A malicious sample classification method and device, electronic equipment and storage medium

Abstract

The application discloses a malicious sample classification method and device, electronic equipment and a storage medium, to solve the problem of low accuracy of the existing malicious sample classification method. The malicious sample classification method comprises: obtaining the communication flow information of the to-be-processed malicious sample, the communication flow information being the data flow information of each network node in the running process of the to-be-processed malicious sample; extracting the session communication information of each session stage from the communication flow information of each to-be-processed malicious sample, and generating the corresponding session communication information sequence based on the session communication information of each session stage; determining the similarity of each two to-be-processed malicious samples according to the corresponding session communication information sequences of each two to-be-processed malicious samples; and classifying the to-be-processed malicious samples according to the similarity of each two to-be-processed malicious samples to obtain a classification result.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a method, apparatus, electronic device, and storage medium for classifying malicious samples. Background Technology

[0002] Malicious samples refer to malware (or code) designed to attack computers, servers, clients, IoT devices, computer networks, or other smart devices, or to steal user information. Malicious samples include viruses, Trojans, worms, adware, installers, spyware, and malicious browser plugins. Classifying malicious samples has become a research hotspot in recent years to facilitate their analysis.

[0003] In related technologies, two main methods are used for classifying malicious samples: static analysis and dynamic analysis. Static analysis involves acquiring information such as the code and file structure of the malicious sample to extract its features, which are called static features. Classification is based on these static features. However, the extraction of static features is subject to many constraints, making it difficult to fully explore the dynamic behavioral characteristics of malicious samples. Furthermore, due to the diverse types and methods of malicious attacks, static analysis struggles to establish a unified classification basis for all types of malicious samples. Dynamic analysis involves running the malicious sample and analyzing its behavior during execution to extract features, which are called dynamic features. Classification is based on these dynamic features. However, dynamic analysis requires significant time and computational resources, making it unsuitable for analyzing large-scale data. Moreover, because of the wide variety of malicious samples and the unique dynamic features of each sample, dynamic analysis cannot guarantee the accuracy of classifying all malicious samples. Summary of the Invention

[0004] To address the problems in the background art, embodiments of this application provide a method, apparatus, electronic device, and storage medium for classifying malicious samples.

[0005] Firstly, embodiments of this application provide a method for classifying malicious samples, including:

[0006] Obtain the communication traffic information of the malicious sample to be processed, wherein the communication traffic information is the data traffic information flowing through each network node during the operation of the malicious sample to be processed;

[0007] The session communication information of each session stage is extracted from the communication traffic information of each malicious sample to be processed, and the corresponding session communication information sequence is generated based on the session communication information of each session stage.

[0008] Based on the session communication information sequence corresponding to each pair of malicious samples to be processed, the similarity between each pair of malicious samples to be processed is determined.

[0009] The malicious samples to be processed are classified according to the similarity between each pair of malicious samples to be processed, and the classification results are obtained.

[0010] In one possible implementation, session communication information for each session stage is extracted from the communication traffic information of each malicious sample to be processed, specifically including:

[0011] For each malicious sample to be processed, the various session stages in the communication traffic information of the malicious sample to be processed are determined based on the five-tuple information corresponding to the malicious sample to be processed.

[0012] Extract the session information of each session stage from the preset fields corresponding to each session stage;

[0013] The session information of each session stage is determined as the session communication information of each session stage.

[0014] In one possible implementation, the similarity between each pair of malicious samples to be processed is determined based on the session communication information sequence corresponding to each pair of malicious samples to be processed, specifically including:

[0015] For any two malicious samples to be processed, two session communication messages in the same session phase in the session communication message sequence are signed respectively to generate signature information for each of the two session communication messages.

[0016] The similarity score of the two session communication messages is determined based on the similarity of their signature information.

[0017] The similarity between any two malicious samples to be processed is determined based on the similarity scores of the two session communication messages of the same session stage in the session communication message sequence corresponding to any two malicious samples to be processed.

[0018] In one possible implementation, a similarity score is determined for the two session communication messages based on the similarity of their signature information, specifically including:

[0019] Based on the similarity between the signature information of the two session communication messages, a matching score is determined for the signature information of the two session communication messages, and the matching score represents the degree of similarity matching between the two session communication messages;

[0020] Calculate the distance between the two session communication messages;

[0021] The similarity score of the two session communication messages is determined based on the matching score of the signature information of the two session communication messages and the distance between the two session communication messages.

[0022] In one possible implementation, the similarity between any two malicious samples to be processed is determined based on the similarity score of two session communication messages at the same session stage in the session communication message sequence corresponding to any two malicious samples to be processed, specifically including:

[0023] The similarity between any two malicious samples to be processed is determined based on the similarity score of the two session communication messages of the same session stage in the session communication message sequence corresponding to any two malicious samples to be processed, the preset length penalty term, and the length of the session communication message sequence corresponding to any two malicious samples to be processed.

[0024] In one possible implementation, the two session communication messages are signed respectively to generate signature information for each of the two session communication messages, specifically including:

[0025] For each session communication information, the session communication information is divided into blocks to obtain session communication information blocks;

[0026] Each session communication information block is hashed individually to obtain the hash value of each session communication information block;

[0027] Based on the hash value of each session communication information block, a signature of the session communication information is generated.

[0028] In one possible implementation, a matching score is determined based on the similarity between the signature information of the two session communication messages, specifically including:

[0029] The signature information of the two session communication messages is divided into blocks to generate corresponding signature information blocks for each;

[0030] Calculate the weighted edit distance between the signature information blocks at the same position in the signature information of the two session communication messages one by one;

[0031] If the weighted edit distance between any two signature information blocks is less than a first preset threshold, then the two signature information blocks are determined to be similar.

[0032] The matching score of the signature information of the two session communication messages is determined based on the number of similar signature information block pairs and the number of signature information blocks of each of the two session communication messages.

[0033] In one possible implementation, calculating the distance between the two session communication messages specifically includes:

[0034] Calculate the N-gram distance between the two session communication messages based on the N-gram model; and

[0035] Based on the matching score and distance of the signature information of the two session communication messages, the similarity score of the two session communication messages is determined, specifically including:

[0036] The similarity score of the two session communication messages is determined based on the matching score of the signature information of the two session communication messages and the N-gram distance between the two session communication messages.

[0037] In one possible implementation, the similarity score of the two session communication messages is determined based on the matching score of the signature information of the two session communication messages and the N-gram distance between the two session communication messages, specifically including:

[0038] The similarity score of the two session communication messages is calculated using the following formula:

[0039]

[0040] Wherein, Score represents the similarity score of the two session communication messages;

[0041] match score This represents the matching score of the signature information of the two session communication messages;

[0042] d represents the N-gram distance between the two session communication messages;

[0043] α and β are constants.

