APT malware classification method and device based on prediction guide prototype

Abstract

The application discloses an APT malicious software classification method and device based on a prediction guide prototype, and the method comprises the following steps: acquiring global feature encoding and numerical encoding sequences of API calling sequences of malicious software; after feature extraction of auxiliary function classification tasks and main organization classification tasks is performed on the numerical encoding sequences, global feature encoding is combined to obtain auxiliary function classification task feature vector representation and main organization classification task feature vector representation; function category Gaussian distribution in a feature space is fitted by using the auxiliary function classification task feature vector representation to obtain prediction probability on the function category; the main organization classification task feature vector representation is fitted into organization category multi-peak distribution in the feature space by combining the prediction probability on the function category, so that prediction probability on each organization category is obtained; and a malicious software classification result is obtained based on the prediction probability of the malicious software on each organization category. The application can cope with emerging APT attack groups.

Description

Technical Field

[0001] This invention belongs to the field of network threat protection and relates to malware classification technology, specifically to a method and apparatus for classifying APT malware based on a predictive prototype. Background Technology

[0002] With the evolution of cyber attack and defense technologies, Advanced Persistent Threats (APTs) have become the primary threat to cyberspace security. APTs are meticulously planned cyberattacks by attack groups possessing specialized knowledge, well-defined architectures, and abundant resources. They deploy multi-stage attack payloads within the specific information infrastructure of their targets using various attack vectors to achieve desired effects such as data theft, fraud, and systemic damage. In 2021, more than 400 APT attack incidents were reported globally. Combating APT attacks has become a key focus of cybersecurity research.

[0003] Most current research on APT countermeasures focuses on two aspects: first, formally modeling the APT attack and defense process to design targeted protection recommendations; and second, detecting attack behavior from traffic data and host audit logs. However, formal modeling methods cannot provide practically usable detection rules or models, and traffic data and log data are difficult for defenders to obtain and hard to sift through massive amounts of data to identify attack behavior. Although APT attacks are more sophisticated and employ more diverse attack methods than ordinary network attacks, the ultimate goal remains the implantation of malware on target machines. By studying the malware used in APT attacks and mining the malicious behavior of malicious samples developed by different APT groups, we can obtain relevant knowledge about APT attacks from another dimension, thereby generating corresponding detection rules or models and discovering suspicious attack events in log data. This can serve as an effective supplement to the two research directions mentioned above. APT groups modularize their tools during the development phase, flexibly applying different functional components in combination during a single attack. This leads to problems such as missing phase samples and significant functional differences between samples from the same organization.

[0004] Current research on APT malware samples is relatively limited. Malware-related research can be categorized into two types based on whether the malware sample is running: static analysis and dynamic analysis. Some researchers collect static information such as bytecode and n-grams to build APT malware detection frameworks, while others collect dynamic information such as system calls in virtual environments like sandboxes. Both methods combine machine learning techniques to build detection or classification models, but these methods have two problems. First, there are few labeled samples. Due to the limited number of available APT samples, the training requirements of traditional machine learning methods are insufficient, causing classifiers to tend to overfit on the training set. Second, the distribution of malware across functional domains varies among different APT groups. Samples scattered across various attack stages show significant functional differences, and this distributional variation can easily mislead the model's convergence direction, affecting classification performance. Third, it cannot identify unknown APT malware samples. Existing methods are conducted on closed datasets and cannot cope with the continuous emergence of new APT groups in real-world scenarios. Summary of the Invention

[0005] The purpose of this invention is to provide an APT malware classification method and apparatus based on predictive guided prototypes. It focuses on utilizing a pre-trained dynamic feature encoding algorithm, an organization classification algorithm based on predictive guided prototypes, and an open-set recognition algorithm based on ternary dynamic thresholds to quantify each dynamic API call of APT malware. Two independent encoders are used to calculate the feature representations of the auxiliary and main tasks for each software instance. The auxiliary task feature representations are used for functional classification, and the classification results are used to optimize the model construction of the main task for organization classification. Open-set recognition is achieved by dynamically calculating ternary thresholds to address the constantly emerging new APT attack groups.

[0006] This invention first collects malware instances from different APT attack groups, obtains their functional category labels using open-source threat intelligence websites, and acquires API call sequences through sandbox simulation. It then uses a designed pre-trained dynamic feature encoding algorithm to numerically encode each API call. Next, it uses a designed organization classification algorithm based on prediction-guided prototypes to construct a prototype feature representation for each organization's malware instance and predicts the classification probability of the malware sample to be tested. Finally, it uses a designed open-set recognition algorithm based on ternary dynamic thresholds to dynamically calculate ternary thresholds and achieve open-set recognition, in order to address the constantly emerging new APT attack groups.

[0007] The technical solution adopted in this invention is as follows:

[0008] A method for classifying APT malware based on a predictive prototype, the method comprising:

[0009] Obtain the API call sequence of the malware, and based on the BERT word embedding model, obtain the global feature encoding of the API call sequence and the numerical encoding sequence of the API call sequence;

[0010] Feature extraction is performed on the numerically encoded sequence for auxiliary function classification and primary tissue classification tasks to obtain local feature codes for auxiliary function classification and primary tissue classification tasks. Based on the concatenation results of the global feature codes with the local feature codes for auxiliary function classification and primary tissue classification tasks, feature vector representations for auxiliary function classification and primary tissue classification tasks are obtained.

