Method and apparatus for detecting repackaged malicious application software

Abstract

The application discloses a kind of heavy repackaging malicious application software detection method and device, wherein the method includes: obtaining normal application dataset and malicious application dataset, and carrying out static analysis to normal application dataset and malicious application dataset, respectively obtaining the API path set of normal application and the API path set of malicious application;Malicious application API path set is input into the LSTM network of normal application trained, and the malicious path set is constructed, and the LSTM network of normal application is obtained by training the API path set of normal application;According to the public substring corresponding to the malicious path set constructed, the feature vector of the application to be detected is constructed by searching the public substring;The feature vector of the application to be detected is input into the classifier, and whether the application to be detected is heavy repackaging malicious application software is determined according to the label output by the classifier.The application can detect malicious behavior of long sequence path by matching long sequence path.

Description

Technical Field

[0001] This invention relates to the field of internet security technology, and in particular to a method and apparatus for detecting repackaged malicious application software. Background Technology

[0002] This section is intended to provide background or context for the embodiments of the invention set forth in the claims. The description herein is not an admission that it is prior art simply because it is included in this section.

[0003] In today's internet landscape, various types of malware are emerging in an endless stream, posing a significant challenge to internet security and seriously harming people's production and lifestyles. Therefore, malware detection has always been a hot topic. However, due to the wide variety and complex functions of malware, most missed cases in existing malware detection results are caused by repackaged malware. When extracting features from repackaged malicious applications, existing solutions mainly extract features from the perspective of the entire application. However, since malicious code in repackaged malware is formed through injection, it only accounts for a small portion of the total code. This means that the overall behavioral characteristics of the application can mask the behavioral characteristics of the malicious code, which is a major reason for missed detections. Therefore, malware is usually detected by detecting malicious behavior paths. Existing methods for identifying malware through paths only consider the transition of the preceding state, and can only detect malicious behavior with short path sequences. However, some paths representing malicious behavior are long sequences, and considering only the transition of one state along the path will lead to missed detections of malicious behavior with long path sequences. Therefore, there is an urgent need for a detection model that can detect malware with long path sequences. Summary of the Invention

[0004] This invention provides a method for detecting repackaged malicious application software. It detects malicious behavior along long path sequences by matching these sequences, and distinguishes the category of the detected malicious application software based on common characteristics of these malicious behaviors. The method includes:

[0005] Obtain normal application datasets and malicious application datasets, and perform static analysis on the normal application datasets and malicious application datasets to obtain the API path sets of normal applications and malicious applications, respectively.

[0006] The malicious application's API path set is input into the trained LSTM network of the normal application to construct the malicious path set. The normal application's LSTM network is trained from the normal application's API path set.

[0007] Based on the constructed malicious path set, the common substrings corresponding to the malicious paths are obtained. The common substrings are searched to construct the feature vector of the application to be detected.

[0008] The feature vector of the application to be detected is input into the classifier, and the detection result of the application to be detected is determined based on the label output by the classifier.

[0009] This invention also provides a device for detecting repackaged malicious application software, used to detect malicious behavior of long sequence paths by matching long sequence paths, and to distinguish the category of the detected malicious application software based on the common characteristics of the malicious behavior. The device includes:

[0010] The API path set acquisition module is used to acquire normal application datasets and malicious application datasets, and perform static analysis on the normal application datasets and malicious application datasets to obtain the API path sets of normal applications and malicious applications respectively.

[0011] The malicious path set construction module is used to input the API path set of the malicious application into the trained LSTM network of the normal application to construct the malicious path set. The LSTM network of the normal application is trained from the API path set of the normal application.

[0012] The feature vector construction module is used to obtain the common substrings corresponding to the malicious paths based on the constructed malicious path set, search the common substrings, and construct the feature vector of the application to be detected.

[0013] The malicious application detection module is used to input the feature vector of the application to be detected into the classifier, and determine the detection result of the application to be detected based on the label output by the classifier.

[0014] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-described method for detecting repackaged malicious application software.

[0015] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for detecting repackaged malicious application software.

[0016] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described method for detecting repackaged malicious application software.