[0044] In one possible implementation, the similarity between any two malicious samples to be processed is determined based on the similarity score of two session communication messages at the same session stage in the session communication message sequence corresponding to any two malicious samples to be processed, a preset length penalty term, and the length of the session communication message sequence corresponding to any two malicious samples to be processed. Specifically, this includes:

[0045] The similarity between any two malicious samples to be processed is calculated using the following formula:

[0046]

[0047] Wherein, Similarity represents the similarity between any two malicious samples to be processed;

[0048] Score i The similarity score of two session communication messages in the i-th same session phase in the session communication message sequence corresponding to any two malicious samples to be processed is represented by N, which represents the number of the same session phase in the session communication message sequence corresponding to any two malicious samples to be processed.

[0049] len1 and len2 represent the lengths of the session communication information sequences corresponding to any two malicious samples to be processed, respectively;

[0050] γ represents the preset length penalty term, 0≤γ≤1.

[0051] In one possible implementation, the malicious samples to be processed are classified according to the similarity between every two malicious samples to be processed, and a classification result is obtained, specifically including:

[0052] For every two malicious samples to be processed, if the similarity between the two malicious samples to be processed is greater than a second preset threshold, then the two malicious samples to be processed are determined to be malicious samples of the same category.

[0053] Secondly, embodiments of this application provide a malicious sample classification device, comprising:

[0054] The acquisition unit is used to acquire the communication traffic information of the malicious sample to be processed, wherein the communication traffic information is the data traffic information flowing through each network node during the operation of the malicious sample to be processed;

[0055] The generation unit is used to extract session communication information of each session stage from the communication traffic information of each malicious sample to be processed, and generate a corresponding session communication information sequence based on the session communication information of each session stage.

[0056] The determining unit is used to determine the similarity between each pair of malicious samples to be processed based on the session communication information sequence corresponding to each pair of malicious samples to be processed.

[0057] The classification unit is used to classify the malicious samples to be processed based on the similarity between every two malicious samples to be processed, and to obtain the classification result.

[0058] In one possible implementation, the generation unit is specifically configured to, for each malicious sample to be processed, determine each session stage in the communication traffic information of the malicious sample to be processed based on the five-tuple information corresponding to the malicious sample to be processed; extract the session information of each session stage from the preset fields corresponding to each session stage; and determine the session information of each session stage as the session communication information of each session stage.

[0059] In one possible implementation, the determining unit is specifically configured to: sign two session communication messages at the same session stage in the session communication message sequence corresponding to any two malicious samples to be processed, respectively, to generate signature information for each of the two session communication messages; determine a similarity score for the two session communication messages based on the similarity of their signature information; and determine the similarity between any two malicious samples to be processed based on the similarity scores of the two session communication messages at each of the same session stages in the session communication message sequence corresponding to any two malicious samples to be processed.

[0060] In one possible implementation, the determining unit is specifically configured to: determine a matching score for the signature information of the two session communication messages based on the similarity between the signature information of the two session communication messages, wherein the matching score characterizes the degree of similarity matching between the two session communication messages; calculate the distance between the two session communication messages; and determine a similarity score between the two session communication messages based on the matching score of the signature information of the two session communication messages and the distance between the two session communication messages.

[0061] In one possible implementation, the determining unit is specifically used to determine the similarity between any two malicious samples to be processed based on the similarity score of two session communication messages of the same session stage in the session communication message sequence corresponding to any two malicious samples to be processed, a preset length penalty term, and the length of the session communication message sequence corresponding to any two malicious samples to be processed.

[0062] In one possible implementation, the determining unit is specifically configured to: divide the session communication information into blocks for each session communication information to obtain session communication information blocks; perform hash calculations on each session communication information block to obtain a hash value for each session communication information block; and generate signature information for the session communication information based on the hash value of each session communication information block.

[0063] In one possible implementation, the determining unit is specifically configured to divide the signature information of the two session communication messages into blocks to generate corresponding signature information blocks for each; calculate the weighted edit distance between signature information blocks at the same position in the signature information of the two session communication messages one by one; if the weighted edit distance between any two signature information blocks is less than a first preset threshold, then determine that any two signature information blocks are similar; and determine the matching score of the signature information of the two session communication messages based on the number of similar signature information block pairs and the number of signature information blocks in each of the two session communication messages.

[0064] In one possible implementation, the determining unit is specifically configured to calculate the N-gram distance between the two session communication messages based on an N-gram model; and to determine the similarity score of the two session communication messages based on the matching score of the signature information of the two session communication messages and the N-gram distance between the two session communication messages.

[0065] In one possible implementation, the determining unit is specifically configured to calculate the similarity score of the two session communication messages using the following formula:

[0066]

[0067] Wherein, Score represents the similarity score of the two session communication messages;

[0068] match score This represents the matching score of the signature information of the two session communication messages;

[0069] d represents the N-gram distance between the two session communication messages;

[0070] α and β are constants.

[0071] In one possible implementation, the determining unit is specifically configured to calculate the similarity between any two malicious samples to be processed using the following formula:

[0072]

[0073] Wherein, Similarity represents the similarity between any two malicious samples to be processed;

[0074] Score i The similarity score of two session communication messages in the i-th same session phase in the session communication message sequence corresponding to any two malicious samples to be processed is represented by N, which represents the number of the same session phase in the session communication message sequence corresponding to any two malicious samples to be processed.

[0075] len1 and len2 represent the lengths of the session communication information sequences corresponding to any two malicious samples to be processed, respectively;

[0076] γ represents the preset length penalty term, 0≤γ≤1.

[0077] In one possible implementation, the classification unit is specifically used to determine that the two malicious samples to be processed are malicious samples of the same category if the similarity between the two malicious samples to be processed is greater than a second preset threshold.

[0078] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the malicious sample classification method described in this application.

[0079] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the malicious sample classification method described in this application.

[0080] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings.

[0081] The beneficial effects of the embodiments of this application are as follows:

[0082] The malicious sample classification method, apparatus, electronic device, and storage medium provided in this application obtain communication traffic information of the malicious sample to be processed. This communication traffic information is the data traffic information flowing through various network nodes during the operation of the malicious sample. Session communication information for each session stage is extracted from the communication traffic information of each malicious sample to be processed. A corresponding session communication information sequence is generated based on the session communication information for each session stage. The similarity between each pair of malicious samples to be processed is determined according to their corresponding session communication information sequences. The malicious samples to be processed are then classified based on their similarity to obtain a classification result. Since the inventors of this application discovered that the communication traffic of two different malicious samples originating from the same malware family is similar... The presence of repetitive or extremely similar payloads during the session phase indicates a certain degree of similarity in communication traffic generated by samples originating from the same malware family when measured on a complete session basis. Therefore, this application extracts session communication information for each session phase from the communication traffic information of the malware samples to be processed, generating a sequence of session communication information for the complete session phase. By comparing the similarity of the session communication information sequences of different malware samples to be processed, the similarity of different malware samples is determined for classification. This allows for the rapid and accurate identification of new malware sample variants and the connections between different malware samples, thereby establishing a unified classification basis for all types of malware samples, improving the accuracy of malware sample classification, saving computational resources, and increasing classification efficiency. Attached Figure Description

[0083] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0084] Figure 1 This is a schematic diagram illustrating an application scenario of the malicious sample classification method provided in the embodiments of this application;

[0085] Figure 2 A schematic diagram illustrating the implementation process of the malicious sample classification method provided in this application embodiment;

[0086] Figure 3 A schematic diagram illustrating the implementation process of extracting session communication information of each session stage from the communication traffic information of each malicious sample to be processed, as provided in this application embodiment.

