode byte string in the current group, thereby assigning the current opcode byte string to the current group; if the current opcode byte string includes opcode operation data, then concatenating the current opcode byte string with the opcode byte string in the current group, thereby assigning the current opcode byte string to the current group, and ending the current grouping.

[0012] Optionally, calculating the hash value corresponding to each group in the opcode sequence to obtain the hash value sequence corresponding to the opcode sequence includes: for each group in the opcode sequence, calculating the hash value corresponding to the concatenated opcode byte string in each group, thereby obtaining the hash value corresponding to each group; and obtaining the hash value sequence corresponding to the opcode sequence based on the hash values ​​corresponding to all groups in the opcode sequence.

[0013] Optionally, obtaining the hash value sequence corresponding to the opcode sequence based on the hash values ​​corresponding to all groups of the opcode sequence includes: deduplicating the hash values ​​based on the hash values ​​corresponding to all groups of the opcode sequence; and obtaining the hash value sequence corresponding to the opcode sequence based on all the deduplicated hash values.

[0014] Optionally, the step of calculating the feature value corresponding to the opcode sequence based on the hash value sequence includes: obtaining a weight array corresponding to the hash value sequence according to a first preset rule, wherein the number of elements in the weight array is the same as the number of bits in the hash value in the hash value sequence; and determining the feature value corresponding to the opcode sequence based on the weight array according to a second preset rule.

[0015] Optionally, obtaining the weight array corresponding to the hash value sequence according to the first preset rule, wherein the number of weight arrays is the same as the number of bits in the hash value sequence, includes: for each hash value in the hash value sequence, determining the bit weight corresponding to each bit of each hash value; summing the bit weights corresponding to all hash values ​​according to the common bits of each hash value to obtain the weight array of the opcode sequence, wherein the number of weight arrays is the same as the number of bits in the hash value sequence.

[0016] Optionally, determining the feature value corresponding to the opcode sequence based on the weight array according to the second preset rule includes: judging each data in the weight array based on a preset judgment threshold to determine the bit feature value; and assembling all the bit feature values ​​into the feature value corresponding to the opcode sequence.

[0017] Optionally, obtaining the opcode sequence corresponding to the method based on the code segment content corresponding to the method in the test sample includes: disassembling the code segment content to obtain the opcode content of the instructions in the method, wherein the opcode content includes the opcode and / or opcode operation data; processing the opcode content of the same instruction into a byte string to obtain the opcode byte string corresponding to each instruction; and using the opcode byte string as the opcode sequence corresponding to the method in the test sample.

[0018] Optionally, disassembling the code segment to obtain the opcode content of the instructions in the method includes: disassembling the code segment to obtain the opcode content of all instructions in the method; filtering one or more of the instructions and the opcode content of the instructions in the method according to a preset filtering rule to obtain the opcode of the filtered instructions and the opcode operation data.

[0019] Optionally, calculating the similarity between the feature value and the malicious feature value in the malicious feature database includes: comparing the feature value with the malicious feature value in the malicious feature database bit by bit to determine the number of identical values ​​in the same bit position between the feature value and the malicious feature value in the malicious feature database; calculating the ratio between the number of identical values ​​and the total number of bits in the feature value, and using the ratio as the similarity between the feature value and the malicious feature value in the malicious feature database.

[0020] Secondly, embodiments of this application provide a malicious code detection device, the device comprising:

[0021] The parsing module is used to obtain the opcode sequence corresponding to the method based on the code segment content corresponding to the method in the sample to be tested;

[0022] The hash value calculation module is used to group the opcode byte string in the opcode sequence, calculate the hash value corresponding to each group in the opcode sequence, and obtain the hash value sequence corresponding to the opcode sequence.

[0023] The feature value calculation module is used to calculate the feature value corresponding to the opcode sequence based on the hash value sequence;

[0024] The detection module is used to calculate the similarity between the feature value and the malicious feature value in the malicious feature library. If the similarity is higher than a preset similarity threshold, it is determined that the sample to be tested contains malicious code.

[0025] Thirdly, embodiments of this application provide a computer storage medium storing a plurality of instructions adapted for loading by a processor and executing the steps of the method described above.

[0026] Fourthly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being adapted to be loaded by the processor and to execute the steps of the method described above.

[0027] The beneficial effects of the technical solutions provided in some embodiments of this application include at least the following:

[0028] This application provides a malicious code detection method. Based on the code segment content corresponding to a method in the sample to be tested, the method obtains the opcode sequence corresponding to the method. Then, by grouping the opcode byte strings in the opcode sequence, a hash value sequence corresponding to the opcode sequence is obtained. Next, the feature value corresponding to the opcode sequence is calculated based on the hash value sequence. Finally, the similarity between the feature value and malicious feature values ​​in a malicious feature database is calculated. If the similarity is higher than a preset similarity threshold, the sample to be tested is determined to contain malicious code. Since the feature value of the opcode sequence obtained by this method can represent the characteristics of the opcode sequence, and even when the opcode sequence is maliciously modified, the feature value can still reflect the similarity with malicious feature values ​​in the malicious feature database, the similarity between two feature values ​​can be used to determine whether the sample to be tested contains malicious code. This highly resistant malicious code detection method can effectively detect maliciously modified malicious code, while also reducing the number of feature rules in the malicious feature database, improving the heuristics of malicious detection, and bringing convenience to technicians in related fields. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 An exemplary system architecture diagram of a malicious code detection method provided in this application embodiment;

[0031] Figure 2 A flowchart illustrating a malicious code detection method provided in an embodiment of this application;

[0032] Figure 3 A flowchart illustrating a malicious code detection method provided in another embodiment of this application;

[0033] Figure 4 A structural block diagram of a malicious code detection device provided in another embodiment of this application;

[0034] Figure 5This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0035] To make the features and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0036] In the following description, when referring to the accompanying drawings, the same numbers in different drawings denote the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0037] Please see Figure 1 , Figure 1 This is an exemplary system architecture diagram of a malicious code detection method provided in an embodiment of this application.

[0038] like Figure 1 As shown, the system architecture may include electronic device 101, network 102, and server 103. Network 102 serves as the medium for providing a communication link between electronic device 101 and server 103. Network 102 may include various types of wired or wireless communication links, such as wired communication links including fiber optic cables, twisted-pair cables, or coaxial cables, and wireless communication links including Bluetooth communication links, Wireless-Fidelity (Wi-Fi) communication links, or microwave communication links, etc.

[0039] Electronic device 101 can interact with server 103 via network 102 to receive messages from or send messages to server 103. Alternatively, electronic device 101 can interact with server 103 via network 102 to receive messages or data sent to server 103 by other users. Electronic device 101 can be hardware or software. When electronic device 101 is hardware, it can be various electronic devices, including but not limited to smartwatches, smartphones, tablets, laptops, and desktop computers. When electronic device 101 is software, it can be installed in the aforementioned electronic devices and can be implemented as multiple software programs or software modules (e.g., to provide distributed services) or as a single software program or software module; no specific limitation is made here.