[0011] The auxiliary function classification task feature vector is used to fit the Gaussian distribution of the function categories in the feature space to obtain the predicted probability of the malware in each function category;

[0012] By combining the predicted probabilities of the malware in each functional category, the feature vector representation of the main organization classification task is fitted with the multimodal distribution of organization categories in the feature space to obtain the predicted probabilities of the malware in each organization category; wherein, the Gaussian distribution of the functional categories and the multimodal distribution of the organization categories are obtained based on labeled samples;

[0013] Based on the predicted probability of the malware in each organizational category, the malware classification results are obtained.

[0014] Further, the step of obtaining the global feature encoding of the API call sequence and the numerical encoding sequence of the API call sequence based on the BERT word embedding model includes:

[0015] A token named

cls

[0016] The modified API call sequence is input into the BERT word embedding model to obtain the API call encoding sequence H = (h1, h2, ..., h S );

[0017] Use encoding h1 as the global feature encoding, and encode (h2,…,h) S () is the numerical encoding sequence of the API call sequence.

[0018] Further, the step of extracting features for the auxiliary function classification task from the numerically encoded sequence to obtain local feature codes for the auxiliary function classification task, and obtaining feature vector representations for the auxiliary function classification task and main organization classification task based on the concatenation result of the global feature code and the local feature codes for the auxiliary function classification task, includes:

[0019] With step size d on the numerical coding sequence k Sd obtained by sliding k Each convolutional feature map;

[0020] Max pooling is used to select the maximum feature from each convolutional feature map, and then the maximum features are concatenated to form a fixed-length auxiliary function classification task local feature code h. c ;

[0021] The local feature encoding of the assistive function classification task h c The global feature encoding is input into a multilayer perceptron to obtain the feature vector representation of the assistive function classification task.

[0022] Further, the step of using the feature vector representation of the auxiliary function classification task to fit a Gaussian distribution of the function categories in the feature space to obtain the predicted probability of the malware on each function category includes:

[0023] Mapping the feature vector representation x of the assistive function classification task to the feature space yields the feature mapping f. F (x); x represents the malicious software;

[0024] Calculate the feature map f F (x) and functional category l F Prototype representation Euclidean distance between Wherein, the prototype represents x i Let represent the feature vector representation of the auxiliary function classification task for the i-th labeled example. Indicates belonging to functional category l F A set of annotated examples;

[0025] Based on the Euclidean distance The malware was obtained in functional category l F The predicted probability.

[0026] Further, the step of combining the predicted probabilities of the malware in each functional category to fit the feature vector representation of the main organization classification task to a multimodal distribution of organization categories in the feature space, in order to obtain the predicted probabilities of the malware in each organization category, includes:

[0027] The feature vector representations of the main organizational classification task are mapped to the feature space to obtain the feature mapping f. G (x′); x′ represents the malicious software;

[0028] Calculate the feature map f G (x′) and organizational category l G Prototype representation Euclidean distance between Wherein, the prototype represents l G Indicates the organization category of the prototype point to be calculated. This represents the set of functional categories in the labeled sample set for this classification task. F Represents a set of functional categories Functional categories in, x j This represents the j-th labeled example in the organization classification task. Indicates organization category l G And the functional category is l F A set of labeled examples This indicates that the organization category is l G After setting the prediction probability of a function category that does not exist in the labeled sample set to 0, the sample is normalized to predict function category l. F The probability of;

[0029] Based on the Euclidean distance The malware was found to be in organization category l G The predicted probability.

[0030] Furthermore, the process of obtaining malware classification results based on the predicted probabilities of the malware in each organizational category includes:

[0031] Based on the multimodal distribution of organization categories in the feature space of the labeled samples, a classification confidence matrix is ​​calculated, and a ternary threshold for each organization category is calculated according to the classification confidence matrix; the ternary threshold includes: an acceptance threshold, a rejection threshold, and an interval threshold;

[0032] Obtain the maximum and second-largest predicted probabilities of the malware across each organization category;

[0033] If the maximum predicted probability is greater than the acceptance threshold, the organization category corresponding to the maximum predicted probability is determined to be the organization category of the malware.

[0034] When the maximum predicted probability is between the acceptance threshold and the rejection threshold, the difference between the maximum predicted probability and the second largest predicted probability is calculated. When the difference is greater than the interval threshold, the organization category corresponding to the maximum predicted probability is determined to be the organization category of the malware. When the difference is less than the interval threshold, the organization category of the malware is determined to be an unknown category.

[0035] If the maximum predicted probability is less than the rejection threshold, the organization category of the malware is determined to be an unknown category.

[0036] Further, the calculation of the classification confidence matrix based on the multimodal distribution of organization categories in the feature space of labeled samples, and the calculation of the ternary threshold for each organization category based on the classification confidence matrix, includes:

[0037] Based on the multi-peak distribution of organizational categories, obtain l for each organizational category G Prototype representation

[0038] Calculate the elements in the classification confidence matrix Where d represents the Euclidean distance calculation. Indicates belonging to an organization category A set of labeled examples; f G (x) represents the mapping of the labeled sample x in the feature space;

[0039] Calculate organization category Acceptance threshold ρ represents the first empirical parameter;

[0040] Calculate organization category rejection threshold η i =κD ii κ represents the first empirical parameter, and κ < ρ;

[0041] Calculate organization category Interval threshold ε represents the third empirical parameter.