[0087] Figure 4 A schematic diagram illustrating the implementation process for determining the similarity between any two malicious samples to be processed, provided for an embodiment of this application;

[0088] Figure 5 This is a schematic diagram illustrating the implementation process for generating signature information for each session communication information provided in an embodiment of this application.

[0089] Figure 6 A schematic diagram illustrating the implementation process for determining the similarity score of two session communication information provided in this application embodiment;

[0090] Figure 7 A schematic diagram illustrating the implementation process for determining the matching score of signature information of two session communication messages, provided in an embodiment of this application;

[0091] Figure 8 This is a schematic diagram of the malicious sample classification device provided in the embodiments of this application;

[0092] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0093] To address the problems in the background art, embodiments of this application provide a method, apparatus, electronic device, and storage medium for classifying malicious samples.

[0094] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0095] In this document, it is important to understand that the technical terms used in this application refer to:

[0096] 1. Internet of Things (IoT): This refers to a network that enables various smart devices, sensors, tools, etc., to connect and communicate with each other via the internet, and to exchange, control, and manage data. IoT has wide applications in many fields such as homes, automobiles, healthcare, and industry.

[0097] 2. Malicious Samples: Malicious samples refer to malware (or code) designed to attack computers, servers, clients, IoT devices, computer networks, or other smart devices, or to steal user information. Malicious samples include, but are not limited to: viruses, Trojans, worms, adware, malicious installers, spyware, and malicious browser plugins.

[0098] 3. Communication Traffic: Communication traffic refers to data traffic involving multiple network nodes during network transmission. It includes communication traffic between the source and destination nodes, traffic from network relay nodes, etc. Communication traffic is one of the most important data sources in network security analysis.

[0099] In this application, the communication traffic information of the malicious sample to be processed (i.e., the malicious sample to be classified) is the data traffic information that flows through each network node during the operation of the malicious sample to be processed.

[0100] 4. Command and Control Server (C&C Server): This is the control center of the malicious sample (i.e., malware). It can send commands to the malware to perform operations, such as transferring data, launching programs, downloading updates, etc.

[0101] 5. Virtual Network Interface Card (NIC): A virtual NIC is a software interface device in a computer system that creates a virtual network interface card, enabling communication between different virtual networks. Virtual NICs are frequently used in network security for Hooking techniques and for hiding communication between command and control servers.

[0102] 6. Static Analysis: Static analysis is a method of analyzing programs without running them. By examining the program's source code, compiled code, and binary code, static analysis can identify vulnerabilities, errors, security risks, and other problems.

[0103] 7. Dynamic Analysis: Dynamic analysis is a method of analyzing programs. It requires running the program being analyzed and observing its behavior to analyze its operations, resource usage, system calls, and other information, thereby determining whether the program's logic and functions are correct.

[0104] 8. Traffic Black Hole: A traffic black hole is a node in a network that can absorb a large amount of data traffic without generating any response data. In the field of network security, traffic black holes are often used for traffic offloading and mitigation of network attacks.

[0105] 9. Sandbox: Also known as a sandbox environment, it's a virtual system program that allows software programs, browsers, or other programs to run in a sandbox environment, so changes made during the run can be subsequently deleted. It creates a sandbox-like isolated operating environment where software can be run first; if malicious behavior is detected, the program is prevented from running further without harming the system. In the field of network security, a sandbox refers to a tool used in an isolated environment to test the behavior of untrusted software, files, or applications.

[0106] 10. C&C Communication Protocol (Command and Control Protocol): Used to manage and control infected computers on a network. It controls infected computers by sending commands, such as obtaining machine information, attacking target machines, and distributing malware.

[0107] First refer to Figure 1 This is a schematic diagram illustrating an application scenario of the malicious sample classification method provided in this application embodiment. It may include a sandbox server 101 and a black hole server 102, and may also include other network nodes, such as a router 103, a command and control server (C&C server) 104, etc. The connection relationships between the devices are as follows: Figure 1 As shown. Sandbox server 101 is configured with a virtual network interface card (NIC) IP and port, and blackhole server 102 is configured with a blackhole interceptor and packet processing plugin. The malicious sample to be processed is executed in sandbox server 101. The original access path of the traffic generated by the execution of the malicious sample is directly through the network access address of command and control server 104. That is, sandbox server 101 first transmits the traffic generated by the execution of the malicious sample to router 103, and then router 103 forwards it to command and control server 104. Alternatively, it may directly perform network scanning and attempt to spread, which may result in the network exit being marked as insecure or posing a risk of infection to internal network devices. Therefore, a blackhole interceptor is additionally deployed on blackhole server 102 to intercept the communication traffic of the malicious sample. The communication traffic of the malicious sample to be processed is the data traffic flowing through various network nodes during the execution of the malicious sample, such as... Figure 1In this context, the communication traffic information of the malicious samples to be processed includes: data traffic of the malicious samples to be processed flowing from sandbox server 101 through router 103, and data traffic of the malicious samples to be processed flowing from router 103 through command and control server 104. First, sandbox server 101 encapsulates the traffic generated by the malicious samples to be processed using a VPN (Virtual Private Network) virtual network interface card (NIC). Then, it forwards the traffic of the malicious samples to be processed through the VPN NIC to the network egress NIC, routing it to blackhole server 102. Blackhole server 102, according to the configured packet filtering rules, can filter out the traffic of the malicious samples to be processed transmitted using the VPN NIC, mark and encrypt it, and then forward it to the blackhole interception program. Blackhole server 102 uses a packet processing plugin to modify the IP (Internet Protocol) address of the source server sandbox server to the IP address of the blackhole server. In this way, the response message returned by the destination server command and control server 104 will be directly returned to blackhole server 102, thereby preventing the communication traffic of the malicious samples from affecting other nodes in the system. Subsequently, after obtaining the communication traffic information of the malicious sample to be processed, the black hole server 102 executes the malicious sample classification process proposed in the embodiments of this application.