[0040] Server 103 can be a business server providing various services. It should be noted that server 103 can be either hardware or software. When server 103 is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When server 103 is software, it can be implemented as multiple software programs or software modules (e.g., used to provide distributed services), or as a single software program or software module; no specific limitations are made here.

[0041] It should be understood that Figure 1 The number of electronic devices, networks, and servers shown is only illustrative; the number of electronic devices, networks, and servers can be any number depending on the implementation requirements.

[0042] In some existing detection methods, the feature values ​​of the extracted sample are generally compared with the feature values ​​of malicious code to achieve accurate detection. However, the problem with these technical solutions is that if the malware developer makes slight modifications, obfuscation, or encryption to the malicious files and code, the malicious files and code will change and will no longer be able to match the features in the malicious feature database. Therefore, the maliciousness cannot be detected. This shows that the existing malware detection methods are not resistant to change and cannot accurately detect the maliciousness of the sample.

[0043] Therefore, this application provides a malicious code detection method to solve the technical problem of weak resistance to change when detecting malicious code that has been maliciously modified.

[0044] Please see Figure 2 , Figure 2 This is a flowchart illustrating a malicious code detection method provided in an embodiment of this application. The execution entity in this embodiment can be an electronic device or a server, or it can be a processor within an electronic device or server, or it can be a malicious code detection system or malicious code detection service within an electronic device or server. For ease of description, the following uses a processor within an electronic device as an example to describe the specific execution process of the malicious code detection method.

[0045] like Figure 2 The malicious code detection methods shown can include at least:

[0046] S201. Based on the code segment content corresponding to the method in the sample to be tested, obtain the opcode sequence corresponding to the method.

[0047] Optionally, since some malware developers use malicious code to steal or tamper with user information, when a user receives a sample to be tested, it is necessary to perform code detection on the sample to identify whether it contains malicious code, thus preventing malicious code from harming user information. The sample to be tested can be a file corresponding to a software downloaded by the user, or a file obtained by the user during software testing, etc. In this embodiment, the method and category of obtaining the sample to be tested are not limited. Therefore, it is necessary to first obtain the code segments capable of executing functions from the sample to be tested. This is because the sample to be tested includes methods for implementing the functions of the sample and methods for calculating some important data. These methods in the sample to be tested are implemented by the code corresponding to each method. Based on this, the code segments corresponding to the methods in the sample to be tested can be obtained, and malicious code detection can be performed based on the code segments corresponding to the methods.

[0048] As is easily understood, the methods for implementing functional requirements in the code described above, that is, the functions for implementing functional requirements in the code, are not distinguished here. The representation of terms in the code in the embodiments of this application does not limit the solution of this application.

[0049] Optionally, since malware developers typically place malicious code in frequently used and important function areas of applications to avoid detection of malicious code in files, rather than treating all code in a file as malicious, if the amount of information in the sample to be tested is too large, only a portion of the code segments corresponding to the methods can be obtained to reduce unnecessary computation by the computer. In this embodiment, when obtaining the code segments corresponding to the methods in the sample to be tested, only the code segments corresponding to preset methods can be obtained for detection, which greatly reduces the computational burden on the computer.

[0050] Optionally, the selection of preset methods from all methods can be conditionally limited based on the characteristics of the methods. For example, if the implementation code of some methods is simple and cannot be maliciously modified based on the implemented function, then the code segment corresponding to such methods may not be detected. Alternatively, the selection can be based on the importance of the methods in the test sample, selecting methods that implement important functions in the test sample for code segment detection and filtering out methods corresponding to marginal functions. When setting the selection conditions for preset methods, they can be set according to the current actual situation, and this application embodiment does not impose any limitations on this.

[0051] Optionally, since the code segment content obtained from the sample to be tested is machine code or bytecode that can be recognized by a machine or virtual machine after compilation, in order to facilitate the extraction of features from the code segment content and to identify whether the code segment content contains malicious code, it is necessary to parse the corresponding opcode from the instructions in the machine code. The opcode describes the operation that the machine is to perform in the machine language instruction. In the computer instruction system, the instruction consists of an opcode and operands. Parsing each instruction can obtain the opcode and opcode operation data corresponding to the instruction. Different opcodes are represented using different encodings.

[0052] Furthermore, to facilitate subsequent calculations, all parsed opcodes can be stored in a preset order and according to sequence storage rules to obtain an opcode sequence, which in turn yields the opcode sequence corresponding to the method in the test sample.

[0053] S202. Divide the opcode byte string in the opcode sequence into groups, calculate the hash value corresponding to each group in the opcode sequence, and obtain the hash value sequence corresponding to the opcode sequence.

[0054] Optionally, after determining the opcode sequence corresponding to the method in the sample to be tested, simply comparing the opcode sequence of the sample to be tested with the opcode sequence of the malicious sample may lead to the following problems: First, the number of opcode sequences is enormous, and comparing them one by one would impose a huge computational burden on the computer; second, subtle changes in the code segment can cause changes in the opcode sequence, making a complete comparison of the opcode sequences fail, thus preventing the detection of code segments containing malicious code. Therefore, a similarity comparison feature value can be calculated from the opcode sequence, and then this feature value can be compared with malicious feature values ​​in a malicious feature database. This improves detection efficiency and detection rate.

[0055] Optionally, since the opcode sequence includes various opcode byte strings under different methods, and there are differences in length and other aspects between these opcode byte strings, it is not convenient to measure similarity using a unified rule. Dimensionality reduction can be used to represent the opcode sequence as numbers to improve the performance of similarity calculation. Dimensionality reduction can reduce the amount of data while minimizing the loss of data information, and it also reflects the similarity and correlation between similar data in the original data. Therefore, the opcode byte strings in the opcode sequence can be represented by a hash algorithm first. Hash is the process of transforming an input of arbitrary length into a fixed-length output, which is the hash value. A hash algorithm is a compression mapping that can compress a message of arbitrary length into a message digest of a certain fixed length. After representing the opcode byte string as a hash value of uniform length, the hash value sequence composed of all hash values ​​can be directly used as the representation of the opcode sequence.

[0056] Understandably, a code segment may contain multiple code fragments to achieve a specific function. Therefore, when inspecting the code segment content, it can be grouped according to the code fragments implementing different functions. Thus, in this embodiment, the opcode byte strings can be grouped, and a preset grouping rule ensures that opcode byte strings within the same group collectively exhibit representative characteristics on a fragment-by-fragment basis. After grouping the opcode byte strings, the hash value corresponding to each opcode group is calculated, and the hash value sequence composed of all hash values ​​is taken as the hash value sequence corresponding to the opcode sequence.

[0057] When using a hash algorithm to calculate the hash value of an opcode block, a specific hash algorithm can be selected according to the actual application requirements. Commonly used hash algorithms include consistent hashing, SHA1, MD5, and other hash algorithms. This application does not specify the hash algorithm used to calculate the hash value.