[0042] An APT malware classification device based on a prediction-guided prototype, the device comprising:

[0043] The data acquisition module is used to acquire the API call sequence of malware, and based on the BERT word embedding model, acquire the global feature encoding of the API call sequence and the numerical encoding sequence of the API call sequence;

[0044] The feature representation module is used to extract features from the numerically encoded sequence for auxiliary function classification tasks and major tissue classification tasks, to obtain local feature codes for auxiliary function classification tasks and local feature codes for major tissue classification tasks, and to obtain feature vector representations for auxiliary function classification tasks and major tissue classification tasks based on the concatenation results of the global feature codes with the local feature codes for auxiliary function classification tasks and the local feature codes for major tissue classification tasks, respectively.

[0045] The probability calculation module is used to fit a Gaussian distribution of functional categories in the feature space using the feature vector representation of the auxiliary function classification task to obtain the predicted probability of the malware in each functional category; and to combine the predicted probability of the malware in each functional category with the feature vector representation of the main organization classification task to fit a multimodal distribution of organization categories in the feature space to obtain the predicted probability of the malware in each organization category; wherein the Gaussian distribution of functional categories and the multimodal distribution of organization categories are obtained based on labeled samples;

[0046] The results generation module is used to obtain malware classification results based on the predicted probability of the malware in each organization category.

[0047] An electronic device is characterized by comprising a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing any of the methods described above.

[0048] A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method described in any of the preceding claims.

[0049] Compared with the prior art, the present invention has at least the following advantages:

[0050] 1) This invention fully leverages the semantic associations of API call contexts learned from large-scale unlabeled common malware samples. Furthermore, auxiliary tasks are set up and their classification results are used to optimize the computation of the prototype, effectively utilizing limited supervisory information. A plug-and-play ternary dynamic threshold enhances the ability to identify unknown organizations, enabling this method to classify APT malware and identify unknown categories under low data resource conditions.

[0051] 2) This invention proposes a pre-trained dynamic feature encoding method, which can make full use of the semantic association of API call context learned from large-scale unlabeled common malware samples, thereby improving the expressive power of dynamic feature sequences of malware.

[0052] 3) This invention proposes an organization classification method based on prediction-guided prototypes. This method can integrate global context features of API calls while focusing on the strong correlations between local API call fragments, achieving a mapping from feature encoding sequences to a feature space specific to the classification task. By predicting the probability distribution of the functional categories of the test samples, the method optimizes the organization prototype representation, resulting in more accurate and efficient representation and organization classification capabilities.

[0053] 4) This invention proposes an open set recognition method based on a ternary dynamic threshold. This method can dynamically obtain a ternary classification threshold to describe the distribution of known categories. The threshold loss and open set loss are combined to improve the open set recognition performance in low-resource scenarios. Attached Figure Description

[0054] Figure 1 This is a flowchart of an APT malware classification method based on a predictive guidance prototype. Detailed Implementation

[0055] The present invention will be further described in detail below through specific embodiments and illustrations.

[0056] The APT malware classification method based on prediction-guided prototypes provided by this invention is suitable for extracting vectorized representations of APT malware by utilizing unsupervised learning API calls to contextual semantic relationships. At the same time, the addition of the functional category prediction auxiliary task enhances the feature learning ability, and the prediction results are used to guide the generation of prototypes to eliminate the bias of distribution differences. It can achieve open set identification and classification tasks using limited supervised samples.

[0057] This invention provides a method for classifying APT malware based on a predictive prototype, such as... Figure 1 As shown, it includes the following steps:

[0058] Step 1: Obtain the API call sequence of the malware, and based on the BERT word embedding model, obtain the global feature encoding of the API call sequence and the numerical encoding sequence of the API call sequence.

[0059] This invention uses a pre-trained dynamic feature encoding algorithm to acquire global feature encoding and numerical encoding sequences. During training, malware instances from different APT groups are first collected. For each APT group, publicly available APT reports with attribution evidence are collected, and APT reports belonging to aliases of the APT group are merged to collect malware instances. For each APT malware instance, its functional category is determined through open-source threat intelligence, and it is simulated and executed using a sandbox to form a dynamic API call sequence. For the API calls of a malware instance, a feature extraction function is used to sequentially extract numerical encoding sequences. Specifically, for each assembly instruction or API call of each malware instance, a large-scale pre-trained word embedding model is used to learn the semantic similarity of API calls from unsupervised non-APT malware data to obtain global feature encoding and numerical encoding sequences.

[0060] In a preferred embodiment of the present invention, the unstructured threat intelligence parsing technique described in the pre-trained dynamic feature encoding algorithm is as follows: In order to obtain malware instances from different APT organizations, it is necessary to parse and identify the specific APT attack organizations and malware hash values ​​involved in the specific APT attack from open-source APT organization attack reports reported globally. Specifically, by constructing and maintaining a list of APT organizations and their aliases, as well as a series of hash value regular expressions, duplicate APT organizations and malware lists are removed to obtain a real dataset of malware set organization labels.