[0108] In this embodiment of the application, in addition to the sandbox server and the black hole server, other network node devices may include, but are not limited to, computers, servers, terminal devices, clients, IoT devices, network devices, or other smart devices, depending on the actual application scenario. This embodiment of the application does not limit this.

[0109] Based on the above application scenarios, the following will refer to the appendix. Figures 2-3 The exemplary embodiments of this application are described in more detail below. It should be noted that the above application scenarios are shown only to facilitate understanding of the spirit and principles of this application, and the implementation methods of this application are not limited in any way. On the contrary, the implementation methods of this application can be applied to any applicable scenario.

[0110] like Figure 2 The diagram shown illustrates the implementation flow of the malicious sample classification method provided in this application, which can be applied to... Figure 1 The black hole server 102 in the middle includes the following steps:

[0111] S21. Obtain the communication traffic information of the malicious sample to be processed.

[0112] In practice, the communication traffic information of the malicious sample to be processed is the data traffic information that flows through each network node during the operation of the malicious sample to be processed. The process by which the black hole server obtains the communication traffic information of the malicious sample to be processed will not be described here.

[0113] S22. Extract session communication information for each session stage from the communication traffic information of each malicious sample to be processed, and generate a corresponding session communication information sequence based on the session communication information for each session stage.

[0114] In specific implementation, it can be done according to the following: Figure 3 The process shown extracts session communication information for each session stage from the communication traffic information of each malicious sample to be processed. For each malicious sample to be processed, the following steps are performed:

[0115] S31. Based on the quintuple information corresponding to the malicious sample to be processed, determine each session stage in the communication traffic information of the malicious sample to be processed.

[0116] In practice, a 5-tuple includes: source IP address, destination IP address, source port, destination port, and transport layer protocol. The 5-tuple distinguishes different sessions, and each session is unique. For example, "192.168.xx, 10000, TCP (Transmission Control Protocol), 121.14.xx.xx, 80" constitutes a 5-tuple, indicating that a device with IP address 192.168.xx connects to a device with IP address 121.14.xx.xx and port 80 via port 10000 using the TCP protocol for data exchange.

[0117] In this step, after obtaining the communication traffic information of the malicious sample to be processed, the black hole server reconstructs each session stage in the communication traffic information of the malicious sample to be processed in the form of a five-tuple, based on the C&C communication protocol used by the malicious sample and the complete session stages required by the specific attack scenario, in order to perform complete session reconstruction. The C&C communication protocol used by the malicious sample and the complete session stages required by the specific attack scenario include, for example, the session flow of the TCP protocol used in the connection establishment phase of the malicious sample, the session flow of the IRC (Internet RelayChat) protocol, SMTP (Simple Mail Transfer Protocol) and other protocols used in the command receiving and response sending phase, and the session flow of the P2P (Peer to Peer) protocol, FTP (File Transfer Protocol) and other protocols used in the data transmission phase.

[0118] S32. Extract the session information of each session stage from the preset fields corresponding to each session stage.

[0119] In practice, session information for each session stage is extracted from the payload field (i.e., data field) corresponding to each session stage.

[0120] S33. Determine the session information of each session stage as the session communication information of each session stage.

[0121] In this step, the session information of each session stage is used as the session communication information of each session stage.

[0122] Among the communication traffic information of similar malicious samples, there are often specific patterns of behavior that appear as strings in the payload field of the traffic packets. For example, in the same session phase of the communication traffic of two malicious samples, the specific data in the payload field of the two malicious samples in this session phase is as follows:

[0123] The payload field of the first malicious sample in this session includes the following three parts:

[0124] Session part 1payload:617263682061726d76340a

[0125] Session part2 payload: 50494e47

[0126] Session part3 payload: 1b5c53376d0d0a

[0127] The string “617263682061726d76340a50494e471b5c53376d0d0a”, formed by concatenating the data from the payload fields of the three session parts, is the session communication information of the first malicious sample in this session phase.

[0128] The second malicious sample's payload field in this session includes the following three parts:

[0129] Session part1 payload: 617263682a53726dee340a

[0130] Session part2 payload: 50494e47

[0131] Session part3 payload: 369a3337659b0a

[0132] The string “617263682a53726dee340a50494e4750494e47”, formed by concatenating the data from the payload fields of the three session parts, is the session communication information of the second malicious sample in this session phase.

[0133] S23. Based on the session communication information sequence corresponding to each pair of malicious samples to be processed, determine the similarity between each pair of malicious samples to be processed.

[0134] In specific implementation, it can be done according to the following: Figure 4 The process shown determines the similarity between any two malicious samples to be processed, including the following steps:

[0135] S41. For any two session communication messages in the same session phase in the session communication message sequence corresponding to any two malicious samples to be processed, sign the two session communication messages respectively to generate signature information for each of the two session communication messages.

[0136] In practice, any two malicious samples to be processed are those whose communication traffic information includes at least one of the same session phase. If the communication traffic information of two malicious samples to be processed does not have the same session phase, it indicates that the two malicious samples to be processed are not similar and belong to different categories. There is no need to determine their similarity, thereby improving the efficiency of malicious sample classification.

[0137] In this step, a fuzzy hash algorithm may be used to generate the signature information of the session communication information, but this application embodiment does not limit this.

[0138] Specifically, it can be done according to such Figure 5 The process shown generates signature information for each session communication, including the following steps:

[0139] S51. For each session communication information, divide the session communication information into blocks to obtain session communication information blocks.

[0140] In specific implementation, for each session communication message in the same session phase of any two session communication messages corresponding to any two malicious samples to be processed, the session communication message is divided into blocks according to a first preset length, resulting in several session communication message blocks. Assuming the preset length is k, that is, the block size is k, the value of k can be set according to actual needs; this embodiment does not limit this.

[0141] Using the example listed in step S33, in the same session phase, the session communication information of the first malicious sample in this session phase is: "617263682061726d76340a50494e471b5c53376d0d0a", and the session communication information of the second malicious sample in this session phase is: "617263682a53726dee340a50494e4750494e47". Dividing these two strings into blocks, assuming the block size k = 4, then "617263682061726d76340a50494e471b5c53376d0d0a" can be divided into the following 11 blocks: "6172" The characters “6368”, “2061”, “726d”, “7634”, “0a50”, “494e”, “471b”, “5c53”, “376d”, “0d0a”, and “617263682a53726dee340a50494e4750494e47” can be divided into 10 blocks: “6172”, “6368”, “2a53”, “726d”, “ee34”, “0a50”, “494e”, “4750”, “494e”, and “47”. Since the length of the 10th block is less than k, it can be padded with 0s to make its length equal to k. Thus, the 10th block “47” becomes “4700” after being padded with two 0s.