[0058] In this embodiment, the MD5 hash algorithm is used to calculate the hash value of the opcode block as an example. The MD5 Message-Digest Algorithm is a widely used cryptographic hash function that produces a 128-bit (16-byte) hash value to ensure the integrity and consistency of transmitted information. In this embodiment, the MD5 algorithm is used to calculate the MD5 value of each opcode block. The MD5 value of all opcode blocks is 128 bits, and the MD5 value sequence composed of all MD5 values ​​is used as the MD5 value sequence corresponding to the opcode sequence.

[0059] S203. Calculate the characteristic value corresponding to the opcode sequence based on the hash value sequence.

[0060] Optionally, hashing the opcode groups in the opcode sequence yields hash values ​​representing the characteristics of the opcode groups. However, due to the computational characteristics of some conventional hash algorithms, the conventional hash values ​​of similar objects can differ significantly, making it impossible for the hash values ​​to reflect the similarity between similar hash objects. In other words, when the opcode byte string undergoes a small change, the hash value obtained by the conventional hash algorithm may change significantly. At this time, the hash value cannot reflect the similarity between the current opcode byte string and the original opcode byte string. Therefore, direct code detection using the hash value sequence may fail to detect malicious code that has undergone encryption, obfuscation, or other transformations. Furthermore, when there are too many hash values ​​in the hash value sequence, not only will the detection time increase significantly, but it will also make it easier for malicious developers to encrypt and hide malicious code.

[0061] Optionally, in order to ensure that similar opcode sequences reflect a corresponding similarity, the hash value sequence needs to be further processed to obtain a feature value that represents the similarity between the opcode sequences. This application embodiment does not limit the method for obtaining the feature value corresponding to the opcode sequence.

[0062] S204. Calculate the similarity between the feature value and the malicious feature value in the malicious feature library. If the similarity is higher than the preset similarity threshold, it is determined that the sample to be tested contains malicious code.

[0063] Understandably, in order to detect the code content in the sample to be tested, it is necessary to first construct a malicious feature library using malicious code samples. In this embodiment of the application, in order to compare the feature value corresponding to the opcode sequence with the information in the malicious feature library, the malicious code samples in the malicious feature library should also adopt the same calculation method as the feature value of the opcode sequence. That is to say, there is a simhash value of the malicious code sample in the malicious feature library, which means that there is a malicious feature value in the malicious feature library.

[0064] Furthermore, the feature values ​​of the opcode sequence are compared with malicious feature values ​​in the malicious feature database to obtain the similarity between the two values. In order to more accurately judge the similarity between the feature values ​​of the opcode sequence and the malicious feature values, a similarity threshold can be preset so that features with a similarity higher than the preset threshold are accurately identified as malicious code. The preset similarity threshold can be set according to the situation of the malicious feature values ​​and the sample to be tested, and this application does not limit it in this regard.

[0065] Optionally, when determining whether a sample to be tested corresponding to the current opcode sequence contains malicious code by comparing the similarity between the feature value of the current opcode sequence and the malicious feature value in the malicious feature library, it means that when detecting a certain number of samples to be tested, the malicious feature library that performs similarity detection will no longer require a large number of redundant and precise malicious feature values ​​compared to the malicious feature library that performs precise detection. This reduces the number of malicious feature values ​​required by the existing malicious feature library. Furthermore, the detection rules based on similarity also provide good inspiration for detecting other malicious applications. For example, when detecting other types of target content, it is still possible to detect them by comparing the similarity between the target content and the sample content, which also brings great convenience to technical personnel in related fields.

[0066] This application provides a method for detecting malicious code. First, based on the code segment content corresponding to the method in the sample to be tested, the opcode sequence corresponding to the method is obtained. Then, by grouping the opcode byte strings in the opcode sequence, a hash value sequence corresponding to the opcode sequence is obtained. Next, the feature value corresponding to the opcode sequence is calculated based on the hash value sequence. Finally, when the similarity between the feature value and the malicious feature value in the malicious feature library is higher than a preset similarity threshold, it is determined that the sample to be tested contains malicious code. Since the feature value of the opcode sequence obtained by this solution can represent the characteristics of the opcode sequence, and even when the opcode sequence is maliciously modified, the feature value can still reflect the similarity with the malicious feature value in the malicious feature library, it is possible to determine whether the sample to be tested contains malicious code based on the similarity between the two feature values. This highly resistant malicious code detection method can effectively detect maliciously modified malicious code, while also reducing the number of feature rules in the malicious feature library, improving the heuristics of malicious detection, and bringing convenience to those skilled in the art.

[0067] Please see Figure 3 , Figure 3 This is a flowchart illustrating a malicious code detection method provided in another embodiment of this application.

[0068] like Figure 3 As shown, malicious code detection methods can include at least:

[0069] S301. Disassemble the code segment to obtain the opcode content of the instructions in the method.

[0070] Optionally, when the sample to be tested is obtained, it is usually in the form of a folder or compressed package. If further testing is to be performed on the contents, the sample to be tested needs to be decompressed and the executable file of the sample to be tested needs to be extracted. For example, if it is an Android sample to be tested, the dex file in the sample is extracted; if it is an iOS sample to be tested, the IPA file in the sample is extracted; if it is a Windows sample to be tested, the exe file in the sample is extracted; if it is a Linux sample to be tested, the ELF file in the sample is extracted. It is easy to understand that this method can be used to test the code content of any sample to be tested from which code instructions can be extracted. When the executable file exists alone, it also needs to be tested separately. For example, a single dex file in the Android system can also be tested separately. The present application embodiment does not limit the application system and the existence of the executable file of the sample to be tested.

[0071] It should be noted that for a file to be tested, a file to be tested includes one or more executable files, an executable file includes one or more methods, and a method includes one or more instructions. Taking the Android system as an example, for a sample to be tested, this application embodiment can detect all or part of the dex files; for the detected dex files, all or part of the methods can be detected; for the detected methods, all or part of the instructions can be processed, all of which can achieve the detection effect; the different data selected are only a trade-off between performance, efficiency and accuracy, and different application scenarios and different performance requirements can be flexibly handled in terms of the detection object, and this application embodiment does not limit this.

[0072] Taking the Android test sample as an example, the header information of the dex file records general information about all fields in the file, including index information, which may mainly include strings, types, method prototypes, fields, and method indexes. Most of the main functional code is implemented using method code, and the method code segment is located through the class definition data index. Therefore, it is necessary to obtain the class definition data index of the executable file by parsing the header information to retrieve class information and method information within that class. The class or function information of test samples from other systems can be obtained from the corresponding field information of their respective executable files, which will not be elaborated here.

[0073] Optionally, after parsing the class definition data index in the code through the header information of the executable file, the class information can be obtained from the index position. Furthermore, the methods used under the class and the code segment content corresponding to each method can be determined through the class information, so as to facilitate subsequent malicious code detection based on the code segment content of the methods.