[0061] In a preferred embodiment of the present invention, the malware intelligence crawling technology described in the pre-trained dynamic feature encoding algorithm is as follows: for each malware hash value, a crawler is used to call an API to crawl malware and related security vendor analysis results from the open-source threat intelligence website VirusTotal. The malware functional category label is obtained by processing the security vendor analysis results. Specifically, based on Kaspersky's labeling, if more than two-thirds of the security vendors agree with the results, the functional category of this sample is confirmed.

[0062] In a preferred embodiment of this invention, the API call encoding technique in the pre-trained dynamic feature encoding algorithm is as follows: For each APT attack-related malware instance, the open-source Cuckoo Sandbox is used to simulate its execution, forming a dynamic API call sequence. For each malware instance's API call sequence, a feature extraction function is used to sequentially extract numerical embedding sequences. Specifically, the large-scale pre-trained word embedding model BERT is used to learn the semantic similarity of API calls from a corpus composed of a large number of unsupervised non-APT malware API call encoding sequences mixed with a limited number of APT malware API call encoding sequences. Each API call of the malware instance is numerically encoded. Specifically, two pre-training tasks are set: API call sequence masking and subsequent API call prediction, to capture the deep contextual relationships between sequence elements. Since the amount of unlabeled malware in the wild is large, it is sufficient to learn the contextual relationships in API calls. BERT pre-trained encoding is also suitable for APT malware classification tasks because the prior knowledge about how malware works via APIs, implicit in the encoding, is beneficial to downstream APT malware classification problems. Adding a [CLS] classification field before and after the API call as a w that can participate in network learning... task Task-related parameter fields are input to the pre-trained BERT model, and its hidden layer states are used as numerical encoding sequences of API call sequences. The model output corresponding to [CLS] is used as the global feature encoding.

[0063] The following is a formal representation of the API call encoding sequence:

[0064] W = (w1, w2, ..., w s )

[0065] H = {h1, h2, ..., h} s} = BERT({w1, w2, ..., w s}, w task )

[0066] Where W is a discrete sequence of malware API call tokens, and w1 is a special token used for classification—[CLS], w task These are the learnable task-related parameter fields. H represents the hidden layer state output by the BERT model, where w task It was separated and will not participate in the coding related to subsequent tasks.

[0067] Step 2: Extract features from the numerically encoded sequence for auxiliary function classification and primary tissue classification tasks to obtain local feature codes for auxiliary function classification and primary tissue classification tasks. Based on the concatenation results of the global feature codes with the local feature codes for auxiliary function classification and primary tissue classification tasks, respectively, obtain feature vector representations for auxiliary function classification and primary tissue classification tasks.

[0068] First, this invention utilizes a one-dimensional convolutional deep neural network encoder model to extract features from the numerical coding sequence calculated by the BERT pre-trained model. Specifically, for each numerical coding sequence of malware, local feature codes for assistive function classification tasks and organization classification tasks are calculated respectively.

[0069] In a preferred embodiment of the present invention, the present invention further extracts local hidden states through a parameter-non-sharing neural network model to obtain malware feature representations in a specific task feature space. Specifically, a one-dimensional convolutional neural network is used to further encode the hidden state sequence, and local information is collected to obtain local feature encoding h. c .

[0070] Then, the local feature encoding h c The hidden state h1 corresponding to the [CLS] token is input into a multilayer perceptron for dimensionality reduction to obtain a malware representation vector for a specific task.

[0071] The following is a formal representation of malware representation vectors for a specific task:

[0072]

[0073]

[0074] e = W1·GeLU(W2·{h1, h) c}+b2)+b1,

[0075] in, It is a convolution kernel In the hidden state sequence (h2, h3, ..., h S ) with step size d k Sd obtained by sliding k Each convolutional feature map is represented by a CNN(·). The CNN(·) operation selects the largest feature from each convolutional feature map using max pooling, and then concatenates these features to form a fixed-length local feature encoding h. c W2 and b2 are linear mapping parameters, GeLU(·) is the activation function, and e is the malware representation vector in the metric space for a specific task.

[0076] Step 3: Use the auxiliary function classification task feature vector representation to fit the Gaussian distribution of function categories in the feature space to obtain the predicted probability of the malware in each function category; combine the predicted probability of the malware in each function category to fit the main organization classification task feature vector representation to fit the multimodal distribution of organization categories in the feature space to obtain the predicted probability of the malware in each organization category.

[0077] For each functional category and organizational category, this invention calculates the prototype representation of that category based on the feature representation of malware samples with known labels in the feature space; for each malware sample to be tested, the functional category probability distribution of the sample is predicted in the feature space based on the distance to the functional origin under Euclidean metric, and this probability distribution is used to optimize the calculation of the origin representation of the organizational category; for each malware sample to be tested, the organizational category probability distribution of the sample is predicted in the feature space based on the distance to the organizational origin under Euclidean metric.