[0142] S52. Perform hash calculation on each session communication information block one by one to obtain the hash value of each session communication information block.

[0143] In specific implementation, a local hash algorithm can be used to perform hash calculations on each session communication information block one by one to obtain the hash value of each session communication information block. The local hash algorithm can be, but is not limited to, the Spamsum algorithm, the Winnowing algorithm, the LSH (Locality Sensitive Hashing) algorithm, etc., and can also be any other hash algorithm. This application embodiment does not limit this.

[0144] Continuing with the previous example, let's take the Spamsum algorithm as an example for illustration.

[0145] For the 11 session communication blocks “6172”, “6368”, “2061”, “726d”, “7634”, “0a50”, “494e”, “471b”, “5c53”, “376d”, and “0d0a” corresponding to the first malicious sample, the Spamsum algorithm was used to calculate 11 64-bit hash values: hash1=Spamsum(6172), hash2=Spamsum(6368), hash3=Spamsum(2061), hash4=Spamsum(726d), hash5=Spamsum(7634), hash6=Spamsum(0a50), hash7=Spamsum(494e), hash8=Spamsum(471b), hash9=Spamsum(5c53), hash10=Spamsum(376d), and hash11=Spamsum(0d0a).

[0146] For the 10 session communication blocks “6172”, “6368”, “2a53”, “726d”, “ee34”, “0a50”, “494e”, “4750”, “494e”, and “4700” corresponding to the second malicious sample, the Spamsum algorithm was used to calculate 10 64-bit hash values: hash1 = Spamsum(6172), hash2 = Spamsum(6368), hash3 = Spamsum(2a53), hash4 = Spamsum(726d), hash5 = Spamsum(ee34), hash6 = Spamsum(0a50), hash7 = Spamsum(494e), hash8 = Spamsum(4750), hash9 = Spamsum(494e), hash10 = Spamsum(4700).

[0147] S53. Generate the signature information of the session communication information based on the hash value of each session communication information block.

[0148] In practice, for each session communication information, the hash values ​​of each session communication information block are concatenated in sequence into a complete string to obtain the hash signature information of the session communication information.

[0149] Employing fuzzy hashing algorithms allows for rapid calculation and comparison of hash values, improving the speed of malicious sample classification and saving computational resources. Furthermore, since malicious samples often have variants, such as those using obfuscation techniques like padding, offsetting, and encryption, conventional malicious sample classification may fail to address these variants. Fuzzy hashing algorithms, however, can calculate hash values ​​by segmenting the session communication information of malicious samples. Samples with high similarity but containing obfuscated variant parts will also have similar hash values, thus enabling more accurate identification of variant malicious samples.

[0150] S42. Determine the similarity score of two session communication messages based on the similarity of their signature information.

[0151] In specific implementation, it can be done according to the following: Figure 6 The process shown determines the similarity score between two session communication messages, including the following steps:

[0152] S61. Determine the matching score of the signature information of the two session communication messages based on the similarity between the signature information of the two session communication messages.

[0153] The matching score represents the degree of similarity between the communication messages of two sessions.

[0154] When implementing it, it can be done according to the following: Figure 7 The process shown determines the matching score of the signature information of two session communications, including the following steps:

[0155] S71. Divide the signature information of the two session communication messages into blocks and generate their respective signature information blocks.

[0156] In specific implementation, for the signature information of two session communication messages in the same session phase within the session communication information sequence corresponding to any two malicious samples to be processed, the signature information of these two session communication messages is divided into blocks according to a second preset length to obtain their respective corresponding signature information blocks. The second preset length, which is the block size, can be set according to actual needs, and this embodiment does not limit it. For example, it can be, but is not limited to, 64 bits.

[0157] Continuing with the previous example, assuming that the signature information of the session communication information corresponding to the first malicious sample in the same session stage, obtained from step S53, is: signature1, and the signature information of the session communication information corresponding to the second malicious sample is: signature2, then signature1 can be divided into n 64-bit signature information blocks: block1_1, block1_2, ..., block1_n, and signature2 can be divided into m 64-bit signature information blocks: block2_1, block2_2, ..., block2_m. When the last block block1_n and block2_m are less than 64 bits, zeros can be added to make it 64 bits.

[0158] S72. Calculate the weighted edit distance between signature information blocks at the same position in the signature information of two session communication messages one by one.

[0159] In this step, the weighted edit distance of the signature information blocks block1_i and block2_i of the two session communication information is calculated one by one.

[0160] Furthermore, to facilitate comparison, each calculated weighted edit distance can be quantized into an integer between 0 and 100.

[0161] This application embodiment is not limited to calculating the weighted edit distance between signature information blocks at the same position of the signature information of two session communication information. It can also calculate the Hamming distance, Jaccard distance, etc., between signature information blocks at the same position of the signature information of two session communication information, as well as any other algorithm that can calculate the distance between two objects. This application embodiment does not limit this.

[0162] For example, when calculating the Jaccard distance between two signature blocks, we can calculate the intersection of the two signature blocks, which is the number of characters that appear in both signature blocks, denoted as 'a'. Then, we can calculate the union of the two signature blocks, which is the number of characters that appear in both signature blocks, denoted as 'b'. Finally, we can calculate the Jaccard distance value between the two signature blocks using the formula J(A, B) = a / b. The Jaccard distance ranges from [0, 1]. The closer the value is to 1, the higher the similarity between the two signature blocks; the closer the value is to 0, the greater the difference between the two sets.

[0163] S73. If the weighted edit distance between any two signature information blocks is less than the first preset threshold, then any two signature information blocks are determined to be similar.

[0164] In this step, the smaller the edit distance, the fewer operations are required for one signature information block to be transformed into another signature information block through "add, delete, modify" operations, which means that the two are more similar. The first preset threshold can be set according to experience value, and this application embodiment does not limit it.

[0165] S74. Determine the matching score of the signature information of the two session communication messages based on the number of similar signature information block pairs and the number of signature information blocks of each of the two session communication messages.

[0166] In this step, when a pair of signature blocks at the same position in the signature information of two session communications is determined to be similar, 1 is incremented to count the number of similar signature block pairs. Then, the matching score of the signature information of the two session communications can be calculated using the following formula:

[0167]

[0168] Among them, match score The matching score of the signature information of the two session communication messages;

[0169] matched blocks This indicates the number of similar signature block pairs in the signature information blocks of the signature information of two session communication messages;

[0170] n and m are the number of signature information blocks in the signature information of the two session communication messages, respectively.

[0171] S62. Calculate the distance between two session communication messages.

[0172] In one implementation, the N-gram distance between two session communication messages can be calculated based on an N-gram model.