[0074] Optionally, as described in the above embodiments, the code segment content obtained from the sample under test is compiled binary machine code that can be recognized by a machine. To facilitate the extraction of features from the code segment content and to identify whether it contains malicious code, the binary machine code needs to be parsed into corresponding opcodes. Based on this, the code segment content can be disassembled. Disassembly can convert machine language into assembly language code, thus allowing the acquisition of the opcode content corresponding to the code segment content.

[0075] Understandably, a method's code segment mainly consists of multiple instructions, and a large amount of important information is contained within these instructions. Therefore, to further refine the characteristics of a method, the instructions within it can be identified. There is a correspondence between opcodes and instructions; the opcode represents the operation performed by the instruction, and the opcode operation data records the parameters used by the opcode. Thus, the instructions within the method can be determined based on the opcode content, and the opcodes and opcode operation data corresponding to each instruction can be extracted according to the instruction format. However, given the large number and variety of instruction types within a method, the fact that some instructions do not contain important information, and the instability of some opcode operation data, it is advisable to first filter the instruction types to be extracted, extracting only the opcodes and opcode operation data corresponding to suitable instructions.

[0076] Optionally, instructions can be extracted in a preset order. This preset order can be set according to actual application requirements. For example, it can be extracted according to the execution order of the code, the reverse order of execution, or a custom order of instruction types. This application embodiment does not specifically limit the extraction order of instructions. In this application embodiment, the following explanation is based on the example of extracting instructions according to the execution order of the code.

[0077] Furthermore, the instructions in the method can be determined first based on the opcode content, and preset instructions can be filtered according to the type of each instruction. That is, according to preset filtering rules, one or more of the instructions in the method and the opcode content of the instructions are filtered to obtain the opcode and opcode operation data of the filtered instructions. Specifically, preset types of instructions and instruction information can be filtered based on the importance and variability of the opcode and opcode operation data. For example, pseudo-instructions do not contain important information and will interfere with the detection results, so the opcode and operation data of pseudo-instructions can be filtered; opcodes with easily changing operation data that have a significant impact on the results can also be filtered. It should be noted that for the opcode and opcode operation data of the same instruction, they can be retained simultaneously, removed simultaneously, or only one of them can be retained. The specific filtering rules can be set according to actual needs, and this application embodiment does not limit this.

[0078] In the illustrative example of the embodiments of this application, the opcodes of all acquired instructions can be recorded. However, for opcode operation data, only the opcode operation data of method call and string assignment instructions are recorded. The opcode operation data of method call instructions records the name of the method called, and the opcode operation data of string assignment instructions records the string to be assigned. This filtering rule for opcodes and opcode operation data does not limit the solution of this application.

[0079] Furthermore, the opcodes and opcode operation data of the filtered instructions in the method can be extracted. After filtering all opcodes and opcode operation data in the method according to the instruction type, the opcodes and opcode operation data of the remaining instructions after filtering are extracted for subsequent feature extraction and malicious code detection.

[0080] S302. Process the opcode content of the same instruction into a byte string to obtain the opcode byte string corresponding to each instruction, and use the opcode byte string as the opcode sequence corresponding to the method in the test sample.

[0081] Optionally, to extract opcode features using instructions as the unit, the opcode and opcode operation data corresponding to the same instruction can be concatenated to obtain the opcode byte string corresponding to each instruction. Since the opcode and opcode operation data have been filtered, the opcode byte string corresponding to each instruction may include both the opcode and opcode operation data, or it may only include the opcode, or it may only include the opcode operation data. It should be noted that when processing the opcode content, the concatenation rules and methods between opcode contents can be set according to actual application requirements; this application embodiment does not impose specific limitations. The obtained opcode byte string can be used as the opcode sequence corresponding to the method in the test sample.

[0082] S303. Traverse each opcode byte string in the opcode sequence, and perform concatenation and grouping operations on the opcode byte strings in the opcode sequence according to the preset grouping rules to obtain the opcode grouping list corresponding to the opcode sequence.

[0083] Optionally, as described in the above embodiments, after obtaining the opcode byte string corresponding to the code segment content, it is necessary to group the opcode byte string. A preset grouping rule ensures that the opcode byte strings in the same group collectively represent the representative features of the code segment content, on a fragment-by-fragment basis. Based on this, since the instructions in the code are arranged logically, and the opcode byte strings are stored according to the order of arrangement, each opcode byte string can be obtained sequentially according to its storage order in the opcode sequence. During the acquisition process, the opcode byte strings are grouped according to the preset grouping rule. Furthermore, if the current opcode byte string already exists in the group it belongs to, the current opcode byte string is directly concatenated with the previous opcode byte string in the group to obtain the opcode grouping list corresponding to the opcode sequence.

[0084] Optionally, preset grouping rules can be set according to different detection requirements. For example, they can be grouped according to a specific number of instructions; they can also be grouped according to different functions; or they can be grouped according to different logics corresponding to the instructions. This application embodiment does not limit the grouping rules.

[0085] In one feasible embodiment of this application, when concatenating and grouping according to a preset grouping rule, each opcode operation data can be regarded as the end of an instruction logic, and this can be used as the basis for grouping. Specifically, this involves identifying whether the current opcode byte string includes opcode operation data, and performing concatenation and grouping operations based on whether the current opcode byte string includes opcode operation data; if the current opcode byte string does not include opcode operation data, then concatenating the current opcode byte string with the opcode byte string in the current group, thereby classifying the current opcode byte string into the current group; and identifying whether the next opcode byte string includes opcode operation data, and performing concatenation and grouping operations based on whether the next opcode byte string includes opcode operation data; if the current opcode byte string includes opcode operation data, then concatenating the current opcode byte string with the opcode byte string in the current group, thereby classifying the current opcode byte string into the current group, ending the current grouping, and after ending the current grouping, not continuing to classify opcode byte strings into the current group, and continuing to identify whether the next opcode byte string includes opcode operation data, and performing concatenation and grouping operations based on whether the next opcode byte string includes opcode operation data. It is important to note that when concatenating and grouping the current opcode byte string, if there is already an unfinished group, the current opcode is placed into the current group and concatenated with the previous opcode byte string in the group; if there is no current group at this time (for example, the current group has ended and the opcode byte string is the first opcode byte string in the sequence), a group is automatically created and the opcode byte string is placed into the group.

[0086] For example, in this embodiment of the application, a byte string containing only the opcode in the opcode sequence is denoted as O. n The byte string containing the opcode operation data is denoted as D. m n and m represent the sequence numbers, and there is a set of opcode sequences [O1, O2, D1, D2, O3, D]. 3, [O4, O5] First, extraction and grouping are performed according to the storage order. When extracting the opcode byte string O1, O1 only contains the opcode, and there is no current group at this time. So, a new group is created and O1 is put into this group. Then, the opcode byte string O2 is extracted. O2 only contains the opcode, so it is assigned to the group where O1 is located. At the same time, O1 and O2 are concatenated to get [O1O2]. The opcode byte string D1 is extracted. D1 contains the opcode operation data, so D1 is assigned to the current group and the current group is ended. At the same time, it is concatenated to get [O1O2D1]. Subsequent concatenation of groups still follows this grouping rule, and groups [D2], [O3D3], and [O4O5] are obtained in sequence. Finally, the opcode group list is [O1O2D1,D2,O3D3,O4O5].

