An information determination method, apparatus, device, and computer readable storage medium
By training a target classification model that fuses real-time and spatial feature extraction models, the problem of traditional convolutional neural networks failing to extract real-time features of malicious programs is solved, achieving higher detection accuracy.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA MOBILE (SUZHOU) SOFTWARE TECH CO LTD
- Filing Date
- 2022-08-31
- Publication Date
- 2026-06-09
AI Technical Summary
Traditional convolutional neural network models fail to consider real-time feature information during program execution when detecting malware, resulting in incomplete feature information and low detection accuracy.
By acquiring the running data of the sample abnormal program at different times, an initial real-time feature extraction model and an initial spatial feature extraction model are trained and fused into a target classification model. The target classifier is then used to process the program to be detected and extract real-time and spatial feature information.
It improves the accuracy of malicious program detection and ensures the integrity of feature information and the accuracy of detection results.
Smart Images
Figure CN116821900B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of Internet technology, and in particular to an information determination method, apparatus, device, and computer-readable storage medium. Background Technology
[0002] With the continuous development of internet technology, more and more companies are pursuing cloud migration. However, the complex internet environment makes malicious programs a constant threat to cloud resources. Currently, traditional convolutional neural network (CNN) models are commonly used to detect malicious programs; however, these models only extract spatial features for detection. Furthermore, these technologies do not consider real-time feature information during program execution, resulting in incomplete feature extraction and consequently, low detection accuracy. Summary of the Invention
[0003] To address the aforementioned technical problems, this application aims to provide an information determination method, apparatus, device, and computer-readable storage medium. This addresses the issue in related technologies where the detection of malicious programs does not consider real-time feature information during program execution, resulting in incomplete extracted feature information and thus low accuracy in detecting program information. This improves the accuracy in identifying abnormal programs.
[0004] The technical solution of this application is implemented as follows:
[0005] An information determination method, the method comprising:
[0006] Obtain multiple sample data of the sample abnormal program; wherein, the sample data represents the running data of the sample abnormal program at different times during its operation;
[0007] Based on the sample data, the initial real-time feature extraction model and the initial spatial feature extraction model are trained to obtain the target real-time feature extraction model and the target spatial feature extraction model.
[0008] Based on the target real-time feature extraction model and the target spatial feature extraction model, a target classification model is obtained;
[0009] The target classification model and target classifier are used to process the target running data of the program to be detected to determine whether the program to be detected is abnormal.
[0010] In the above scheme, obtaining multiple sample data of the sample anomaly program includes:
[0011] Obtain first data and second data at different times during the execution of the sample abnormal program; wherein, the first data represents the function calls during the execution of the sample abnormal program, and the second data represents the memory usage during the execution of the sample abnormal program;
[0012] The format of each of the first data and each of the second data is converted.
[0013] Each of the first data and each of the second data after transformation is standardized to obtain the third data and the fourth data.
[0014] The third and fourth data are concatenated to obtain multiple sample data.
[0015] In the above scheme, the step of training the initial real-time feature extraction model and the initial spatial feature extraction model based on the sample data to obtain the target real-time feature extraction model and the target spatial feature extraction model includes:
[0016] The initial real-time feature extraction model is used to extract features from the sample data to obtain first feature information;
[0017] The first feature information is extracted using the initial spatial feature extraction model to obtain the second feature information;
[0018] Update the parameters of the initial real-time feature extraction model and the parameters of the initial spatial feature extraction model;
[0019] The updated initial real-time feature extraction model is used to extract features from the sample data to obtain third feature information, and the updated initial spatial feature extraction model is used to extract features from the third feature information until the target real-time feature extraction model and the target spatial feature extraction model are obtained.
[0020] In the above scheme, the step of using the initial real-time feature extraction model to extract features from the sample data to obtain first feature information includes:
[0021] Multiple feature extractors in the initial real-time feature extraction model are used to extract features from multiple sample data to obtain fourth feature information for each sample data; wherein, the sample data and the feature extractors have a corresponding relationship;
[0022] Determine the weights corresponding to each of the aforementioned feature extractors;
[0023] Based on the fourth feature information and the weight, the feature extraction result of the sample data is determined.
[0024] In the above scheme, determining the weights corresponding to each feature extractor includes:
[0025] The basic feature information is obtained by performing calculations on the feature extraction results corresponding to each of the aforementioned feature extractors;
[0026] The weights are determined based on the feature extraction results, the basic feature information, and the target value.
[0027] In the above scheme, determining the weights based on the feature extraction results, the basic feature information, and the target value includes:
[0028] Determine the target value;
[0029] The weights are obtained by processing the feature extraction results, the basic feature information, and the target value using an objective function.
[0030] In the above scheme, obtaining the target classification model based on the real-time target feature extraction model and the target spatial feature extraction model includes:
[0031] The target real-time feature extraction model and the target spatial feature extraction model are fused to obtain the target classification model.
[0032] In the above scheme, the step of processing the target running data of the program to be detected using the target classification model and target classifier to determine whether the program to be detected is abnormal includes:
[0033] Acquire the target running data at different times during the execution of the program to be tested;
[0034] The target classification model processes the target running data to obtain target feature information;
[0035] The target feature information is processed using the target classifier to obtain the target probability of the target feature information;
[0036] If the target probability is greater than the probability threshold, the program to be detected is determined to be abnormal.
[0037] An information determining device, the device comprising:
[0038] An acquisition unit is used to acquire multiple sample data of a sample anomaly program; wherein, the sample data represents the running data of the sample anomaly program at different times during its operation;
[0039] The training unit is used to train the initial real-time feature extraction model and the initial spatial feature extraction model based on the sample data to obtain the target real-time feature extraction model and the target spatial feature extraction model.