[0173] Specifically, the N-gram model is used to decompose each session communication information (string) into a set of all consecutive character sequences. The N-gram model includes the bi-gram model and the tri-gram model, and the appropriate model can be selected according to the requirements during implementation. This application does not limit the choice of model. The selected N-gram model is used to decompose two session communication information into their respective sets of consecutive N-gram sequences. For example, if the tri-gram model is used to decompose “617263682061726d76340a50494e471b5c53376d0d0a”, the corresponding N-gram sequence set can be obtained as: {617, 172, 726, 263, ..., d0d, 0d0, d0a}.

[0174] After obtaining the N-gram sequence sets corresponding to the two session communication information, a vector is formed from the probability distribution of each N-gram sequence set, and their respective N-gram matrices are constructed. The N-gram distance between the two session communication information is calculated based on each element in the two N-gram matrices. The specific calculation method is a mature algorithm in the existing technology, which will not be elaborated here.

[0175] Since session communication information originates from each stage of a complete session, it possesses context-dependent characteristics. Based on this, this embodiment calculates the N-gram distance between two session communication pieces. The N-gram matrix considers contextual information when calculating similarity, and when matching character sequences, it is not limited to a single character but considers larger units (multiple consecutive characters), thus capturing more context-related information and improving the accuracy of similarity calculation. For malicious sample variant obfuscation scenarios, N-gram distance is more advantageous than conventional character-based distance methods for similarity matching of multi-dimensional text (including tabs, special characters, and other padding or markings), further enhancing its ability to handle malicious sample variant obfuscation scenarios.

[0176] This application embodiment is not limited to using the N-gram model to calculate the distance between two session communication messages. Other methods that can calculate the distance between two objects can also be used to calculate the distance between two session communication messages, such as Euclidean distance. This application embodiment does not limit this.

[0177] S63. Determine the similarity score of the two session communication messages based on the matching score of the signature information of the two session communication messages and the distance between the two session communication messages.

[0178] In practice, after calculating the N-gram distance between two session communication messages based on the N-gram model, the similarity score of the two session communication messages can be determined based on the matching score of the signature information of the two session communication messages and the N-gram distance between the two session communication messages.

[0179] Specifically, the similarity score of the two session communication messages can be calculated using the following formula:

[0180]

[0181] Wherein, Score represents the similarity score of communication information between two sessions;

[0182] match score The matching score of the signature information of the two session communication messages;

[0183] d represents the N-gram distance between two session communication messages;

[0184] α and β are constants.

[0185] α and β are used to adjust the relative importance between the matching score and the distance. The values ​​of α and β can be set according to actual needs and experience.

[0186] In this way, the similarity score of the two session communication messages in the same session stage in the session communication message sequence corresponding to the two malicious samples to be processed can be calculated.

[0187] S43. Determine the similarity between any two malicious samples to be processed based on the similarity scores of the two session communication messages of the same session stage in the session communication message sequence corresponding to any two malicious samples to be processed.

[0188] In practice, the similarity between any two malicious samples to be processed is determined based on the similarity score of the two session communication messages of the same session stage in the session communication message sequence corresponding to any two malicious samples to be processed, the preset length penalty term, and the length of the session communication message sequence corresponding to any two malicious samples to be processed.

[0189] When calculating the similarity between two strings, the impact of string length on similarity needs to be considered. If the length difference between two strings is large, even if they are similar in content, the calculated similarity may be very low. Therefore, this application introduces a length penalty term to penalize the length difference between two session communication messages, thereby improving the accuracy of similarity calculation.

[0190] Specifically, the similarity between any two malicious samples to be processed can be calculated using the following formula:

[0191]

[0192] Where Similarity represents the similarity between any two malicious samples to be processed;

[0193] Score i The similarity score of two session communication messages in the i-th same session phase in the session communication message sequence corresponding to any two malicious samples to be processed is represented by N, which represents the number of the same session phase in the session communication message sequence corresponding to any two malicious samples to be processed.

[0194] len1 and len2 represent the lengths of the session communication information sequences corresponding to any two malicious samples to be processed, respectively;

[0195] γ represents the preset length penalty term, 0≤γ≤1.

[0196] This length penalty is used to adjust the impact of the length of the session communication message (string).

[0197] S24. Classify the malicious samples to be processed according to the similarity between each pair of malicious samples to be processed, and obtain the classification results.

[0198] In specific implementation, for every two malicious samples to be processed, if it is determined that the similarity between the two malicious samples to be processed is greater than the second preset threshold, then the two malicious samples to be processed are determined to be malicious samples of the same category. The second preset threshold can be set according to actual needs. For example, it can be set to the same as the first preset threshold, or it can be set to other values. This application embodiment does not limit this.

[0199] The malicious sample classification method provided in this application obtains the communication traffic information of the malicious sample to be processed. This communication traffic information is the data traffic information flowing through various network nodes during the operation of the malicious sample. Session communication information for each session stage is extracted from the communication traffic information of each malicious sample to be processed. A corresponding session communication information sequence is generated based on the session communication information for each session stage. The similarity between each pair of malicious samples to be processed is determined according to their corresponding session communication information sequences. The malicious samples to be processed are then classified based on their similarity to obtain the classification result. Since the communication traffic of two different malicious samples from the same malware family may overlap or differ in the same session stage... The extremely similar payload data indicates that communication traffic generated by samples from the same malware family exhibits a certain degree of similarity when measured on a complete session basis. Therefore, this application extracts session communication information for each session stage from the obtained communication traffic information of the malicious samples to be processed, generating a sequence of session communication information for each complete session stage. By comparing the similarity of the session communication information sequences of different malicious samples to be processed, the similarity of different malicious samples to be processed is determined for classification. In this way, new variants of malicious samples and the connections between different malicious samples can be quickly and accurately identified. Thus, a unified classification basis is established for all types of malicious samples, improving the accuracy of malicious sample classification, saving computing resources, and improving classification efficiency.

[0200] Based on the same inventive concept, this application also provides a malicious sample classification device. Since the principle of the above-mentioned malicious sample classification device in solving the problem is similar to that of the malicious sample classification method, the implementation of the above-mentioned device can refer to the implementation of the method, and the repeated parts will not be described again.

[0201] like Figure 8As shown, it is a schematic diagram of the structure of the malicious sample classification device provided in the embodiments of this application, which may include:

[0202] The acquisition unit 81 is used to acquire the communication traffic information of the malicious sample to be processed, wherein the communication traffic information is the data traffic information flowing through each network node during the operation of the malicious sample to be processed.

[0203] The generation unit 82 is used to extract session communication information of each session stage from the communication traffic information of each malicious sample to be processed, and generate a corresponding session communication information sequence based on the session communication information of each session stage.

[0204] The determining unit 83 is used to determine the similarity between each pair of malicious samples to be processed based on the session communication information sequence corresponding to each pair of malicious samples to be processed.

[0205] The classification unit 84 is used to classify the malicious samples to be processed according to the similarity between each pair of malicious samples to be processed, and to obtain the classification result.