[0078] In a preferred embodiment of this invention, the type prototype calculation technique described in the organization classification based on prediction-guided prototypes is as follows: For malware representation vectors in the metric space under a specific task, the prototype network learns parameters to ensure that the feature vectors encoded by different samples are dispersed in different Gaussian distributions in the feature space; the prototype is an estimate of the mean of the Gaussian distribution. Next, using labeled samples in the task, a prototype is calculated for each category, and then labels are assigned to the samples to be tested. To address the problem in the main organization classification task where functional differences lead to differences in the API call sequences corresponding to malware samples of the same organization, making it difficult to learn a good prototype in the organization origination feature encoding space, the objective of the prototype network is changed to fitting a multimodal distribution. First, the functional category of malware samples in the auxiliary functional classification task is predicted, and then a prediction-guided prototype network is designed to eliminate the interference caused by this difference. For auxiliary tasks, the prototype network model is simply applied.

[0079] The following is a formal representation of the prediction probability calculation process in the auxiliary function classification task:

[0080]

[0081]

[0082] Among them, f F (·) represents the mapping from the malware instance space to the feature representation space in the accessibility classification task. It belongs to the functional category. F A set of labeled examples For functional category l F The prototype representation, where d(·,·) represents the Euclidean distance. The malware samples to be tested are categorized into category l. F The probability of.

[0083] The following is a formal representation of the prediction probability calculation process in major organizational classification tasks:

[0084]

[0085] Among them, f G (·) indicates the mapping from the malware instance space to the feature representation space in the main organizational classification task. It is an organization category l G And the functional category is l F The set consists of labeled samples. Due to the scarcity of APT attack samples, the labeled sample set may lack samples for certain functional categories. To ignore function classes that do not exist in the labeled sample set, i.e., after setting the prediction probability of that class to 0, the normalized sample is predicted to be function class l. F The probability, For example x j Organizational categories G Similarly, the prototype represents the use of softmax to calculate the classification of malware sample organizations into category l. G probability

[0086] Step 4: Based on the predicted probability of the malware in each organization category, obtain the malware classification result.

[0087] This invention presents an open-set identification algorithm based on a ternary dynamic threshold. In the feature space, a classification confidence matrix is ​​calculated based on malware samples of known categories. Specifically, the diagonal elements describe the degree of cohesion within a category, and the off-diagonal elements represent the interval between categories. Using the obtained classification confidence matrix, a ternary threshold consisting of an acceptance threshold, a rejection threshold, and an interval threshold is dynamically calculated for each organization category. For each labeled malware instance, an open-set loss is calculated to train a neural network model. For each malware instance to be tested, the obtained ternary threshold is compared with the predicted probability distribution of its organization category to determine whether it belongs to an unknown category.

[0088] In a preferred embodiment of the present invention, the classification confidence matrix calculation technique in the open set recognition algorithm based on ternary dynamic thresholds is as follows: Given the feature representation of the main organization classification task of an APT malware instance, after feature learning by the above algorithm, the feature space should follow the trend of small intra-class representation spacing and large inter-class spacing, that is, the malware should be closer to its actual class prototype and farther away from the prototypes of other classes. The classification confidence matrix is ​​calculated using the predicted probability of the labeled instances.

[0089] The following is the formal representation of the calculation of the classification confidence matrix:

[0090]

[0091] In this context, the element Dij in the classification confidence matrix is ​​defined as the class... Annotated instances are predicted to be of category The expected value of the probability, whose diagonal element D ii The in-class feature describes the degree of cohesion of the distribution, and the off-diagonal element D ij The interval of the distribution of features between classes is represented by softmax, which normalizes the direct distance results to avoid outliers from having a significant impact on the mean.

[0092] In a preferred embodiment of the present invention, the dynamic ternary threshold calculation technique in the open set recognition algorithm based on ternary dynamic thresholding involves: given the classification confidence matrix of the main organizational classification task, dynamically calculating the ternary threshold (acceptance threshold ζ) for each category. i Rejection threshold η i Interval threshold θ i ).

[0093] The following is a formal representation of the dynamic calculation of the ternary threshold:

[0094] ζ i =ρD ii

[0095] η i =kD ii

[0096]

[0097] Where 0 < ρ, κ, ε < 1 are empirical parameters, and the acceptance threshold ζ is used. i The higher the value, the higher the category. The more compact the distribution of the feature representation, the smaller the interval threshold θ. i The higher the value, the greater the gap between it and the rest of the categories.

[0098] In a preferred embodiment of the present invention, the unknown category determination technique in the open set recognition algorithm based on ternary dynamic thresholds is as follows: given ternary dynamic thresholds for each category in the main organization classification task, for each malware instance to be tested, its predicted probability distribution and the ternary dynamic thresholds are combined to determine its category. Specifically, it is assumed that the category corresponding to the maximum predicted probability is... The second largest value corresponds to the category The decision criteria for the classifier are as follows: If Category determination like It has been determined to be an unknown category. The size is in ζ i and η i The range between these values ​​indicates that classifying this sample is relatively difficult. In this case, it is necessary to further consider the correlation information between categories and calculate... and The difference, if the difference is greater than θ i The category is determined as follows. Otherwise, it is an unknown category.