[0040] The processing unit is used to obtain a target classification model based on the target real-time feature extraction model and the target spatial feature extraction model;
[0041] The determination unit is used to process the target running data of the program to be detected using the target classification model and the target classifier to determine whether the program to be detected is abnormal.
[0042] An information determining device, the device comprising: a processor, a memory, and a communication bus;
[0043] The communication bus is used to realize the communication connection between the processor and the memory;
[0044] The processor is used to execute the information determination program stored in the memory to implement the steps of the information determination method described above.
[0045] A computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the steps of the information determination method described above.
[0046] The information determination method, apparatus, device, and computer-readable storage medium provided in this application embodiment acquire multiple sample data of an abnormal sample program. These sample data represent the runtime data of the abnormal sample program at different times during its operation. Based on the sample data, an initial real-time feature extraction model and an initial spatial feature extraction model are trained to obtain a target real-time feature extraction model and a target spatial feature extraction model. Then, based on the target real-time feature extraction model and the target spatial feature extraction model, a target classification model is obtained. Finally, the target classification model and a target classifier are used to process the target runtime data of the program to be detected to determine whether the program to be detected is abnormal. Thus, this method is used to detect whether a program is abnormal. The target classification model includes both a real-time target feature extraction model and a spatial target feature extraction model. The real-time model extracts real-time feature information, while the spatial model extracts spatial feature information. Therefore, when using the target classification model for anomaly detection, it can extract both real-time and spatial feature information corresponding to the program being detected. This results in more complete feature information and more accurate detection results. It solves the problem in related technologies where traditional convolutional neural networks for malware detection do not consider real-time feature information generated at different times during program execution, leading to incomplete feature extraction and improving the accuracy of identifying anomalies. Attached Figure Description
[0047] Figure 1A flowchart illustrating an information determination method provided in an embodiment of this application;
[0048] Figure 2 A flowchart illustrating yet another information determination method provided in an embodiment of this application;
[0049] Figure 3 A schematic diagram of the target real-time feature extraction model in the information determination method provided in the embodiments of this application;
[0050] Figure 4 A schematic diagram of the target space feature extraction model in the information determination method provided in the embodiments of this application;
[0051] Figure 5 A schematic diagram illustrating the determination of feature extraction results of sample data in the information determination method provided in the embodiments of this application;
[0052] Figure 6 A schematic diagram illustrating the classification process using a classifier in the information determination method provided in this application embodiment;
[0053] Figure 7 A flowchart illustrating the process of determining whether a program is malicious in the information determination method provided in this application embodiment;
[0054] Figure 8 This is a schematic diagram of the structure of an information determination device provided in an embodiment of this application;
[0055] Figure 9 This is a schematic diagram of the structure of an information determination device provided in an embodiment of this application. Detailed Implementation
[0056] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.
[0057] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.
[0058] This application provides an information determination method, which can be applied to an information determination device, as described above. Figure 1 As shown, the method includes the following steps:
[0059] Step 101: Obtain multiple sample data from the sample anomaly program.
[0060] Among them, the sample data represents the running data corresponding to different times during the execution of the sample abnormal program; it should be noted that different times can refer to multiple moments determined during the execution of the sample abnormal program.
[0061] In this embodiment, the sample data can be obtained by processing the initial data acquired by the information determination device; or it can be sent to the information determination device by other devices with information determination processing capabilities. It should be noted that the running data during the execution of the sample anomaly program can be acquired periodically, and the corresponding running data during the execution of the sample anomaly program is different at different times.
[0062] Step 102: Train the initial real-time feature extraction model and the initial spatial feature extraction model based on the sample data to obtain the target real-time feature extraction model and the target spatial feature extraction model.
[0063] Among them, the target real-time feature extraction model can refer to a network model used to extract real-time feature information; the target spatial feature extraction model can refer to a network model used to extract spatial feature information; in a feasible implementation, the target real-time feature extraction model can be a bidirectional long-term memory (BiLSTM) neural network model, and the target spatial feature extraction model can be a densely connected neural network model (DenseNet).
[0064] In the embodiments of this application, the target real-time feature extraction model can be obtained by training an initial real-time feature extraction model based on sample data using a neural network algorithm; the target spatial feature extraction model can also be obtained by training an initial spatial feature extraction model based on sample data using a neural network algorithm.
[0065] Step 103: Based on the real-time target feature extraction model and the target spatial feature extraction model, obtain the target classification model.
[0066] In the embodiments of this application, the real-time feature extraction model and the spatial feature extraction model of the target can be processed to obtain a target classification model.
[0067] Step 104: Use a target classification model and target classifier to process the target running data of the program to be detected to determine whether the program to be detected is abnormal.
[0068] The target classifier is a module that can classify the target running data of the program to be detected. In one feasible implementation, the target classifier can be a softmax classifier. In this embodiment, the target running data of the program to be detected can be input into the target classification model. The target classification model can extract features from the data to be processed to obtain feature information. Then, the feature information is input into the target classifier for classification, thereby determining whether the program to be detected is abnormal based on the classification result.
[0069] The information determination method provided in the embodiments of this application is used to detect whether a program is abnormal. The target classification model includes both a real-time target feature extraction model and a spatial target feature extraction model. Because the real-time target feature extraction model can extract real-time feature information and the spatial target feature extraction model can extract spatial feature information, when using the target classification model to detect abnormal programs, it can extract both the real-time feature information and the spatial feature information corresponding to the program to be detected. The extracted feature information is more complete, and the detection result is more accurate. This solves the problem in related technologies where the real-time feature information generated at different times during the program's operation is not considered when using traditional convolutional neural networks to detect malicious programs, resulting in incomplete extracted feature information. This improves the accuracy of identifying abnormal programs.