[0206] In one possible implementation, the generation unit 82 is specifically configured to, for each malicious sample to be processed, determine each session stage in the communication traffic information of the malicious sample to be processed based on the five-tuple information corresponding to the malicious sample to be processed; extract the session information of each session stage from the preset fields corresponding to each session stage; and determine the session information of each session stage as the session communication information of each session stage.

[0207] In one possible implementation, the determining unit 83 is specifically configured to: sign two session communication messages at the same session stage in the session communication message sequence corresponding to any two malicious samples to be processed, respectively, to generate signature information for each of the two session communication messages; determine a similarity score for the two session communication messages based on the similarity of their signature information; and determine the similarity between any two malicious samples to be processed based on the similarity scores of two session communication messages at each of the same session stages in the session communication message sequence corresponding to any two malicious samples to be processed.

[0208] In one possible implementation, the determining unit 83 is specifically configured to: determine a matching score for the signature information of the two session communication messages based on the similarity between the signature information of the two session communication messages, wherein the matching score characterizes the degree of similarity matching between the two session communication messages; calculate the distance between the two session communication messages; and determine a similarity score between the two session communication messages based on the matching score of the signature information of the two session communication messages and the distance between the two session communication messages.

[0209] In one possible implementation, the determining unit 83 is specifically used to determine the similarity between any two malicious samples to be processed based on the similarity score of two session communication messages of the same session stage in the session communication message sequence corresponding to any two malicious samples to be processed, a preset length penalty term, and the length of the session communication message sequence corresponding to any two malicious samples to be processed.

[0210] In one possible implementation, the determining unit 83 is specifically configured to: divide the session communication information into blocks for each session communication information to obtain session communication information blocks; perform hash calculations on each session communication information block to obtain a hash value for each session communication information block; and generate signature information for the session communication information based on the hash value of each session communication information block.

[0211] In one possible implementation, the determining unit 83 is specifically configured to divide the signature information of the two session communication messages into blocks to generate corresponding signature information blocks; calculate the weighted edit distance between signature information blocks at the same position in the signature information of the two session communication messages one by one; if the weighted edit distance between any two signature information blocks is less than a first preset threshold, then determine that any two signature information blocks are similar; and determine the matching score of the signature information of the two session communication messages based on the number of similar signature information block pairs and the number of signature information blocks in each of the two session communication messages.

[0212] In one possible implementation, the determining unit 83 is specifically used to calculate the N-gram distance between the two session communication messages based on the N-gram model; and to determine the similarity score of the two session communication messages based on the matching score of the signature information of the two session communication messages and the N-gram distance between the two session communication messages.

[0213] In one possible implementation, the determining unit 83 is specifically used to calculate the similarity score of the two session communication messages using the following formula:

[0214]

[0215] Wherein, Score represents the similarity score of the two session communication messages;

[0216] match score This represents the matching score of the signature information of the two session communication messages;

[0217] d represents the N-gram distance between the two session communication messages;

[0218] α and β are constants.

[0219] In one possible implementation, the determining unit 83 is specifically configured to calculate the similarity between any two malicious samples to be processed using the following formula:

[0220]

[0221] Wherein, Similarity represents the similarity between any two malicious samples to be processed;

[0222] Score i The similarity score of two session communication messages in the i-th same session phase in the session communication message sequence corresponding to any two malicious samples to be processed is represented by N, which represents the number of the same session phase in the session communication message sequence corresponding to any two malicious samples to be processed.

[0223] len1 and len2 represent the lengths of the session communication information sequences corresponding to any two malicious samples to be processed, respectively;

[0224] γ represents the preset length penalty term, 0≤γ≤1.

[0225] In one possible implementation, the classification unit 84 is specifically used to determine that the two malicious samples to be processed are malicious samples of the same category if the similarity between the two malicious samples to be processed is greater than a second preset threshold.

[0226] Based on the same technical concept, this application also provides an electronic device 900, referring to... Figure 9 As shown, the electronic device 900 is used to implement the malicious sample classification method described in the above-described method embodiments. The electronic device 900 in this embodiment may include: a memory 901, a processor 902, and a computer program stored in the memory and executable on the processor, such as a malicious sample classification program. When the processor executes the computer program, it implements the steps in the various malicious sample classification method embodiments described above, for example... Figure 2The step S21 shown. Alternatively, when the processor executes the computer program, it implements the functions of each module / unit in the above-described device embodiments, such as 81.

[0227] This application embodiment does not limit the specific connection medium between the memory 901 and the processor 902. This application embodiment... Figure 9 The memory 901 and processor 902 are connected via a bus 903, and the bus 903 is in Figure 9 The connections between other components are shown in bold lines only and are not intended to be limiting. The bus 903 can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 9 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0228] Memory 901 may be volatile memory, such as random-access memory (RAM); memory 901 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 901 may be any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 901 may be a combination of the above-mentioned memories.

[0229] Processor 902, used to implement such Figure 2 The malicious sample classification method shown includes:

[0230] The processor 902 is used to call the computer program stored in the memory 901 to execute, such as Figure 2 The steps shown are as follows: S21, obtaining communication traffic information of the malicious sample to be processed; S22, extracting session communication information of each session stage from the communication traffic information of each malicious sample to be processed, and generating corresponding session communication information sequences based on the session communication information of each session stage; S23, determining the similarity between each pair of malicious samples to be processed according to the session communication information sequences corresponding to each pair of malicious samples to be processed; and S24, classifying the malicious samples to be processed according to the similarity between each pair of malicious samples to be processed, and obtaining the classification results.

[0231] This application also provides a computer-readable storage medium storing computer-executable instructions required to execute the processor, including a program required to execute the processor.

[0232] In some possible implementations, various aspects of the malicious sample classification method provided in this application can also be implemented as a program product comprising program code. When the program product is run on an electronic device, the program code causes the electronic device to perform the steps in the malicious sample classification method according to the various exemplary embodiments of this application described above. For example, the electronic device can perform actions such as... Figure 2 The steps shown are as follows: S21, obtaining communication traffic information of the malicious sample to be processed; S22, extracting session communication information of each session stage from the communication traffic information of each malicious sample to be processed, and generating corresponding session communication information sequences based on the session communication information of each session stage; S23, determining the similarity between each pair of malicious samples to be processed according to the session communication information sequences corresponding to each pair of malicious samples to be processed; and S24, classifying the malicious samples to be processed according to the similarity between each pair of malicious samples to be processed, and obtaining the classification results.