[0017] Existing methods for identifying malicious applications based on paths only consider the transition of the preceding state, thus only detecting malicious behavior with short path sequences. However, some paths representing malicious behavior are long sequences, and considering only one state transition within the path will lead to missed detections of malicious behavior along long paths. To avoid these shortcomings, this invention trains an LSTM neural network on the API path set of a normal application dataset, then inputs the API path set of a malicious application dataset into the LSTM neural network to construct a malicious path set and perform cluster analysis. Based on the cluster analysis, common substrings corresponding to each type of malicious path are obtained. A classifier then uses the feature vector of the application under test constructed from these common substrings to detect malicious applications. This allows for the detection of malicious behavior along long paths, and by extracting common features of malicious behavior belonging to the same category, the category of the detected malicious application can be distinguished. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0019] Figure 1 This is a flowchart of the method for detecting repackaged malicious application software in an embodiment of the present invention;

[0020] Figure 2 This is a schematic diagram illustrating the construction of feature vectors in an embodiment of the present invention;

[0021] Figure 3 This is a schematic diagram of the method for detecting repackaged malicious application software in an embodiment of the present invention;

[0022] Figure 4 This is a schematic diagram of the malicious application software repackaging detection device in an embodiment of the present invention;

[0023] Figure 5 This is a schematic diagram of a specific repackaging malicious application software detection device in an embodiment of the present invention;

[0024] Figure 6 This is a schematic diagram of a specific repackaging malicious application software detection device in an embodiment of the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0026] A detailed explanation of some key terms:

[0027] 1. LSTM (Long Short-Term Memory) is a type of recurrent neural network primarily designed to address the vanishing and exploding gradient problems encountered during the training of long sequences in RNNs. It is suitable for processing and predicting important events with very long intervals and delays in time series. Simply put, compared to ordinary RNNs, LSTM performs better with longer sequences.

[0028] 2. An API (Application Programming Interface) is a set of predefined functions, or an agreement between different components of a software system. It provides applications and developers with a set of routines accessible to them based on certain software or hardware, without requiring access to the source code or understanding of the internal workings. Typically, malicious software requires calls to specific APIs to function; for example, malicious billing software calls the SMS sending API, and privacy-stealing software calls the contact access API. These types of APIs are called sensitive APIs.

[0029] Figure 1 This is a flowchart of a method for detecting repackaged malicious application software in an embodiment of the present invention. The method includes:

[0030] Step 101: Obtain the normal application dataset and the malicious application dataset, and perform static analysis on the normal application dataset and the malicious application dataset to obtain the API path set of the normal application and the API path set of the malicious application respectively.

[0031] Step 102: Input the API path set of the malicious application into the trained LSTM network of the normal application to construct the malicious path set. The LSTM network of the normal application is trained from the API path set of the normal application.

[0032] Step 103: Based on the constructed malicious path set, obtain the common substrings corresponding to the malicious paths, search the common substrings, and construct the feature vector of the application to be detected.

[0033] Step 104: Input the feature vector of the application to be detected into the classifier, and determine the detection result of the application to be detected based on the label output by the classifier.

[0034] The following provides a detailed explanation of each step.

[0035] In step 101, a normal application dataset and a malicious application dataset are obtained, and static analysis is performed on the normal application dataset and the malicious application dataset to obtain the API path set of the normal application and the API path set of the malicious application, respectively.

[0036] In one embodiment, static analysis is performed on normal application datasets and malicious application datasets, including:

[0037] Extract the API call graphs from the normal application dataset and the malicious application dataset respectively, and analyze the corresponding API call paths based on the respective API call graphs;

[0038] Based on the corresponding API call paths, obtain the API path set for normal applications and the API path set for malicious applications.

[0039] In one embodiment, the API path set consists of multiple API paths, which are a sequence of different APIs arranged in the order of their calls.

[0040] In step 102, the set of API paths of the malicious application is input into the trained LSTM network of the normal application to construct the malicious path set. The LSTM network of the normal application is trained from the set of API paths of the normal application.

[0041] In a specific embodiment, a normal application dataset is constructed, and API paths are extracted from all applications in the normal application dataset. Then, each path is treated as a sentence and encoded, and then fed into an LSTM model for learning. The final output LSTM model is an LSTM neural network that contains only normal application path information.