[0070] Based on the foregoing embodiments, this application provides yet another information determination method, referring to... Figure 2 As shown, the method includes the following steps:
[0071] Step 201: The information determination device acquires the first and second data at different times during the execution of the sample anomaly program.
[0072] The first data represents the functions called during the execution of the sample abnormal program, and the second data represents the memory usage during the execution of the sample abnormal program. It should be noted that the first and second data at different times correspond to the feature extractors in the information determining device. That is, the number of first and second data at different times may be greater than the number of feature extractors, the number of first and second data at different times may be less than the number of feature extractors, and the number of first and second data at different times may also be equal to the number of feature extractors.
[0073] In this embodiment, the information determination device can periodically acquire first and second data at different times during the execution of the sample abnormal program. Alternatively, the device can acquire the first and second data at different times during the execution of the sample abnormal program in real time. In one feasible implementation, the first data can be dynamic link library (DLL) information, and the second data can be memory information. It should be noted that, compared to existing technologies, this embodiment only acquires DLL information and memory information, without acquiring the dynamic real-time parameters of the operating system corresponding to the abnormal program's execution, because DLL information and memory information are things that abnormal programs cannot interfere with or disguise. Thus, the acquired information is more authentic and reliable.
[0074] Step 202: The information determination device performs format conversion processing on each first data and each second data.
[0075] In this embodiment of the application, the data preprocessing module in the information determination device can convert the format of each first data into a matrix form, and also convert the format of each second data into a matrix form.
[0076] In one feasible implementation, when the first data is dynamic link library (DLL) information, DLL information at different times can be acquired periodically. The DLL information for each program forms a feature matrix. Each row of the feature matrix represents the DLL information and frequency used by each process during program execution, with 0 counts for unused DLLs. The DLLs are arranged horizontally in the order of their calls, filtering out DLLs with lower contribution. Ultimately, each program forms a two-dimensional feature matrix of the same size. Thus, by acquiring the information and frequency of DLL calls during program execution, a two-dimensional feature matrix contains more comprehensive information, allowing for the extraction of more identifiable features and reducing the likelihood of feature loss, thereby improving the accuracy of information detection. When the second data is memory information, memory snapshots are also acquired periodically during program execution. The memory snapshot information at each selected moment is saved, and forensic analysis tools (Volatility) are used to analyze the snapshots, extracting features of changes in operating system memory. Similarly, the memory features at each program execution time are used as a feature matrix, and the memory features at each selected moment are arranged sequentially to obtain a matrix information after format conversion.
[0077] Step 203: The information determination device performs standardization processing on each of the first and second data after conversion to obtain the third and fourth data.
[0078] In this embodiment of the application, a standard normalization function can be used to standardize each of the transformed first data to obtain the third data corresponding to the first data; and a standard normalization function can be used to standardize each of the transformed second data to obtain the fourth data corresponding to the second data.
[0079] In one feasible implementation, the formula shown in formula (1) below can be used to standardize each of the first and second data after the transformation process to obtain the third and fourth data:
[0080] Formula (1)
[0081] Where u represents the mean of all first data points or the mean of all second data points, and δ represents the standard deviation of all first data points or the standard deviation of all second data points. This refers to either the first or second data after transformation. This refers to the first data after transformation. This refers to the third data obtained after standardizing the first data after transformation; in This refers to the second data after transformation. This refers to the fourth data obtained after standardizing the transformed second data.
[0082] It should be noted that standardizing each first and second data point after transformation can eliminate the large differences in data values caused by different units, resulting in faster algorithm convergence and thus higher efficiency in detecting malicious programs.
[0083] Step 204: The information determination device splices the third and fourth data to obtain multiple sample data.
[0084] In this embodiment of the application, the third and fourth data at the same time are concatenated to obtain a sample data at that time. Then, by concatenating the third and fourth data at each same time, multiple sample data are obtained.
[0085] Step 205: The information determination device uses an initial real-time feature extraction model to extract features from the sample data to obtain the first feature information.
[0086] The first feature information represents the feature information obtained after extracting features from the sample data using the initial real-time feature extraction model.
[0087] In this embodiment of the application, sample data can be input into an initial real-time feature extraction model for feature extraction to obtain first feature information; it should be noted that the first feature information is represented in the form of a matrix.
[0088] Step 206: The information determination device uses the initial spatial feature extraction model to extract features from the first feature information to obtain the second feature information.
[0089] In this embodiment, the first feature information can be input into the initial spatial feature extraction model, and the initial spatial feature extraction model can be used to extract features from the first feature information to obtain the second feature information.
[0090] It should be noted that the initial spatial feature extraction model consists of a dense block and a transition layer. The dense block comprises a batch normalization (BN) layer, an activation layer, and a convolutional layer (Conv), while the transition layer consists of a convolutional layer (Conv) and a pooling layer. The following combination... Figure 3 This section explains how to use an initial spatial feature extraction model to extract features from the first feature information to obtain the second feature information: (Refer to...) Figure 3 As shown, the initial spatial feature extraction model includes three densely connected modules and two transition layers. The three densely connected modules in the initial spatial feature extraction model have the same structure, including batch normalization (BN), activation layers, and convolutional layers. The convolutional layers have 32 elements of size [missing information]. The convolutional kernels are padded with symmetrical padding, followed by a concatenation layer to concatenate the features. From the above... Figure 3 As can be seen, each layer passes its features to all subsequent layers; it should be noted that the activation layer uses the leaky_relu activation function to perform non-linear processing on the features, and its expression is shown in the following expression (2):
[0091] Expression (2)
[0092] Where 'a' can be a value set based on historical experience. Furthermore, as can be seen from expression (2), the value of the leaky_relu activation function on the negative half axis is slightly less than zero. This can prevent the death of neurons and maintain the unilateral inhibition effect of Relu, which has good sparsity and can also converge quickly, making the network model more robust and generalizable.