[0233] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0234] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0235] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0236] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0237] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0238] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for classifying malicious samples, characterized in that, include: Obtain the communication traffic information of the malicious sample to be processed, wherein the communication traffic information is the data traffic information flowing through each network node during the operation of the malicious sample to be processed; Session communication information for each session stage is extracted from the communication traffic information of each malicious sample to be processed. A corresponding session communication information sequence is generated based on the session communication information for each session stage. The session communication information for each session stage is the session information extracted from the payload field corresponding to each session stage. Based on the session communication information sequence corresponding to every two malicious samples to be processed, the similarity between each pair of malicious samples to be processed is determined. Specifically, this includes: for two session communication messages of the same session stage in the session communication information sequence corresponding to any two malicious samples to be processed, signing the two session communication messages respectively to generate signature information for each of the two session communication messages; determining the similarity score of the two session communication messages based on the similarity of the signature information; and determining the similarity between any two malicious samples to be processed based on the similarity scores of two session communication messages of the same session stage in the session communication information sequence corresponding to any two malicious samples to be processed. Specifically, determining the similarity score of the two session communication messages based on the similarity of their signature information includes: determining a matching score for the signature information of the two session communication messages based on the similarity between their signature information, where the matching score represents the degree of similarity between the two session communication messages; calculating the N-gram distance between the two session communication messages based on an N-gram model; and determining the similarity score of the two session communication messages based on the matching score of their signature information and the N-gram distance between them. The similarity between any two malicious samples to be processed is determined based on the similarity scores of two session communication messages at the same session stage in the session communication message sequence corresponding to any two malicious samples to be processed. Specifically, this includes determining the similarity between any two malicious samples to be processed based on the similarity scores of two session communication messages at the same session stage in the session communication message sequence corresponding to any two malicious samples to be processed, a preset length penalty term, and the length of the session communication message sequence corresponding to any two malicious samples to be processed. The similarity score of the two session communication messages is determined based on the matching score of their signature information and the N-gram distance between them, specifically including: The similarity score of the two session communication messages is calculated using the following formula: in, This represents the similarity score between the two session communication messages; This represents the matching score of the signature information of the two session communication messages; This represents the N-gram distance between the two session communication messages; , It is a constant; The malicious samples to be processed are classified according to the similarity between each pair of malicious samples to be processed, and the classification results are obtained.

2. The method as described in claim 1, characterized in that, Session communication information for each session stage is extracted from the communication traffic information of each malicious sample to be processed, specifically including: For each malicious sample to be processed, the various session stages in the communication traffic information of the malicious sample to be processed are determined based on the five-tuple information corresponding to the malicious sample to be processed. Extract the session information of each session stage from the payload field corresponding to each session stage; The session information of each session stage is determined as the session communication information of each session stage.

3. The method as described in claim 1, characterized in that, Sign the two session communication messages respectively to generate signature information for each of the two session communication messages, specifically including: For each session communication information, the session communication information is divided into blocks to obtain session communication information blocks; Each session communication information block is hashed individually to obtain the hash value of each session communication information block; Based on the hash value of each session communication information block, a signature of the session communication information is generated.

4. The method as described in claim 1, characterized in that, Based on the similarity between the signature information of the two session communication messages, a matching score is determined for the signature information of the two session communication messages, specifically including: The signature information of the two session communication messages is divided into blocks to generate corresponding signature information blocks for each; Calculate the weighted edit distance between the signature information blocks at the same position in the signature information of the two session communication messages one by one; If the weighted edit distance between any two signature information blocks is less than a first preset threshold, then the two signature information blocks are determined to be similar. The matching score of the signature information of the two session communication messages is determined based on the number of similar signature information block pairs and the number of signature information blocks of each of the two session communication messages.

5. The method as described in claim 1, characterized in that, The similarity between any two malicious samples to be processed is determined based on the similarity score of two session communication messages at the same session stage in the session communication message sequence corresponding to any two malicious samples to be processed, a preset length penalty term, and the length of the session communication message sequence corresponding to any two malicious samples to be processed. Specifically, this includes: The similarity between any two malicious samples to be processed is calculated using the following formula: in, This indicates the similarity between any two malicious samples to be processed; The similarity score of two session communication messages in the i-th same session phase in the session communication message sequence corresponding to any two malicious samples to be processed is represented by N, which represents the number of the same session phase in the session communication message sequence corresponding to any two malicious samples to be processed. len2 and len2 represent the lengths of the session communication information sequences corresponding to any two malicious samples to be processed, respectively; This indicates the preset length penalty term. .

6. The method as described in claim 1, characterized in that, The malicious samples to be processed are classified according to the similarity between every two malicious samples to be processed, and the classification results are obtained, specifically including: For every two malicious samples to be processed, if the similarity between the two malicious samples to be processed is greater than a second preset threshold, then the two malicious samples to be processed are determined to be malicious samples of the same category.

7. A malicious sample classification device, characterized in that, include: The acquisition unit is used to acquire the communication traffic information of the malicious sample to be processed, wherein the communication traffic information is the data traffic information flowing through each network node during the operation of the malicious sample to be processed; The generation unit is used to extract session communication information of each session stage from the communication traffic information of each malicious sample to be processed, and generate a corresponding session communication information sequence based on the session communication information of each session stage. The session communication information of each session stage is the session information extracted from the payload field corresponding to each session stage. The determining unit is used to determine the similarity between each pair of malicious samples to be processed based on the session communication information sequence corresponding to each pair of malicious samples to be processed. The determining unit is specifically configured to: for any two malicious samples to be processed, sign two session communication messages in the same session phase within the session communication message sequence, respectively, to generate signature information for each of the two session communication messages; determine a similarity score for the two session communication messages based on the similarity of their signature information; and determine the similarity between any two malicious samples to be processed based on the similarity scores of two session communication messages in the same session phase within the session communication message sequence corresponding to any two malicious samples to be processed. The determining unit is specifically used to determine a matching score of the signature information of the two session communication information based on the similarity between the signature information of the two session communication information, wherein the matching score represents the degree of similarity matching between the two session communication information. The N-gram distance between the two session communication messages is calculated based on the N-gram model; the similarity score between the two session communication messages is determined based on the matching score of the signature information of the two session communication messages and the N-gram distance between the two session communication messages. The determining unit is specifically used to determine the similarity between any two malicious samples to be processed based on the similarity score of two session communication information in the same session stage in the session communication information sequence corresponding to any two malicious samples to be processed, a preset length penalty term, and the length of the session communication information sequence corresponding to any two malicious samples to be processed. The determining unit is specifically used to calculate the similarity score of the two session communication messages using the following formula: in, This represents the similarity score between the two session communication messages; This represents the matching score of the signature information of the two session communication messages; This represents the N-gram distance between the two session communication messages; , It is a constant; A classification unit is used to classify the malicious samples to be processed based on the similarity between every two malicious samples to be processed, and to obtain a classification result.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the malicious sample classification method as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the steps in the malicious sample classification method as described in any one of claims 1 to 6.

Images