[0042] In one embodiment, the malicious application's API path set is input into a trained LSTM network of a normal application to construct the malicious path set, including:

[0043] The first n-1 API paths in the API path set are input into the trained LSTM neural network of a normal application to predict the probability of the nth API path. Based on the probability of the nth API path, it is determined whether the nth API path is a malicious path. If so, it is added to the malicious path set.

[0044] Where n is the number of API path sets.

[0045] In one embodiment, determining whether an API path is malicious based on its probability of occurrence includes:

[0046] Obtain the probability of each API path appearing in the API path set, and sort the probabilities of each API path appearing.

[0047] If the probability ranking of the nth API path is after the preset order, then the API path is determined to be a malicious path.

[0048] In a specific implementation, the path is determined to be malicious by probability. LSTM predicts a probability distribution. By analyzing the API sequence (API sub-path) consisting of the first n-1 APIs, LSTM can give the probability of the nth API appearing. Since the trained LSTM is a model that only contains information about normal application paths, if the predicted probability of the nth API appearing is high, it means that it has likely already appeared in a normal path. Conversely, if the predicted probability is low, it means that it may not have appeared in a normal path, i.e., it is likely a malicious path. Assuming there are 100 different APIs in the path set, after analyzing the API sub-path, LSTM will give the probability of all APIs appearing after this API sub-path, with each API receiving a probability. After obtaining the probability of all APIs appearing, we sort these APIs according to the probability values ​​and predefine a threshold m. When the actual nth API is not among the first m, the path is determined to be a malicious path. Assuming m = 50, if the probability ranking of the nth API in a path is below 50, then the path is considered a malicious path.

[0049] In one embodiment, based on the constructed malicious path set, the common substrings corresponding to the malicious paths are obtained, including:

[0050] Cluster analysis is performed on the constructed malicious path set to obtain multiple classes;

[0051] For each type of malicious path, extract the corresponding common sub-path as a common substring.

[0052] In a specific embodiment, for the constructed malicious path set, all malicious path sets are first clustered. Paths are treated as strings, and the similarity between different strings is calculated. Similar malicious paths are clustered into the same category. For each category of malicious paths, the paths of that category are extracted as common substrings. The common substrings extracted from different categories are used as signatures.

[0053] In step 103, based on the constructed malicious path set, the common substrings corresponding to the malicious paths are obtained, and the common substrings are searched to construct the feature vector of the application to be detected.

[0054] In a specific embodiment, the process of constructing the feature vector includes: as follows Figure 2As shown, assume there are 7 common substrings extracted by LSTM and clustering. The suspicious application extracted 5 paths through static analysis. During the search process, it was found that path 1 contains common substring 1, path 2 does not contain any common substring, path 3 contains common substring 3, path 4 contains common substring 4, and path 5 does not contain any common substring. Therefore, the feature vector of the suspicious application is (1,0,1,1,0,0,0).

[0055] In one embodiment, searching for common substrings to construct a feature vector of the application to be detected includes:

[0056] A common substring search is performed on the API path to be detected. If the API path to be detected contains a common substring, the label of the feature vector is 1; if the API path to be detected does not contain a common substring, the label of the feature vector is 0.

[0057] In step 104, the feature vector of the application to be detected is input into the classifier, and the detection result of the application to be detected is determined based on the label output by the classifier.

[0058] In one embodiment, determining the detection result of the application to be detected based on the label output by the classifier includes:

[0059] If the classifier outputs a label of 1, it indicates a repackaged malicious application; if the classifier outputs a label of 0, it indicates a normal application.

[0060] like Figure 3 The diagram illustrates the principle of the malicious application detection method in this embodiment of the invention. Specifically, it is divided into a malicious feature mining stage and a malicious software detection stage. The mining stage utilizes an LSTM model to obtain malicious paths and extracts common substrings from these paths to detect malicious software. The specific steps are as follows:

[0061] API path sets are extracted from normal and malicious application datasets. An API path set consists of multiple API paths, and an API path is a sequence of different APIs called in that order. A normal LSTM neural network is trained on the API path set of the normal application dataset. Then, the API path set of the malicious application dataset is input into the trained normal LSTM neural network to detect malicious paths in the malicious application dataset. These paths are clustered to obtain common substrings for each cluster. These common substrings are used to construct features for the application under test to detect malware. The purpose of the mining phase is to train the LSTM neural network on normal application paths to analyze malicious paths in the malicious application path set and then extract common substrings from the malicious paths. This mainly consists of four steps: static analysis to obtain API paths, training the LSTM neural network, constructing a malicious path set using the LSTM neural network, and extracting common substrings from the malicious paths.