[0099] In a preferred embodiment of the present invention, the open set loss calculation technique in the open set recognition algorithm based on ternary dynamic thresholds is as follows: Given the classification prediction of training examples for the main organizational classification task, for examples of visible categories, cross-entropy loss is used as the training function to address misclassification caused by low confidence in the sample being predicted as the correct label. A ternary loss is introduced to narrow the distance with the positive example prototype while widening the distance with the negative example prototype. To address misclassification caused by the small difference between the predicted probabilities of the correct label and the misclassified label, parameter learning is used to reduce intra-class differences in the feature space, increase the interval of the visible category distribution, and enhance the classification ability. For examples of invisible categories, by maximizing the entropy function of the predicted probability of the visible category, the sample is rejected when its predicted probability for any visible category is very small or close to the predicted probability.

[0100] The following is a formal representation of the open-set recognition loss calculation:

[0101]

[0102]

[0103] Where γ is an empirical parameter, The loss calculation function for visible category samples. The loss calculation function for samples of the invisible category.

[0104] Example 1 uses a pre-trained dynamic feature encoding algorithm and a prediction-guided prototype-based organization classification algorithm to classify APT malware organizations.

[0105] Using the self-collected dataset Few-APTMW as an example dataset, the Few-APTMW dataset contains 9,575 malware from 59 APT attack groups, with at least 15 malware instances from each group. Dynamic API call sequences were collected using Cuckoo Sandbox, with functional categories including downloaders, loaders, backdoors, and spyware.

[0106] 1) First, experiments were conducted on the APT software dataset to obtain the dynamic API call sequence of malware in Few-APTMW;

[0107] 2) Using a BERT word embedding model pre-trained in a corpus of API call sequences of large-scale common malware, add classification fields and task-specific fields to numerically encode the API call sequences obtained in 1) for accessibility classification tasks and main organization classification tasks.

[0108] 3) For assistive function classification tasks and major tissue classification tasks, a one-dimensional convolutional neural network without shared parameters is used to extract local feature encodings;

[0109] 4) Connect the global and local feature encodings in 2) and 3), use GeLU as the activation function of the MLP, and extract feature vector representations for the auxiliary function classification task and the main tissue classification task, respectively;

[0110] 5) For the feature vector representation of the auxiliary function classification task obtained in 4), according to the function category, fit the mean of the Gaussian distribution of the category in the feature space as the prototype representation of the category, and use Euclidean distance combined with the Softmax function to calculate the function category prediction probability of the test sample.

[0111] 6) For the functional category prediction probability of the test sample obtained in 5), the tissue category prototype representation for the test sample is optimized by fitting the multimodal distribution in the special space, and the tissue category prediction probability of the test sample is calculated by using Euclidean distance combined with the Softmax function.

[0112] The results of the method of this invention are compared with those of other methods. The baseline methods (MANNWARE, SIMPLE, Markov Chain) are trained on the training set of the Few-APTMW dataset and tested on the partitioned test set. The classification accuracy (%) and F1 score (%) are shown.

[0113] Table 1. Accuracy and F1 score of our method compared to other methods for APT malware classification on the Few-APTMW dataset.

[0114]

[0115] Example 2 uses a pre-trained dynamic feature encoding algorithm, a prediction-guided prototype-based organization classification algorithm, and a ternary dynamic threshold-based open-set recognition algorithm to classify APT malware organizations.

[0116] Using the self-collected dataset Few-APTMW as an example dataset, the Few-APTMW dataset contains 9,575 malware from 59 APT attack groups, with at least 15 malware instances from each group. Dynamic API call sequences were collected using Cuckoo Sandbox, with functional categories including downloaders, loaders, backdoors, and spyware.

[0117] 1) First, experiments were conducted on the APT software dataset to obtain the dynamic API call sequence of malware in Few-APTMW;

[0118] 2) Using a BERT word embedding model pre-trained in a corpus of API call sequences of large-scale common malware, add classification fields and task-specific fields to numerically encode the API call sequences obtained in 1) for accessibility classification tasks and main organization classification tasks.

[0119] 3) For assistive function classification tasks and major tissue classification tasks, a one-dimensional convolutional neural network without shared parameters is used to extract local feature encodings;

[0120] 4) Connect the API call sequence numerical encoding and local feature encoding in 2) and 3), use GeLU as the activation function of MLP, and extract feature vector representations for assistive function classification task and main tissue classification task respectively;

[0121] 5) For the feature vector representation of the auxiliary function classification task obtained in 4), according to the function category, fit the mean of the Gaussian distribution of the category in the feature space as the prototype representation of the category, and use Euclidean distance combined with the Softmax function to calculate the function category prediction probability of the test sample.

[0122] 6) For the functional category prediction probability of the test sample obtained in 5), by fitting the multimodal distribution in the special space, optimize the calculation of the tissue category prototype representation for the test sample, and use Euclidean distance combined with the Softmax function to calculate the tissue category prediction probability of the labeled sample and the test sample.

[0123] 7) For the predicted organization category probabilities of the labeled samples obtained in 6), calculate the classification confidence matrix, dynamically calculate the ternary threshold based on the classification confidence matrix, and realize open set recognition by comparing the predicted organization category probabilities of the test samples with the ternary threshold.

[0124] The results of the method of this invention are compared with those of other methods. The baseline methods (MANNWARE, SIMPLE, Markov Chain) are trained on the training set of the Few-APTMW dataset and tested on the partitioned test set. The classification accuracy (%) and F1 score (%) are shown.

[0125] Table 2. Accuracy and F1 score of our method compared with other methods for open-set APT malware identification on the Few-APTMW dataset.