[0093] In the transition layer of the initial spatial feature extraction model, the first transition layer's convolutional layer has 128 convolutional layers of size [missing information]. The convolution kernel is set to average pooling, and the pooling window size is [value missing]. The second transition layer of the convolutional layer has 256 convolutional layers of size ; The convolution kernel is set to average pooling, and the pooling window size is [value missing]. It should be noted that because the dense connection module contains a concatenation layer to concatenate features, the number of parameters in the initial spatial feature extraction model increases. Using the convolutional layer in the transition layer can reduce dimensionality and thus reduce parameter computation. Furthermore, the pooling layer can both preserve important features and further reduce parameters, making the final model more stable.
[0094] Step 207: Information determination device updates the parameters of the initial real-time feature extraction model and the parameters of the initial spatial feature extraction model.
[0095] In this embodiment of the application, the information determination device can use the extracted feature information to update the parameters of the initial real-time feature extraction model and the parameters of the initial spatial feature extraction model.
[0096] Step 208: The information determination device uses the updated initial real-time feature extraction model to extract features from the sample data to obtain the third feature information, and uses the updated initial spatial feature extraction model to extract features from the third feature information until the target real-time feature extraction model and the target spatial feature extraction model are obtained.
[0097] The third feature information is obtained by extracting features from the sample data using the updated initial real-time feature extraction model. During the second model training, the information determination device updates the parameters using the feature information extracted during the first model training; during the third model training, it updates the parameters using the feature information extracted during the second model training, and so on, until the target real-time feature extraction model and the target spatial feature extraction model are obtained.
[0098] It should be noted that for convolutional neural networks, the number of convolutional and pooling layers, as well as the size of the convolutional kernels, directly affect the model's performance. Currently, there is no good method to determine the optimal parameter combination, therefore parameter tuning is necessary. The parameter tuning process involves fixing other parameters, adjusting one parameter within a reasonable range, and then comparing the results. The following explanation uses training an initial spatial feature extraction model: First, the number and size of the convolutional kernels are fixed. Then, the number of Dense Blocks in DenseNet and the number of layers in each Dense Block are tuned. Since DenseNet uses feature concatenation, setting multiple Dense Blocks and many layers of Dense Blocks would increase the number of parameters too much. Therefore, the final parameter tuning of the DenseNet network model in this application sets the number of Dense Blocks to 3. Because selecting a large convolutional kernel would result in too many parameters and slow down the model, while a kernel that is too small would not extract useful features, leading to low accuracy, the final parameter tuning in this application selects a kernel size of [missing information]. The convolutional kernels are optimized; in addition, the DenseNet network model uses DropBlock regularization instead of Dropout regularization, which removes some neurons to minimize overfitting and effectively enhance the model's robustness and generalization ability.
[0099] It should be noted that the steps 205-208, when using the initial real-time feature extraction model to extract features from the sample data, and the subsequent steps when using the updated initial real-time feature extraction model to extract features from the sample data, can both be achieved through the following steps:
[0100] A. The information determination device uses multiple feature extractors in the initial real-time feature extraction model to extract features from multiple sample data, and obtains the fourth feature information of each sample data.
[0101] There is a correspondence between the sample data and the feature extractor.
[0102] In the embodiments of this application, when the number of sample data at different times is equal to the number of feature extractors, each sample data at a different time corresponds to a feature extractor; when the number of sample data at different times is greater than the number of feature extractors, sample data at multiple times can correspond to a single feature extractor.
[0103] In one feasible implementation, the initial real-time feature extraction model is a BiLSTM network model. Multiple feature extractors are used to extract features from each sample data, resulting in the fourth feature information for each sample data. This is explained in the following example. Figure 4 As shown, the BiLSTM network model consists of multiple feature extractors (i.e., BiLSTM cells), each of which includes three gate control units: an input gate, a forget gate, and an output gate. It should be noted that the feature extractors update and store data through these gate control units. Given a total of n sample data points and n feature extractors, that is, when the number of sample data points at different times is equal to the number of feature extractors, the sample data at the first time point ( The input is fed into any feature extractor in the BiLSTM network model for feature extraction. The feature extraction process is as follows, where the expression for the BiLSTM forget gate is shown in expression (3) below:
[0104] Expression (3)
[0105] The BiLSTM input gate expressions are shown in expressions (4) and (5) below:
[0106] Expression (4)
[0107] Expression (5)
[0108] The expressions for the output gates of BiLSTM are shown in expressions (6) and (7) below:
[0109] Expression (6)
[0110] Expression (7)
[0111] The extracted fourth feature information is expressed as shown in the following expression (8):
[0112] Expression (8)
[0113] It should be noted that in the above expression... This represents the sample data at time t. This indicates the state of the initial sample data, and its value can be determined to be 0. and This represents the output feature information (i.e., the fourth feature information) of sample t data. Represents the Gate of Oblivion Indicates the input gate. This indicates the current state of the feature extractor. This represents the weight matrix of the output gate. Indicates the state of the output sample data. represents the state of the sample data at time t, and b represents the bias term of the corresponding gate.
[0114] B. The information determination device determines the weight corresponding to each feature extractor.
[0115] In this embodiment, each feature extractor can be analyzed to determine the weight corresponding to each feature extractor; in one feasible implementation, the weight can be used... Let represent , where the subscript t indicates the t-th feature extractor.