[0087] Optionally, when grouping and concatenating opcode byte strings, grouping and concatenation operations can be performed separately. Specifically, after grouping each opcode byte string, the opcode byte strings in each group can be concatenated to obtain a list of opcode groups corresponding to the opcode sequence.

[0088] For example, in this embodiment of the application, a byte string containing only the opcode in the opcode sequence is denoted as O. n The byte string containing the opcode operation data is denoted as D. m n and m represent the sequence numbers, and there is a set of opcode sequences [O1, O2, D1, D2, O3, D]. 3, [O4, O5] First, extraction and grouping are performed according to the storage order. When extracting the opcode byte string O1, O1 only contains the opcode, and there is no current group at this time. So, a new group is created and O1 is put into this group. Then, the opcode byte string O2 is extracted. O2 only contains the opcode, so it is assigned to the group where O1 is located. The opcode byte string D1 is extracted. D1 contains the opcode operation data, so D1 is assigned to the current group and the current group ends, thus forming the group [O1, O2, D1]. Subsequent groups still follow this grouping rule, and the groups [D2], [O3, D3], and [O4, O5] are obtained in sequence. Finally, the opcode byte strings in each group are concatenated to obtain the opcode group list [O1O2D1, D2, O3D3, O4O5].

[0089] It should be noted that the embodiments of this application do not specifically limit the splicing method between opcode byte strings. In practical applications, technicians can make specific settings for the splicing method.

[0090] S304. For each group in the opcode sequence, calculate the hash value corresponding to the concatenated opcode byte string in each group, thereby obtaining the hash value corresponding to each group.

[0091] Optionally, after obtaining the opcode groups, the hash value corresponding to each group is calculated. As can be seen from the above embodiments, the hash algorithm for calculating the hash value is not limited. In this embodiment, the MD5 hash algorithm is used as an example to calculate the MD5 value corresponding to each opcode group.

[0092] S305. Based on the hash values ​​corresponding to all groups in the opcode sequence, obtain the hash value sequence corresponding to the opcode sequence.

[0093] Optionally, the sequence of hash values ​​corresponding to all opcode groups is the hash value sequence corresponding to the opcode sequence. However, considering that in practice, the functions and instructions called under the method may be repeated in large numbers, so there may also be duplicate hash values. In order to further reduce unnecessary power consumption and calculation process of the computer, all calculated hash values ​​can be deduplicated to remove duplicate values ​​from all hash values, so as to obtain the final hash value sequence corresponding to the opcode sequence.

[0094] Optionally, due to the characteristics of hash values, if deduplication is not performed on hash values, it will not affect the subsequent feature value calculation. Therefore, this application does not limit whether hash value deduplication is performed. In addition, when deduplicating hash values, the specific processing scheme and deduplication steps can be selected according to actual needs, and this application embodiment does not limit this as well.

[0095] S306. Obtain the weight array corresponding to the hash value sequence according to the first preset rule.

[0096] Optionally, as described in the above embodiments, after obtaining the hash value sequence, it is necessary to determine the feature value corresponding to the opcode sequence based on the hash value sequence. It should be noted that the aforementioned hash value sequence can be either an undeduplicated hash value sequence or a deduplicated hash value sequence. Whether or not the hash values ​​are deduplicated does not cause defects or impacts on the embodiments of this application or subsequent solutions. Considering that hash values ​​are generally represented as binary numbers, the hash value sequence can be processed by the weights of each hash value. The bit weights of each digit in each hash value are assigned according to a first preset rule. After calculating the bit weights of each digit in each hash value, the weight array of the opcode sequence is obtained by traversing each hash value in the hash value sequence and summing the bit weights of each hash value according to the common bits of each hash value. When weighting the digits of the hash value, the specific weights can be set by the technicians themselves and will not affect subsequent calculations and judgments.

[0097] Specifically, the weights of the first bit of each hash value are summed to obtain the first bit weight of the opcode sequence; the weights of the second bit of each hash value are summed to obtain the second bit weight of the opcode sequence; and so on, until the Nth bit weight of each hash value is summed to obtain the Nth bit weight of the opcode sequence, thus obtaining the weight array of the opcode sequence. For example, in this embodiment, the bit weights of each digit of each MD5 value in the MD5 value sequence are calculated. The MD5 value sequence contains 10 MD5 values, each of which is 128 bits of binary data. For each digit of each MD5 value, the initial bit weight is set to 0; the bit weight of the digit with a value of 1 is increased by 1, and the bit weight of the digit with a value of 0 is decreased by 1, thus obtaining the bit weights of each digit in the 10 MD5 values. Then, by traversing through each of the 10 MD5 values, the bit weights of each MD5 value are summed according to the common bits of each MD5 value to obtain the weight array corresponding to the opcode sequence; for example, the bit weights of the first digit of the 10 MD5 values ​​are summed to obtain the first bit weight; the bit weights of the second digit of the 10 MD5 values ​​are summed to obtain the second bit weight; ..., the bit weights of the 128th digit of the 10 MD5 values ​​are summed to obtain the 128th bit weight; the first bit weight to the 128th bit weight are combined to form the weight value, and this weight array contains 128 bit weights.

[0098] S307. Based on the weight array, determine the feature value corresponding to the opcode sequence according to the second preset rule.

[0099] Furthermore, after obtaining the weight array corresponding to the opcode sequence, it is necessary to determine the bit feature value corresponding to each weight in the weight array according to the second preset rule, thereby obtaining the feature value corresponding to the opcode sequence. It should be noted that the aforementioned weight array can be a weight array obtained by weighting a hash value sequence according to any weighting rule. For example, for the weight array corresponding to the opcode sequence obtained from the MD5 value, a judgment threshold can be set to judge each bit weight in the weight array. For example, if the judgment threshold is set to 0, then if the bit weight is greater than 0, the bit feature value is determined to be 1; if the bit weight is other values, the bit feature value is determined to be 0. This reduces the dimensionality of the weight array to a 128-bit sequence containing only 0s and 1s, which is the feature value corresponding to the opcode sequence. Of course, the judgment threshold can also be set to other values; this embodiment does not limit this.

[0100] S308. Compare the feature value with the malicious feature values ​​in the malicious feature database bit by bit to determine the number of times the feature value and the malicious feature values ​​in the malicious feature database have the same value in the same bit.