[0126]

[0127] The results in Tables 1 and 2 demonstrate the superiority of the malware classification method based on collaborative attention proposed in this invention.

[0128] In summary, this invention employs a large-scale pre-trained word embedding model for each APT malware instance to be identified. This model learns the semantic similarity of API calls from unsupervised non-APT malware data. A one-dimensional convolutional neural network model is combined to extract vectorized representations of malware for both auxiliary function classification and primary organization classification tasks. The prototype representation for the primary task is optimized by predicting the probability distribution of the auxiliary task. A plug-and-play open-set loss and dynamic ternary threshold are introduced, enabling open-set identification and classification tasks using limited supervised samples. First, this invention collects malware instances from different APT organizations and obtains API call sequences through sandbox simulation. Then, using a pre-trained word embedding model, the dynamic API call sequence of each malware is quantified, transforming each API call into a numerically encoded sequence. Next, using the quantified dynamic and static feature sequences, prototype feature representations corresponding to each functional category and organization category, as well as feature representations for each malware, are constructed. The category distribution probability is calculated using Euclidean distance in the feature space. Finally, during the malware feature representation construction process, the distribution of known malware instances in the feature space is used to dynamically calculate the ternary classification threshold, achieving open-set identification of APT malware to counter emerging APT attack organizations.

[0129] Based on the same inventive concept, another embodiment of the present invention provides an APT malware classification device based on a prediction-guided prototype, comprising:

[0130] The data acquisition module is used to acquire the API call sequence of malware, and based on the BERT word embedding model, acquire the global feature encoding of the API call sequence and the numerical encoding sequence of the API call sequence;

[0131] The feature representation module is used to extract features from the numerically encoded sequence for auxiliary function classification tasks and major tissue classification tasks, to obtain local feature codes for auxiliary function classification tasks and local feature codes for major tissue classification tasks, and to obtain feature vector representations for auxiliary function classification tasks and major tissue classification tasks based on the concatenation results of the global feature codes with the local feature codes for auxiliary function classification tasks and the local feature codes for major tissue classification tasks, respectively.

[0132] The probability calculation module is used to fit a Gaussian distribution of functional categories in the feature space using the feature vector representation of the auxiliary function classification task to obtain the predicted probability of the malware in each functional category; and to combine the predicted probability of the malware in each functional category with the feature vector representation of the main organization classification task to fit a multimodal distribution of organization categories in the feature space to obtain the predicted probability of the malware in each organization category; wherein the Gaussian distribution of functional categories and the multimodal distribution of organization categories are obtained based on labeled samples;

[0133] The results generation module is used to obtain malware classification results based on the predicted probability of the malware in each organization category.

[0134] For the specific implementation process of each module, please refer to the description of the method of the present invention above.

[0135] Based on the same inventive concept, another embodiment of the present invention provides an electronic device (computer, server, smartphone, etc.) including a memory and a processor, wherein the memory stores a computer program configured to be executed by the processor, and the computer program includes instructions for performing the steps of the method of the present invention.

[0136] Based on the same inventive concept, another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk), which stores a computer program that, when executed by a computer, implements the various steps of the method of the present invention.

[0137] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Those skilled in the art can modify or make equivalent substitutions to the technical solutions of the present invention without departing from the spirit and scope of the present invention. The scope of protection of the present invention should be determined by the claims.

Claims

1. A method for classifying APT malware based on predictive prototype guidance, characterized in that, The method includes: Obtain the API call sequence of the malware, and based on the BERT word embedding model, obtain the global feature encoding of the API call sequence and the numerical encoding sequence of the API call sequence; Feature extraction is performed on the numerically encoded sequence for auxiliary function classification and primary tissue classification tasks to obtain local feature codes for auxiliary function classification and primary tissue classification tasks. Based on the concatenation results of the global feature codes with the local feature codes for auxiliary function classification and primary tissue classification tasks, feature vector representations for auxiliary function classification and primary tissue classification tasks are obtained. The auxiliary function classification task feature vector is used to fit the Gaussian distribution of the function categories in the feature space to obtain the predicted probability of the malware in each function category; By combining the predicted probabilities of the malware in each functional category, the feature vector representation of the main organization classification task is fitted with the multimodal distribution of organization categories in the feature space to obtain the predicted probabilities of the malware in each organization category; wherein, the Gaussian distribution of the functional categories and the multimodal distribution of the organization categories are obtained based on labeled samples; Based on the predicted probability of the malware in each organizational category, the malware classification results are obtained; The step of obtaining the global feature encoding of the API call sequence and the numerical encoding sequence of the API call sequence based on the BERT word embedding model includes: A [cls] token was added before the API call sequence; The modified API call sequence is input into the BERT word embedding model to obtain the API call encoding sequence. ; Encode As a global feature encoding, and the encoding As a numerically encoded sequence of the API call sequence; Specifically, feature extraction for the auxiliary function classification task is performed on the numerically encoded sequence to obtain local feature codes for the auxiliary function classification task. Based on the concatenation results of the global feature codes and the local feature codes for the auxiliary function classification task, a feature vector representation for the auxiliary function classification task is obtained, including: With step size on the numerical coding sequence Slide, get Each convolutional feature map; Max pooling is used to select the maximum feature from each convolutional feature map, and then the maximum features are concatenated to form a fixed-length auxiliary function local feature encoding for classification tasks. ; Encode the local features of the assistive function classification task. The global feature encoding is input into a multilayer perceptron to obtain the feature vector representation of the assistive function classification task.