[0116] It should be noted that a weight of 0 indicates that the feature information extracted by this feature extractor is not considered, while a weight of 1 indicates that the feature information extracted by this feature extractor is considered. The attention mechanism layer is the layer that determines the weights. The number of neurons selected in the attention mechanism layer affects the performance of the BiLSTM network model. Too few neurons result in uninterpretable extracted features, while too many neurons result in too many parameters. Therefore, the BiLSTM network model uses 8 neurons. In this way, better results are achieved with fewer neurons, reducing feature extraction time and extracting more interpretable features.
[0117] It should be noted that step B can be achieved in the following way:
[0118] B1. The information determination device performs calculations on the feature extraction results corresponding to each feature extractor to obtain basic feature information.
[0119] In this embodiment, mathematical logic operations can be performed on the feature extraction results corresponding to each feature extractor to obtain basic feature information; in one feasible implementation, derivative operations can be performed on the feature extraction results corresponding to each feature extractor to obtain basic feature information, wherein the feature extraction results corresponding to each feature extractor can be used... To represent it, the basic feature information can be used as follows: To express.
[0120] B2. The information determination device determines the weights based on the feature extraction results, basic feature information, and target values.
[0121] In this embodiment of the application, the information determination device can perform calculations on the feature extraction results, basic feature information, and target values to obtain the weight corresponding to each feature extractor.
[0122] It should be noted that step B2 can be achieved in the following way:
[0123] b1. Information determination equipment determines the target value.
[0124] In this embodiment of the application, the target value can be set based on historical experience, and the target value can be represented by U.
[0125] b2. The information determination device uses an objective function to process the feature extraction results, basic feature information, and target values to obtain weights.
[0126] In this embodiment of the application, the feature extraction results, basic feature information and target values can be input into the objective function for calculation to obtain the weight corresponding to each feature extractor.
[0127] In one feasible implementation, the objective function can be the sigmoid activation function, which can be calculated using the activation function formula shown in the following formula (9):
[0128] Formula (9)
[0129] in, This represents the weight at time t. This represents the feature extraction result at time t. This represents the basic feature information at time t-1, and U represents the target value.
[0130] Step C: The information determination device determines the feature extraction results of the sample data based on the fourth feature information and weights.
[0131] In this embodiment, each fourth feature information is multiplied by its corresponding weight to obtain a feature information after calculation. Then, the feature information obtained by multiplying all the fourth feature information by their corresponding weights is added together to obtain the feature extraction result of the sample data. In this way, by dynamically selecting the fourth feature information to participate in the weighted calculation, more interpretable feature information can be extracted, which not only reduces the amount of calculation but also improves the effect of the network model in information detection.
[0132] Reference Figure 5 As shown, the fourth feature information ( ) input to the corresponding feature extractor ( The feature information is obtained by multiplying the features in the sample data, and then adding all the feature information together to get the feature extraction result of the sample data.
[0133] Step 209: The information determination device fuses the target real-time feature extraction model and the target spatial feature extraction model to obtain a target classification model.
[0134] In this embodiment, the real-time target feature extraction model and the target spatial feature extraction model are concatenated to obtain a target classification model; that is, the output feature information of the real-time target feature extraction model is used as the output feature information of the target spatial feature extraction model.
[0135] Step 210: The information determination device acquires the target running data at different times during the operation of the program to be tested.
[0136] Here, different times can refer to multiple moments determined during the operation of the program to be tested.
[0137] In the embodiments of this application, the target running data may be obtained by the information determining device after processing the acquired initial data; or it may be sent to the information determining device by other devices with information determining processing capabilities.
[0138] Step 211: The information determination device uses a target classification model to process the target operation data to obtain target feature information.
[0139] In this embodiment of the application, the target running data of the program to be detected can be input into the target classification model. The target classification model can extract features from the target running data of the program to be detected to obtain target feature information.
[0140] Step 212: The information determination device uses a target classifier to process the target feature information and obtain the target probability of the target feature information.
[0141] In this embodiment of the application, target feature information is input into a target classifier, which performs calculations on the target feature information to obtain the target probability of the target feature information.
[0142] Reference Figure 6 As shown, multiple sample data can be divided into training and test sets according to a certain ratio. First, the target real-time feature extraction model (ABiLSTM) is used for feature extraction. Then, in order to further improve the detection accuracy, the target spatial feature extraction model (DenseNet) is used to further extract features to obtain target feature information. Then, the extracted target feature information is input into the softmax classifier for classification to obtain the target probability (classification result) of the target feature information.
[0143] Step 213: If the target probability is greater than the probability threshold, the information determination device determines that the program to be detected is abnormal.
[0144] The probability threshold can be set based on historical probabilities.
[0145] In this embodiment, the target probability can be compared with a probability threshold. If the target probability is greater than the probability threshold, the program to be detected is determined to be abnormal; if the target probability is less than or equal to the probability threshold, the program to be detected is determined to be normal.
[0146] In other embodiments of this application, reference is made to Figure 7As shown, malicious programs are detected through a data acquisition module, a data preprocessing module, and a feature extraction and classification module. Specifically: 1) The data acquisition module includes a program sample dataset, configuring a virtual machine image to simulate a cloud environment, and running the program sample dataset in the simulated cloud environment to obtain memory information and dynamic link library information of the program sample dataset; 2) The acquired malicious programs and normal programs of various known types are grouped into a set as the program sample dataset, and each malicious program and normal program is labeled to determine its type, with normal programs labeled as 1 and malicious programs labeled as 2; 3) A virtual machine image is configured to simulate a cloud environment, i.e., a virtual machine environment is created on the host and configured accordingly, treating it as a cloud server, and then the program sample dataset is deployed to the virtual machine environment for execution; 4) During the execution of the program sample dataset in the virtual machine, the memory information of the program runtime and the dynamic link library information of each process in each program are obtained, i.e., the program sample dataset is run sequentially in the simulated virtual machine environment, ensuring that only one program is executed at a time; It should be noted that after each program finishes running and the dynamic link library information and memory information are collected, the virtual machine needs to be restarted before executing the next program, until all program sample datasets have been run. 2. The data preprocessing module includes a format conversion module and a normalization module. It converts the dynamic link library information and memory information into their respective matrices, and then uses a normalization function to standardize the converted matrices, resulting in standardized matrices. 3. The feature extraction and classification module consists of two parts: a feature extraction module and a classification module. The standardized matrices are divided into training and testing sets. The matrices from the training set are input into the target classification model for training, and the matrices from the testing set are input into the trained target classification model for testing. Then, a softmax classifier is used to classify the features obtained after standardization and feature extraction from the target classification model, thus obtaining the classification result. It should be noted that the accuracy of the malicious program detection method using the target classification model can be evaluated later.