[0062] The purpose of the detection phase is to classify whether the application to be detected is malware. An output of 1 indicates malware, while an output of 0 indicates normal software. It mainly consists of two steps: static analysis to obtain the application's API path and using public path search to extract feature vectors to detect malware.

[0063] This invention also provides a device for detecting repackaged malicious application software, as described in the following embodiments. Since the principle by which this device solves the problem is similar to that of the method for detecting repackaged malicious application software, the implementation of this device can refer to the implementation of the method for detecting repackaged malicious application software; repeated details will not be elaborated further.

[0064] like Figure 4 This is a schematic diagram of a malicious application software repackaging detection device according to an embodiment of the present invention. The device includes:

[0065] API path set acquisition module 401 is used to acquire normal application datasets and malicious application datasets, and perform static analysis on the normal application datasets and malicious application datasets to obtain the API path sets of normal applications and malicious applications respectively.

[0066] The malicious path set construction module 402 is used to input the API path set of the malicious application into the trained LSTM network of the normal application to construct the malicious path set. The LSTM network of the normal application is trained from the API path set of the normal application.

[0067] The feature vector construction module 403 is used to obtain the common substrings corresponding to the malicious paths based on the constructed malicious path set, search the common substrings, and construct the feature vector of the application to be detected.

[0068] The malicious application software judgment module 404 is used to input the feature vector of the application to be detected into the classifier and determine the detection result of the application to be detected based on the label output by the classifier.

[0069] like Figure 5 The diagram shown is a schematic of a specific repackaging malicious application software detection device according to an embodiment of the present invention. In one embodiment, it further includes a static analysis module 501, used for:

[0070] Extract the API call graphs from the normal application dataset and the malicious application dataset respectively, and analyze the corresponding API call paths based on the respective API call graphs;

[0071] Based on the corresponding API call paths, obtain the API path set for normal applications and the API path set for malicious applications.

[0072] like Figure 6 The diagram shown is a schematic of a specific repackaging malicious application software detection device according to an embodiment of the present invention. In one embodiment, it further includes a common substring acquisition module 601, used for:

[0073] Cluster analysis is performed on the constructed malicious path set to obtain multiple classes;

[0074] For each type of malicious path, extract the corresponding common sub-path as a common substring.

[0075] In one embodiment, the API path set consists of multiple API paths, which are a sequence of different APIs arranged in the order of their calls.

[0076] In one embodiment, the malicious path set construction module 402 is used for:

[0077] The first n-1 API paths in the API path set are input into the trained LSTM neural network of a normal application to predict the probability of the nth API path. Based on the probability of the nth API path, it is determined whether the nth API path is a malicious path. If so, it is added to the malicious path set.

[0078] Where n is the number of API path sets.

[0079] In one embodiment, the malicious path set construction module 402 is further configured to:

[0080] Obtain the probability of each API path appearing in the API path set, and sort the probabilities of each API path appearing.

[0081] If the probability ranking of the nth API path is after the preset order, then the API path is determined to be a malicious path.

[0082] In one embodiment, the feature vector construction module 403 is used for:

[0083] A common substring search is performed on the API path to be detected. If the API path to be detected contains a common substring, the label of the feature vector is 1; if the API path to be detected does not contain a common substring, the label of the feature vector is 0.

[0084] In one embodiment, the malicious application software repackaging judgment module 404 is used for:

[0085] If the classifier outputs a label of 1, it indicates a repackaged malicious application; if the classifier outputs a label of 0, it indicates a normal application.

[0086] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-described method for detecting repackaged malicious application software.

[0087] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for detecting repackaged malicious application software.

[0088] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described method for detecting repackaged malicious application software.