2. The method as described in claim 1, characterized in that, The step of using the auxiliary function classification task feature vector representation to fit a Gaussian distribution of the function categories in the feature space to obtain the predicted probability of the malware in each function category includes: Representing the feature vector of assistive function classification tasks Mapping to the feature space yields the feature map. ; Calculate feature mapping With functional categories Prototype representation Euclidean distance between Wherein, the prototype represents , Let represent the feature vector representation of the auxiliary function classification task for the i-th labeled example. Indicates belonging to a functional category A set of annotated examples; Based on the Euclidean distance The malware was obtained in the functional category. The predicted probability.

3. The method as described in claim 1, characterized in that, The step of combining the predicted probabilities of the malware in each functional category to fit the feature vector representation of the main organization classification task to a multimodal distribution of organization categories in the feature space, in order to obtain the predicted probabilities of the malware in each organization category, includes: The feature vector representations of the main organizational classification tasks are mapped to the feature space to obtain the feature mapping. ; Calculate feature mapping With organization category Prototype representation Euclidean distance between Wherein, the prototype represents , Indicates the organization category of the prototype point to be calculated. This represents the set of functional categories in the labeled sample set for this classification task. Represents a set of functional categories Functional categories in, x j This represents the j-th labeled example in the organization classification task. Indicates the organization category as And the functional category is A set of labeled examples This indicates that the organization category is... After setting the prediction probability of a function category that does not exist in the labeled sample set to 0, the sample is normalized to predict the function category. The probability of; Based on the Euclidean distance The malware was obtained in the organization category. The predicted probability.

4. The method as described in claim 1, characterized in that, The malware classification results, based on the predicted probabilities of the malware in each organizational category, include: Based on the multimodal distribution of organization categories in the feature space of the labeled samples, a classification confidence matrix is ​​calculated, and a ternary threshold for each organization category is calculated according to the classification confidence matrix; the ternary threshold includes: an acceptance threshold, a rejection threshold, and an interval threshold; Obtain the maximum and second-largest predicted probabilities of the malware across each organization category; If the maximum predicted probability is greater than the acceptance threshold, the organization category corresponding to the maximum predicted probability is determined to be the organization category of the malware. When the maximum predicted probability is between the acceptance threshold and the rejection threshold, the difference between the maximum predicted probability and the second largest predicted probability is calculated. When the difference is greater than the interval threshold, the organization category corresponding to the maximum predicted probability is determined to be the organization category of the malware. When the difference is less than the interval threshold, the organization category of the malware is determined to be an unknown category. If the maximum predicted probability is less than the rejection threshold, the organization category of the malware is determined to be an unknown category.

5. An APT malware classification device based on a predictive guidance prototype, characterized in that, The device includes: The data acquisition module is used to acquire the API call sequence of malware, and based on the BERT word embedding model, acquire the global feature encoding of the API call sequence and the numerical encoding sequence of the API call sequence; The feature representation module is used to extract features from the numerically encoded sequence for auxiliary function classification tasks and major tissue classification tasks, to obtain local feature codes for auxiliary function classification tasks and local feature codes for major tissue classification tasks, and to obtain feature vector representations for auxiliary function classification tasks and major tissue classification tasks based on the concatenation results of the global feature codes with the local feature codes for auxiliary function classification tasks and the local feature codes for major tissue classification tasks, respectively. The probability calculation module is used to fit a Gaussian distribution of functional categories in the feature space using the feature vector representation of the auxiliary function classification task to obtain the predicted probability of the malware in each functional category; and to combine the predicted probability of the malware in each functional category with the feature vector representation of the main organization classification task to fit a multimodal distribution of organization categories in the feature space to obtain the predicted probability of the malware in each organization category; wherein the Gaussian distribution of functional categories and the multimodal distribution of organization categories are obtained based on labeled samples; The result generation module is used to obtain malware classification results based on the predicted probability of the malware in each organization category; The step of obtaining the global feature encoding of the API call sequence and the numerical encoding sequence of the API call sequence based on the BERT word embedding model includes: A [cls] token was added before the API call sequence; The modified API call sequence is input into the BERT word embedding model to obtain the API call encoding sequence. ; Encode As a global feature encoding, and the encoding As a numerically encoded sequence of the API call sequence; Specifically, feature extraction for the auxiliary function classification task is performed on the numerically encoded sequence to obtain local feature codes for the auxiliary function classification task. Based on the concatenation results of the global feature codes and the local feature codes for the auxiliary function classification task, a feature vector representation for the auxiliary function classification task is obtained, including: With step size on the numerical coding sequence Slide, get Each convolutional feature map; Max pooling is used to select the maximum feature from each convolutional feature map, and then the maximum features are concatenated to form a fixed-length auxiliary function local feature encoding for classification tasks. ; Encode the local features of the assistive function classification task. The global feature encoding is input into a multilayer perceptron to obtain the feature vector representation of the assistive function classification task.

6. An electronic device, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method according to any one of claims 1 to 4.

Images