[0147] The information determination method provided in the embodiments of this application is used to detect whether a program is abnormal. The target classification model includes both a real-time target feature extraction model and a spatial target feature extraction model. Because the real-time target feature extraction model can extract real-time feature information and the spatial target feature extraction model can extract spatial feature information, when using the target classification model to detect abnormal programs, it can extract both the real-time feature information and the spatial feature information corresponding to the program to be detected. The extracted feature information is more complete, and the detection result is more accurate. This solves the problem in related technologies where the real-time feature information generated at different times during the program's operation is not considered when using traditional convolutional neural networks to detect malicious programs, resulting in incomplete extracted feature information. This improves the accuracy of identifying abnormal programs.
[0148] Based on the foregoing embodiments, embodiments of this application provide an information determining device, which can be applied to... Figures 1-2 In the information determination method provided in the corresponding embodiment, refer to Figure 8 As shown, the device 3 may include: an acquisition unit 31, a training unit 32, a processing unit 33, and a determination unit 34, wherein:
[0149] The acquisition unit 31 is used to acquire multiple sample data of the sample abnormal program; wherein, the sample data represents the running data corresponding to different times during the running of the sample abnormal program;
[0150] Training unit 32 is used to train the initial real-time feature extraction model and the initial spatial feature extraction model based on sample data to obtain the target real-time feature extraction model and the target spatial feature extraction model;
[0151] Processing unit 33 is used to obtain a target classification model based on the real-time target feature extraction model and the target spatial feature extraction model;
[0152] The determination unit 34 is used to process the target running data of the program to be detected using a target classification model and a target classifier to determine whether the program to be detected is abnormal.
[0153] In this embodiment of the application, the acquisition unit 31 is further configured to perform the following steps:
[0154] Obtain first and second data at different times during the execution of the sample abnormal program; wherein, the first data represents the function calls during the execution of the sample abnormal program, and the second data represents the memory usage during the execution of the sample abnormal program;
[0155] The format of each first data point and each second data point is converted.
[0156] Standardize each first and second data point after transformation to obtain the third and fourth data points.
[0157] The third and fourth data points are concatenated to obtain multiple sample data.
[0158] In this embodiment of the application, the training unit 32 is further configured to perform the following steps:
[0159] The initial real-time feature extraction model is used to extract features from the sample data to obtain the first feature information;
[0160] The first feature information is extracted using an initial spatial feature extraction model to obtain the second feature information;
[0161] Update the parameters of the initial real-time feature extraction model and the initial spatial feature extraction model;
[0162] The updated initial real-time feature extraction model is used to extract features from the sample data to obtain the third feature information, and the updated initial spatial feature extraction model is used to extract features from the third feature information until the target real-time feature extraction model and the target spatial feature extraction model are obtained.
[0163] In this embodiment of the application, the training unit 32 is further configured to perform the following steps:
[0164] Multiple feature extractors in the initial real-time feature extraction model are used to extract features from multiple sample data to obtain the fourth feature information of each sample data; wherein, there is a correspondence between the sample data and the feature extractors;
[0165] Determine the weights corresponding to each feature extractor;
[0166] Based on the fourth feature information and weights, the feature extraction results of the sample data are determined.
[0167] In this embodiment of the application, the training unit 32 is further configured to perform the following steps:
[0168] The basic feature information is obtained by performing calculations on the feature extraction results corresponding to each feature extractor.
[0169] Weights are determined based on feature extraction results, basic feature information, and target values.
[0170] In this embodiment of the application, the training unit 32 is further configured to perform the following steps:
[0171] Determine the target value;
[0172] The objective function is used to process the feature extraction results, basic feature information, and target values to obtain weights.
[0173] In this embodiment of the application, the processing unit 33 is further configured to perform the following steps:
[0174] The target real-time feature extraction model and the target spatial feature extraction model are fused to obtain a target classification model.
[0175] In this embodiment of the application, the determining unit 33 is further configured to perform the following steps:
[0176] Obtain the target execution data at different times during the execution of the program under test;
[0177] The target classification model is used to process the target running data to obtain target feature information;
[0178] A target classifier is used to process the target feature information to obtain the target probability of the target feature information;
[0179] If the target probability is greater than the probability threshold, the program to be detected is determined to be abnormal.
[0180] It should be noted that the specific implementation process of the steps performed by each unit in this embodiment can be referred to Figures 1-2 The implementation process of the information determination method provided in the corresponding embodiments will not be described in detail here.
[0181] The information determination device provided in the embodiments of this application is used to detect whether a program is abnormal. The target classification model includes both a real-time target feature extraction model and a spatial target feature extraction model. Because the real-time target feature extraction model can extract real-time feature information and the spatial target feature extraction model can extract spatial feature information, when using the target classification model to detect abnormal programs, it can extract both the real-time feature information and the spatial feature information corresponding to the program to be detected. The extracted feature information is more complete, and the detection result is more accurate. This solves the problem in related technologies where the real-time feature information generated at different times during the program's operation is not considered when using traditional convolutional neural networks to detect malicious programs, resulting in incomplete extracted feature information. This improves the accuracy of identifying abnormal programs.