[0101] Optionally, as described in the above embodiments, the feature value of the opcode sequence and the malicious feature value in the malicious feature library are obtained using the same calculation method. Both feature values ​​are 128-bit simhash values. Since the feature value of the opcode sequence and the malicious feature value in the malicious feature library have the same number of bits, the Hamming distance algorithm can be used to compare the similarity between the two feature values. That is, the two simhash values ​​are compared bit by bit to obtain the number of times the feature value and the malicious feature value in the malicious feature library have different values ​​in the same bit. This number is the Hamming distance between the feature value of the sample to be tested and the malicious feature value. Thus, the number of times the feature value of the opcode sequence and the malicious feature value in the malicious feature library have the same value in the same bit can be determined.

[0102] S309. Calculate the ratio between the number of identical values ​​and the total number of digits of the feature value, and use the ratio as the similarity between the feature value and the malicious feature value in the malicious feature database.

[0103] Optionally, the ratio of the number of identical bits in the same position between two feature values ​​to the total number of bits in the feature value can be used as the similarity between the feature value and a malicious feature value in a malicious feature database. For example, if 102 bits in the 128-bit opcode sequence are identical to a malicious feature value, then the similarity between the two values ​​is considered to be 80%.

[0104] S3010. If the similarity is higher than the preset similarity threshold, it is determined that the sample to be tested contains malicious code.

[0105] Optionally, a reasonable similarity threshold can be set based on testing experience and actual conditions to facilitate the detection of whether the feature values ​​of the opcode sequence of the test sample successfully match malicious feature values, thereby obtaining the most accurate detection effect. For example, in this embodiment, based on the test results of a large number of samples, a preset similarity threshold of 85% is set. Since the simhash value is 128 bits, when the Hamming distance between the simhash value of the opcode sequence and the malicious simhash value is not greater than 19, that is, when the similarity reaches 85%, it is determined that the test sample contains malicious code.

[0106] This application provides a method for detecting malicious code. By further selecting appropriate opcodes and opcode operation data according to the type of instruction, and grouping and concatenating each opcode byte string, unnecessary power consumption and calculation steps of the computer are reduced, improving the overall computational efficiency and accuracy of the algorithm. Based on the weight array obtained from the hash value sequence corresponding to the opcode sequence, the bit value of each weight in the weight array is further determined to finally obtain the feature value of the opcode sequence. This feature value can represent the characteristics of the opcode sequence, and when the opcode sequence is maliciously modified, the feature value can still reflect the similarity with the malicious feature value in the malicious feature library. Therefore, when the similarity is greater than a preset threshold, it can be determined that the sample to be tested contains malicious code. This highly resistant malicious code detection method can effectively detect malicious code that has been maliciously modified.

[0107] Please see Figure 4 , Figure 4 This is a structural block diagram of a malicious code detection device provided in another embodiment of this application. Figure 4 As shown, the malicious code detection device 400 includes:

[0108] The parsing module 410 is used to obtain the opcode sequence corresponding to the method based on the code segment content of the method in the test sample;

[0109] The hash value calculation module 420 is used to group the opcode byte string in the opcode sequence, calculate the hash value corresponding to each group in the opcode sequence, and obtain the hash value sequence corresponding to the opcode sequence.

[0110] The feature value calculation module 430 is used to calculate the feature value corresponding to the opcode sequence based on the hash value sequence;

[0111] The detection module 440 is used to calculate the similarity between the feature value and the malicious feature value in the malicious feature library. If the similarity is higher than the preset similarity threshold, it is determined that the sample to be tested contains malicious code.

[0112] Optionally, the parsing module 410 is also used to disassemble the code segment content, obtain the opcode content of the instructions in the method, the opcode content includes the opcode and / or opcode operation data; process the opcode content of the same instruction into a byte string to obtain the opcode byte string corresponding to each instruction; and use the opcode byte string as the opcode sequence corresponding to the method in the test sample.

[0113] Optionally, the parsing module 410 is also used to disassemble the code segment content to obtain the opcode content of all instructions in the method; and to filter one or more of the instructions and opcode content of the instructions in the method according to preset filtering rules to obtain the opcode of the filtered instructions and the opcode operation data.

[0114] Optionally, the hash value calculation module 420 is also used to traverse each opcode byte string in the opcode sequence, and perform concatenation and grouping operations on the opcode byte strings in the opcode sequence according to a preset grouping rule to obtain the opcode grouping list corresponding to the opcode sequence.

[0115] Optionally, the hash value calculation module 420 is also used to identify whether the current opcode byte string includes opcode operation data, and to perform concatenation and grouping operations based on whether the current opcode byte string includes opcode operation data.

[0116] Optionally, the hash value calculation module 420 is further configured to, if the current opcode byte string does not include opcode operation data, concatenate the current opcode byte string with the opcode byte string in the current group, thereby assigning the current opcode byte string to the current group; if the current opcode byte string includes opcode operation data, concatenate the current opcode byte string with the opcode byte string in the current group, thereby assigning the current opcode byte string to the current group and ending the current group.

[0117] Optionally, the hash value calculation module 420 is further configured to calculate the hash value corresponding to the concatenated opcode byte string in each group of each group in the opcode sequence, thereby obtaining the hash value corresponding to each group; and obtain the hash value sequence corresponding to the opcode sequence based on the hash values ​​corresponding to all groups of the opcode sequence.

[0118] Optionally, the hash value calculation module 420 is also used to deduplicatize the hash values ​​based on the hash values ​​corresponding to all groups of the opcode sequence; and to obtain the hash value sequence corresponding to the opcode sequence based on all the deduplicated hash values.

[0119] Optionally, the feature value calculation module 430 is further configured to obtain a weight array corresponding to the hash value sequence according to a first preset rule, wherein the number of weight arrays is the same as the number of bits in the hash value sequence; and determine the feature value corresponding to the opcode sequence according to a second preset rule based on the weight array.

[0120] Optionally, the feature value calculation module 430 is also used to determine the bit weight corresponding to each bit of each hash value in the hash value sequence; and to sum the bit weights corresponding to all hash values ​​according to the common bits of each hash value to obtain the weight array of the opcode sequence, wherein the number of weight arrays is the same as the number of bits of the hash values ​​in the hash value sequence.

[0121] Optionally, the feature value calculation module 430 is also used to judge each data in the weight array based on a preset judgment threshold to determine the bit feature value; and to form the feature value corresponding to the opcode sequence by combining all the bit feature values.

[0122] Optionally, the detection module 440 is further configured to compare the feature value with the malicious feature value in the malicious feature library bit by bit, determine the number of identical values ​​in the same bit between the feature value and the malicious feature value in the malicious feature library; calculate the ratio between the number of identical values ​​and the total number of bits in the feature value, and use the ratio as the similarity between the feature value and the malicious feature value in the malicious feature library.