[0089] Existing methods for identifying malicious applications based on paths only consider the transition of the preceding state, thus only detecting malicious behavior with short path sequences. However, some paths representing malicious behavior are long sequences, and considering only one state transition within the path will lead to missed detections of malicious behavior along long paths. To avoid these shortcomings, this invention trains an LSTM neural network on the API path set of a normal application dataset, then inputs the API path set of a malicious application dataset into the LSTM neural network to construct a malicious path set and perform cluster analysis. Based on the cluster analysis, common substrings corresponding to each type of malicious path are obtained. A classifier then uses the feature vector of the application under test constructed from these common substrings to detect malicious applications. This allows for the detection of malicious behavior along long paths, and by extracting common features of malicious behavior belonging to the same category, the category of the detected malicious application can be distinguished.

[0090] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0091] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0092] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0093] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0094] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting repackaged malicious application software, characterized in that, include: Obtain normal application datasets and malicious application datasets, and perform static analysis on the normal application datasets and malicious application datasets to obtain the API path sets of normal applications and malicious applications, respectively. The malicious application's API path set is input into the trained LSTM network of the normal application to construct the malicious path set. The normal application's LSTM network is trained from the normal application's API path set. Based on the constructed malicious path set, the common substrings corresponding to the malicious paths are obtained. The common substrings are searched to construct the feature vector of the application to be detected. The feature vector of the application to be detected is input into the classifier, and the detection result of the application to be detected is determined based on the label output by the classifier. The step of inputting the API path set of the malicious application into the trained LSTM network of the normal application to construct the malicious path set includes: The API sequence consisting of the first n-1 APIs in the API path set of the malicious application is input into the LSTM neural network of the normal application, and the probability of the nth API appearing is predicted and sorted. If the probability of the nth API appearing is after the preset order, the nth API path is determined to be a malicious path and added to the malicious path set.

2. The method as described in claim 1, characterized in that, Static analysis was performed on normal application datasets and malicious application datasets, including: Extract the API call graphs from the normal application dataset and the malicious application dataset respectively, and analyze the corresponding API call paths based on the respective API call graphs; Based on the corresponding API call paths, obtain the API path set for normal applications and the API path set for malicious applications.

3. The method as described in claim 1, characterized in that, Based on the constructed set of malicious paths, the common substrings corresponding to the malicious paths are obtained, including: Cluster analysis is performed on the constructed malicious path set to obtain multiple classes; For each type of malicious path, extract the corresponding common sub-path as a common substring.

4. The method as described in claim 1, characterized in that, The API path set consists of multiple API paths, which are a sequence of different APIs arranged in the order of their calls.

5. The method as described in claim 1, characterized in that, Searching for common substrings to construct the feature vector of the application to be detected, including: A common substring search is performed on the API path to be detected. If the API path to be detected contains a common substring, the label of the feature vector is 1; if the API path to be detected does not contain a common substring, the label of the feature vector is 0.

6. The method as described in claim 5, characterized in that, The detection result of the application to be detected is determined based on the labels output by the classifier, including: If the classifier outputs a label of 1, it indicates a repackaged malicious application; if the classifier outputs a label of 0, it indicates a normal application.

7. A device for detecting repackaged malicious application software, characterized in that, include: The API path set acquisition module is used to acquire normal application datasets and malicious application datasets, and perform static analysis on the normal application datasets and malicious application datasets to obtain the API path sets of normal applications and malicious applications respectively. The malicious path set construction module is used to input the API path set of the malicious application into the trained LSTM network of the normal application to construct the malicious path set. The LSTM network of the normal application is trained from the API path set of the normal application. The feature vector construction module is used to obtain the common substrings corresponding to the malicious paths based on the constructed malicious path set, search the common substrings, and construct the feature vector of the application to be detected. The malicious application software detection module is used to input the feature vector of the application to be detected into the classifier and determine the detection result of the application to be detected based on the label output by the classifier. The malicious path set construction module is specifically used to: input the API sequence consisting of the first n-1 APIs in the API path set of the malicious application into the trained LSTM neural network of the normal application, predict the probability of the nth API appearing and sort it. If the probability of the nth API appearing is after the preset order, then the nth API path is determined to be a malicious path and added to the malicious path set.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 6.

Images