[0182] Based on the foregoing embodiments, embodiments of this application provide an information determining device, which can be applied to... Figures 1-2 The information determination method provided in the corresponding embodiment is referred to Figure 9 As shown, the device 4 may include a processor 41, a memory 42, and a communication bus 43;
[0183] Communication bus 43 is used to realize the communication connection between processor 41 and memory 42;
[0184] Processor 4 is used to execute the information determination program stored in memory 42 to perform the following steps:
[0185] Obtain multiple sample data points from the sample anomalous program; where the sample data represents the runtime data of the sample anomalous program at different times during its execution.
[0186] Based on sample data, the initial real-time feature extraction model and the initial spatial feature extraction model are trained to obtain the target real-time feature extraction model and the target spatial feature extraction model.
[0187] Based on the real-time target feature extraction model and the target spatial feature extraction model, a target classification model is obtained;
[0188] The target classification model and target classifier are used to process the target running data of the program to be detected to determine whether the program to be detected is abnormal.
[0189] In other embodiments of this application, processor 41 is used to execute multiple sample data of a sample anomaly acquisition program stored in memory 42 to perform the following steps:
[0190] Obtain first and second data at different times during the execution of the sample abnormal program; wherein, the first data represents the function calls during the execution of the sample abnormal program, and the second data represents the memory usage during the execution of the sample abnormal program;
[0191] The format of each first data point and each second data point is converted.
[0192] Standardize each first and second data point after transformation to obtain the third and fourth data points.
[0193] The third and fourth data points are concatenated to obtain multiple sample data.
[0194] In other embodiments of this application, the processor 41 is used to perform model training on the initial real-time feature extraction model and the initial spatial feature extraction model based on sample data stored in the memory 42, to obtain the target real-time feature extraction model and the target spatial feature extraction model, in order to implement the following steps:
[0195] The initial real-time feature extraction model is used to extract features from the sample data to obtain the first feature information;
[0196] The first feature information is extracted using an initial spatial feature extraction model to obtain the second feature information;
[0197] Update the parameters of the initial real-time feature extraction model and the initial spatial feature extraction model;
[0198] The updated initial real-time feature extraction model is used to extract features from the sample data to obtain the third feature information, and the updated initial spatial feature extraction model is used to extract features from the third feature information until the target real-time feature extraction model and the target spatial feature extraction model are obtained.
[0199] In other embodiments of this application, the processor 41 is used to perform feature extraction on the sample data using an initial real-time feature extraction model stored in the memory 42 to achieve the following steps:
[0200] Multiple feature extractors in the initial real-time feature extraction model are used to extract features from multiple sample data to obtain the fourth feature information of each sample data; wherein, there is a correspondence between the sample data and the feature extractors;
[0201] Determine the weights corresponding to each feature extractor;
[0202] Based on the fourth feature information and weights, the feature extraction results of the sample data are determined.
[0203] In other embodiments of this application, processor 41 is used to execute the determination of weights corresponding to each feature extractor in memory 42 to implement the following steps:
[0204] The basic feature information is obtained by performing calculations on the feature extraction results corresponding to each feature extractor.
[0205] Weights are determined based on feature extraction results, basic feature information, and target values.
[0206] In other embodiments of this application, the processor 41 is used to execute the memory 42 to determine weights based on feature extraction results, basic feature information, and target values to achieve the following steps:
[0207] Determine the target value;
[0208] The objective function is used to process the feature extraction results, basic feature information, and target values to obtain weights.
[0209] In other embodiments of this application, processor 41 is used to execute the target real-time feature extraction model and the target spatial feature extraction model stored in memory 42 to obtain a target classification model, thereby implementing the following steps:
[0210] The target real-time feature extraction model and the target spatial feature extraction model are fused to obtain a target classification model.
[0211] In other embodiments of this application, the processor 41 is used to process the target running data of the program to be detected stored in the memory 42 using a target classification model and a target classifier to determine whether the program to be detected is abnormal, in order to implement the following steps:
[0212] Obtain the target execution data at different times during the execution of the program under test;
[0213] The target classification model is used to process the target running data to obtain target feature information;
[0214] A target classifier is used to process the target feature information to obtain the target probability of the target feature information;
[0215] If the target probability is greater than the probability threshold, the program to be detected is determined to be abnormal.
[0216] It should be noted that the specific implementation process of the steps executed by the processor in this embodiment can be referred to Figures 1-2 The implementation process of the information determination method provided in the corresponding embodiments will not be described in detail here.
[0217] The information determination device provided in the embodiments of this application is used to detect whether a program is abnormal. The target classification model includes both a real-time target feature extraction model and a spatial target feature extraction model. Because the real-time target feature extraction model can extract real-time feature information and the spatial target feature extraction model can extract spatial feature information, when using the target classification model to detect abnormal programs, it can extract both the real-time feature information and the spatial feature information corresponding to the program to be detected. The extracted feature information is more complete, and the detection result is more accurate. This solves the problem in related technologies where the real-time feature information generated at different times during the program's operation is not considered when using traditional convolutional neural networks to detect malicious programs, resulting in incomplete extracted feature information. This improves the accuracy of identifying abnormal programs.
[0218] Based on the foregoing embodiments, embodiments of this application provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement... Figures 1-2 The steps in the information determination method provided in the corresponding embodiment.
[0219] It should be noted that the aforementioned computer-readable storage media can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM), etc.; or it can be various electronic devices including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.
[0220] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0221] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.
[0222] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.
[0223] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0224] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0225] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0226] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.