[0123] This application provides a malicious code detection device, comprising: a parsing module for obtaining the opcode sequence corresponding to a method based on the code segment content of the method in the sample to be tested; a hash value calculation module for obtaining a hash value sequence corresponding to the opcode sequence by grouping the opcode byte strings in the opcode sequence; a feature value calculation module for calculating the feature value corresponding to the opcode sequence based on the hash value sequence; and a detection module for calculating the similarity between the feature value and malicious feature values ​​in a malicious feature library. If the similarity is higher than a preset similarity threshold, the sample to be tested is determined to contain malicious code. Since the feature value of the opcode sequence obtained by this solution can represent the characteristics of the opcode sequence, and even when the opcode sequence is maliciously modified, the feature value can still reflect the similarity with malicious feature values ​​in the malicious feature library, it is possible to determine whether the sample to be tested contains malicious code based on the similarity between the two feature values. This highly resistant malicious code detection method can effectively detect maliciously modified malicious code, while also reducing the number of feature rules in the malicious feature library, improving the heuristics of malicious detection, and bringing convenience to those skilled in the art.

[0124] This application also provides a computer storage medium that can store multiple instructions adapted for loading by a processor and executing the steps of any of the methods described in the above embodiments.

[0125] Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 5 As shown, the electronic device 500 may include: at least one electronic device processor 501, at least one network interface 504, user interface 503, memory 505, and at least one communication bus 502.

[0126] The communication bus 502 is used to enable communication between these components.

[0127] The user interface 503 may include a display screen and a camera. Optionally, the user interface 503 may also include a standard wired interface and a wireless interface.

[0128] The network interface 504 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0129] The electronic device processor 501 may include one or more processing cores. The electronic device processor 501 connects to various parts within the electronic device 500 using various interfaces and lines. It executes various functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 505, and by calling data stored in the memory 505. Optionally, the electronic device processor 501 may be implemented using at least one hardware form selected from Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). The electronic device processor 501 may integrate one or more of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content required for display; and the modem handles wireless communication. It is understood that the modem may also be implemented as a separate chip without being integrated into the electronic device processor 501.

[0130] The memory 505 may include random access memory (RAM) or read-only memory (ROM). Optionally, the memory 505 may include a non-transitory computer-readable storage medium. The memory 505 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 505 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 505 may also be at least one storage device located remotely from the aforementioned electronic device processor 501. Figure 5 As shown, the memory 505, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a malicious code detection program.

[0131] exist Figure 5 In the illustrated electronic device 500, the user interface 503 is mainly used to provide an input interface for the user and to obtain user input data; while the electronic device processor 501 can be used to call the malicious code detection program stored in the memory 505 and specifically perform the following operations:

[0132] Based on the code segment content corresponding to the method in the sample to be tested, obtain the opcode sequence corresponding to the method;

[0133] The opcode byte string in the opcode sequence is grouped, and the hash value corresponding to each group in the opcode sequence is calculated to obtain the hash value sequence corresponding to the opcode sequence.

[0134] Calculate the characteristic value corresponding to the opcode sequence based on the hash value sequence;

[0135] Calculate the similarity between the feature value and the malicious feature value in the malicious feature library. If the similarity is higher than the preset similarity threshold, it is determined that the sample to be tested contains malicious code.

[0136] In some embodiments, when the electronic device processor 501 executes the following steps to obtain the opcode sequence corresponding to the method based on the code segment content corresponding to the method in the test sample: disassembling the code segment content to obtain the opcode content of the instructions in the method, the opcode content including the opcode and / or opcode operation data; processing the opcode content of the same instruction into a byte string to obtain the opcode byte string corresponding to each instruction; and using the opcode byte string as the opcode sequence corresponding to the method in the test sample.

[0137] In some embodiments, when the electronic device processor 501 performs disassembly of the code segment content to obtain the opcode content of the instructions in the method, it specifically performs the following steps: disassembling the code segment content to obtain the opcode content of all instructions in the method; filtering one or more of the instructions in the method and the opcode content of the instructions according to a preset filtering rule to obtain the opcode of the filtered instructions and the opcode operation data.

[0138] In some embodiments, when the electronic device processor 501 performs the action of grouping the opcode byte strings in the opcode sequence, it specifically performs the following steps: traversing each opcode byte string in the opcode sequence, and performing concatenation and grouping operations on the opcode byte strings in the opcode sequence according to a preset grouping rule to obtain the opcode grouping list corresponding to the opcode sequence.

[0139] In some embodiments, when the electronic device processor 501 performs a concatenation and grouping operation on the opcode byte string in the opcode sequence according to a preset grouping rule, it specifically performs the following steps: identifying whether the current opcode byte string includes opcode operation data, and performing a concatenation and grouping operation based on whether the current opcode byte string includes opcode operation data.

[0140] In some embodiments, when the electronic device processor 501 performs a concatenation and grouping operation based on whether the current opcode byte string includes opcode operation data, it specifically performs the following steps: if the current opcode byte string does not include opcode operation data, then the current opcode byte string is concatenated with the opcode byte string in the current group, thereby classifying the current opcode byte string into the current group; if the current opcode byte string includes opcode operation data, then the current opcode byte string is concatenated with the opcode byte string in the current group, thereby classifying the current opcode byte string into the current group, and the current grouping ends.

[0141] In some embodiments, when the electronic device processor 501 performs the calculation of the hash value corresponding to each group in the opcode sequence to obtain the hash value sequence corresponding to the opcode sequence, it specifically performs the following steps: for each group in each group in the opcode sequence, calculate the hash value corresponding to the concatenated opcode byte string in each group, thereby obtaining the hash value corresponding to each group; based on the hash values ​​corresponding to all groups in the opcode sequence, obtain the hash value sequence corresponding to the opcode sequence.

[0142] In some embodiments, when the electronic device processor 501 executes the hash values ​​corresponding to all groups of the opcode sequence to obtain the hash value sequence corresponding to the opcode sequence, it specifically performs the following steps: based on the hash values ​​corresponding to all groups of the opcode sequence, deduplicating the hash values; based on all the deduplicated hash values, obtaining the hash value sequence corresponding to the opcode sequence.

[0143] In some embodiments, when the electronic device processor 501 performs the calculation of the feature value corresponding to the opcode sequence based on the hash value sequence, it specifically performs the following steps: obtaining the weight array corresponding to the hash value sequence according to a first preset rule, wherein the number of elements in the weight array is the same as the number of bits in the hash value in the hash value sequence; and determining the feature value corresponding to the opcode sequence based on the weight array according to a second preset rule.

[0144] In some embodiments, when the electronic device processor 501 executes the following steps when it obtains the weight array corresponding to the hash value sequence according to the first preset rule, and the number of weight arrays is the same as the number of bits in the hash value sequence: for each hash value in the hash value sequence, determine the bit weight corresponding to each bit of each hash value; according to the common bits of each hash value, sum the bit weights corresponding to all hash values ​​to obtain the weight array of the opcode sequence, and the number of weight arrays is the same as the number of bits in the hash value sequence.

[0145] In some embodiments, when the electronic device processor 501 performs the following steps when determining the feature value corresponding to the opcode sequence based on the weight array and according to the second preset rule: judging each data in the weight array based on the preset judgment threshold to determine the bit feature value; and assembling all the bit feature values ​​into the feature value corresponding to the opcode sequence.

[0146] In some embodiments, when the electronic device processor 501 performs the calculation of the similarity between the feature value and the malicious feature value in the malicious feature library, it specifically performs the following steps: comparing the feature value with the malicious feature value in the malicious feature library bit by bit to determine the number of identical values ​​in the same bit between the feature value and the malicious feature value in the malicious feature library; calculating the ratio between the number of identical values ​​and the total number of bits in the feature value, and using the ratio as the similarity between the feature value and the malicious feature value in the malicious feature library.

[0147] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0148] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0149] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0150] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0151] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0152] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0153] The above is a description of a malicious code detection method, apparatus, storage medium, and electronic device provided in this application. For those skilled in the art, based on the ideas of the embodiments of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for detecting malicious code, characterized in that, The method includes: Based on the code segment content corresponding to the method in the sample to be tested, obtain the opcode sequence corresponding to the method; The opcode byte string in the opcode sequence is grouped, and the hash value corresponding to each group in the opcode sequence is calculated to obtain the hash value sequence corresponding to the opcode sequence. Calculate the feature value corresponding to the opcode sequence based on the hash value sequence; Calculate the similarity between the feature value and the malicious feature value in the malicious feature library. If the similarity is higher than a preset similarity threshold, then it is determined that the sample to be tested contains malicious code. The step of grouping the opcode byte strings in the opcode sequence includes: traversing each opcode byte string in the opcode sequence, and performing concatenation and grouping operations on the opcode byte strings in the opcode sequence according to a preset grouping rule to obtain an opcode grouping list corresponding to the opcode sequence; The concatenation and grouping operation includes: identifying whether the current opcode byte string includes opcode operation data; if the current opcode byte string does not include opcode operation data, then concatenating the current opcode byte string with the opcode byte string in the current group, thereby assigning the current opcode byte string to the current group; if the current opcode byte string includes opcode operation data, then concatenating the current opcode byte string with the opcode byte string in the current group, thereby assigning the current opcode byte string to the current group, and ending the current grouping.

2. The method according to claim 1, characterized in that, Each opcode byte string in the opcode sequence includes the opcode and / or opcode operation data.

3. The method according to any one of claims 1 to 2, characterized in that, The step of calculating the hash value corresponding to each group in the opcode sequence to obtain the hash value sequence corresponding to the opcode sequence includes: For each group in the opcode sequence, calculate the hash value corresponding to the concatenated opcode byte string in each group to obtain the hash value corresponding to each group. Based on the hash values ​​corresponding to all groups of the opcode sequence, the hash value sequence corresponding to the opcode sequence is obtained.

4. The method according to claim 3, characterized in that, The process of obtaining the hash value sequence corresponding to the opcode sequence based on the hash values ​​corresponding to all groups of the opcode sequence includes: Based on the hash values ​​corresponding to all groups of the opcode sequence, the hash values ​​are deduplicated; Based on all the deduplicated hash values, the hash value sequence corresponding to the opcode sequence is obtained.

5. The method according to claim 4, characterized in that, The step of calculating the feature value corresponding to the opcode sequence based on the hash value sequence includes: According to the first preset rule, the weight array corresponding to the hash value sequence is obtained, and the number of the weight array is the same as the number of bits in the hash value in the hash value sequence; Based on the weight array, the feature values ​​corresponding to the opcode sequence are determined according to the second preset rule.

6. The method according to claim 5, characterized in that, The step of obtaining the weight array corresponding to the hash value sequence according to the first preset rule, wherein the number of elements in the weight array is the same as the number of bits in the hash value sequence, includes: For each hash value in the hash value sequence, determine the bit weight corresponding to each bit of each hash value; Based on the common bits of each hash value, the bit weights corresponding to all hash values ​​are summed to obtain the weight array of the opcode sequence. The number of elements in the weight array is the same as the number of bits in the hash values ​​in the hash value sequence.

7. The method according to claim 5, characterized in that, The step of determining the feature value corresponding to the opcode sequence based on the weight array and according to the second preset rule includes: Based on a preset judgment threshold, each data in the weight array is judged to determine the bit feature value; All bit feature values ​​are combined to form the feature value corresponding to the opcode sequence.

8. The method according to claim 1, characterized in that, The step of obtaining the opcode sequence corresponding to the method based on the code segment content corresponding to the method in the test sample includes: Disassemble the code segment to obtain the opcode content of the instructions in the method, wherein the opcode content includes the opcode and / or opcode operation data; The opcode content of the same instruction is processed into a single byte string to obtain the opcode byte string corresponding to each instruction. The opcode byte string is used as the opcode sequence corresponding to the method in the sample to be tested.

9. The method according to claim 8, characterized in that, The disassembly of the code segment to obtain the opcode content of the instructions in the method includes: Disassemble the code segment to obtain the opcodes of all instructions in the method; According to preset filtering rules, one or more of the instructions and the opcode content of the instructions in the method are filtered to obtain the opcode of the filtered instructions and the opcode operation data.

10. The method according to claim 1, characterized in that, The calculation of the similarity between the feature value and malicious feature values ​​in the malicious feature database includes: The feature value is compared bit by bit with the malicious feature values ​​in the malicious feature database to determine the number of times the feature value and the malicious feature values ​​in the malicious feature database have the same value in the same bit. Calculate the ratio between the number of identical values ​​and the total number of digits in the feature value, and use the ratio as the similarity between the feature value and malicious feature values ​​in the malicious feature database.

11. A malicious code detection device, characterized in that, The device includes: The parsing module is used to obtain the opcode sequence corresponding to the method based on the code segment content corresponding to the method in the sample to be tested; The hash value calculation module is used to group the opcode byte string in the opcode sequence, calculate the hash value corresponding to each group in the opcode sequence, and obtain the hash value sequence corresponding to the opcode sequence. The feature value calculation module is used to calculate the feature value corresponding to the opcode sequence based on the hash value sequence; The detection module is used to calculate the similarity between the feature value and the malicious feature value in the malicious feature library. If the similarity is higher than a preset similarity threshold, it is determined that the sample to be tested contains malicious code. The hash value calculation module is also used to traverse each opcode byte string in the opcode sequence, and perform concatenation and grouping operations on the opcode byte strings in the opcode sequence according to a preset grouping rule to obtain the opcode grouping list corresponding to the opcode sequence. The concatenation and grouping operation includes: identifying whether the current opcode byte string includes opcode operation data; if the current opcode byte string does not include opcode operation data, then concatenating the current opcode byte string with the opcode byte string in the current group, thereby assigning the current opcode byte string to the current group; if the current opcode byte string includes opcode operation data, then concatenating the current opcode byte string with the opcode byte string in the current group, thereby assigning the current opcode byte string to the current group, and ending the current grouping.

12. A computer storage medium, characterized in that, The computer storage medium stores a plurality of instructions adapted for loading by a processor and executing the steps of the method as described in any one of claims 1 to 10.

13. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the steps of the method as described in any one of claims 1 to 10.

Images