Claims
1. A method for determining information, characterized in that, The method includes: Acquire first and second data at different times during the execution of the sample abnormal program; wherein, the first data is the dynamic link library information during the execution of the sample abnormal program, and the second data is the memory information during the execution of the sample abnormal program; The format of each of the first data and each of the second data is converted; wherein, the dynamic link library information of each of the sample abnormal programs is a feature matrix, each row of the feature matrix is the dynamic link library information and the number of times used by each process in the sample abnormal program during execution, the number of times the unused dynamic link library information is called is recorded as 0, and the dynamic link libraries are arranged horizontally in the order of calling the dynamic link libraries, and dynamic link library information with a contribution level lower than a preset threshold is filtered out, and each of the sample abnormal programs constitutes a two-dimensional feature matrix of the same size; Each of the first and second data points after transformation is standardized to obtain the third and fourth data points; the third and fourth data points are then concatenated to obtain multiple sample data points. The sample data is used to extract features using an initial real-time feature extraction model to obtain first feature information; the first feature information is then extracted using an initial spatial feature extraction model to obtain second feature information; the parameters of the initial real-time feature extraction model and the initial spatial feature extraction model are updated until a target real-time feature extraction model and a target spatial feature extraction model are obtained; wherein, multiple feature extractors in the initial real-time feature extraction model are used to extract features from the sample data, and the weight corresponding to each feature extractor is determined, where a weight of 0 indicates that the feature information extracted by the feature extractor is not considered, and a weight of 1 indicates that the feature information extracted by the feature extractor is considered; the feature extraction result of the sample data is determined based on the feature information extracted by the feature extractor and the weight. Based on the target real-time feature extraction model and the target spatial feature extraction model, a target classification model is obtained; The target classification model and target classifier are used to process the target running data of the program to be detected to determine whether the program to be detected is abnormal.
2. The method according to claim 1, characterized in that, The step of updating the parameters of the initial real-time feature extraction model and the initial spatial feature extraction model until the target real-time feature extraction model and the target spatial feature extraction model are obtained includes: Update the parameters of the initial real-time feature extraction model and the parameters of the initial spatial feature extraction model; The updated initial real-time feature extraction model is used to extract features from the sample data to obtain third feature information, and the updated initial spatial feature extraction model is used to extract features from the third feature information until the target real-time feature extraction model and the target spatial feature extraction model are obtained.
3. The method according to claim 1, characterized in that, Determining the weights corresponding to each feature extractor includes: The basic feature information is obtained by performing calculations on the feature extraction results corresponding to each of the aforementioned feature extractors; The weights are determined based on the feature extraction results, the basic feature information, and the target value.
4. The method according to claim 3, characterized in that, The step of determining the weights based on the feature extraction results, the basic feature information, and the target value includes: Determine the target value; The weights are obtained by processing the feature extraction results, the basic feature information, and the target value using an objective function.
5. The method according to claim 1, characterized in that, The target classification model obtained based on the real-time target feature extraction model and the target spatial feature extraction model includes: The target real-time feature extraction model and the target spatial feature extraction model are fused to obtain the target classification model.
6. The method according to claim 1, characterized in that, The step of processing the target running data of the program to be detected using the target classification model and target classifier to determine whether the program to be detected is abnormal includes: Acquire the target running data at different times during the execution of the program to be tested; The target classification model is used to process the target running data to obtain target feature information; The target feature information is processed using the target classifier to obtain the target probability of the target feature information; If the target probability is greater than the probability threshold, the program to be detected is determined to be abnormal.
7. An information determining device, characterized in that, The device includes: The acquisition unit is used to acquire first data and second data at different times during the execution of the sample abnormal program; wherein, the first data is dynamic link library information during the execution of the sample abnormal program, and the second data is memory information during the execution of the sample abnormal program. The format of each of the first data and each of the second data is converted; wherein, the dynamic link library information of each of the sample abnormal programs is a feature matrix, each row of the feature matrix is the dynamic link library information and the number of times used by each process in the sample abnormal program during execution, the number of times the unused dynamic link library information is called is recorded as 0, and the dynamic link libraries are arranged horizontally in the order of calling the dynamic link libraries, and dynamic link library information with a contribution level lower than a preset threshold is filtered out, and each of the sample abnormal programs constitutes a two-dimensional feature matrix of the same size; Each of the first and second data points after transformation is standardized to obtain the third and fourth data points; the third and fourth data points are then concatenated to obtain multiple sample data points. The training unit is used to extract features from the sample data using an initial real-time feature extraction model to obtain first feature information; to extract features from the first feature information using an initial spatial feature extraction model to obtain second feature information; and to update the parameters of the initial real-time feature extraction model and the initial spatial feature extraction model until a target real-time feature extraction model and a target spatial feature extraction model are obtained. Specifically, multiple feature extractors in the initial real-time feature extraction model are used to extract features from the sample data, and a weight is determined for each feature extractor. A weight of 0 indicates that the feature information extracted by the feature extractor is not considered, and a weight of 1 indicates that the feature information extracted by the feature extractor is considered. The feature extraction result of the sample data is determined based on the feature information extracted by the feature extractor and the weight. The processing unit is used to obtain a target classification model based on the target real-time feature extraction model and the target spatial feature extraction model; The determination unit is used to process the target running data of the program to be detected using the target classification model and the target classifier to determine whether the program to be detected is abnormal.
8. An information determining device, characterized in that, The device includes: a processor, a memory, and a communication bus; The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute the information determination program stored in the memory to implement the steps of the information determination method as described in any one of claims 1 to 6.
9. A computer-readable storage medium, characterized in that, The storage medium stores one or more programs, which can be executed by one or more processors to implement the steps of the information determination method as described in any one of claims 1 to 6.