Software classification model training method, classification method, device, model, and apparatus

Abstract

Embodiments of the present application provide a software classification model training method, a classification method, an apparatus, a model and a device, the method comprising: obtaining a first control flow graph of a function in a first binary sample, a second control flow graph of the function in a second binary sample, and a third control flow graph of the function in a third binary sample; training a semantic embedding sub-model using assembly instructions included in the first control flow graph; extracting semantic features of the second control flow graph and the third control flow graph using the trained semantic embedding sub-model to obtain a second attribute control flow graph and a third attribute control flow graph carrying the semantic features; training a function classifier using the second attribute control flow graph; classifying the third attribute control flow graph using the trained function classifier to obtain a classification label of the function, and training a malicious family classifier using the third attribute control flow graph carrying the classification label to obtain a trained software classification model.

Description

Technical Field

[0001] This application relates to the field of deep learning technology, and more specifically, to a software classification model training method, classification method, apparatus, model, and device. Background Technology

[0002] With the continuous development of internet and computer technologies, malware is also constantly evolving. Malware with malicious behavior, such as spyware, viruses, Trojans, and worms, is becoming increasingly diverse and poses a growing threat. To better combat malware, it is necessary to detect and classify its maliciousness. This allows for a deeper understanding of the malicious behavior and characteristics of malware, including its propagation methods, targets, and attack methods, enabling targeted prevention and the development of appropriate defense strategies.

[0003] In related technologies, an increasing number of advanced deep learning methods have been proposed and applied to malware classification tasks. However, deep learning-based malware classification methods suffer from poor interpretability and their classification performance needs improvement; these are pressing technical problems that need to be solved in this field. Summary of the Invention

[0004] The purpose of this application is to provide a software classification model training method, classification method, apparatus, model, and device to at least solve any one or more of the aforementioned technical problems.

[0005] The first aspect of this application provides a method for training a software classification model, wherein the software classification model includes a semantic embedding sub-model, a function classifier, and a malicious family classifier, and the method includes:

[0006] Obtain the first control flow graph of the function in the first binary sample, the second control flow graph of the function in the second binary sample, and the third control flow graph of the function in the third binary sample;

[0007] The semantic embedding sub-model is trained using the assembly instructions included in the first control flow graph;

[0008] The semantic features of the second control flow graph and the third control flow graph are extracted using the trained semantic embedding sub-model to obtain the second attribute control flow graph and the third attribute control flow graph carrying semantic features;

[0009] The function classifier is trained using the control flow graph based on the second attribute;

[0010] The third attribute control flow graph is classified using a trained function classifier to obtain the function's classification label. The third attribute control flow graph carrying the classification label is then used to train the malicious family classifier to obtain a trained software classification model.

[0011] In the above implementation process, the semantic embedding sub-model learns the semantic features in binary samples through training, enabling the model to extract semantic features from binary files. These semantic features then assist the model in subsequent identification and classification of malicious code, thereby improving the classification effect of malware. Furthermore, the model can utilize a function classifier to classify functions in malware. The identified malicious functions can be used to interpret the classification results and perform fine-grained attribution, thus providing efficient assistance to reverse engineers for secondary analysis of key samples.

[0012] Further, the function classifier includes a graph reconstruction model; training the function classifier using the second attribute control flow graph includes:

[0013] Obtain the target second attribute control flow graph from the second attribute control flow graph; wherein, the function corresponding to the target second attribute control flow graph belongs to the target category, and the target category includes benign category or malicious category;

[0014] The function classifier is trained using the control flow graph of the target's second attribute.

[0015] In the above implementation, a graph reconstruction model is used as the function classifier, and the target second attribute control flow graph corresponding to the target class function is used as training data. This results in the graph reconstruction model achieving better reconstruction results for the attribute control flow graphs of functions belonging to the target class, and worse reconstruction results for attribute control flow graphs of functions of other classes. Function classification is achieved based on the difference in reconstruction results for different attribute control flow graphs. The graph reconstruction model is trained in an unsupervised manner, requiring no labeling of the training data. Therefore, the second binary sample can be selected from data in unlabeled large-scale datasets, and the graph reconstruction model can be trained unsupervised on unlabeled large-scale datasets. This efficiently utilizes large-scale datasets, and unsupervised training has lower requirements for training data, reducing the difficulty of model training.

[0016] Further, the third binary sample includes benign functions and malicious functions; the step of classifying the third attribute control flow graph using a trained function classifier to obtain the function's classification label, and then training the malicious family classifier with the third attribute control flow graph carrying the classification label, includes:

[0017] The third attribute control flow graph is classified using a trained function classifier;

[0018] If the function corresponding to the control flow graph of the third attribute is classified into a malicious category, the classification label is determined to be the family label corresponding to the malicious family to which the third binary sample belongs;

[0019] If the function corresponding to the control flow graph of the third attribute is classified into a benign category, the classification label is determined to be a benign label;

[0020] The malicious family classifier is trained using a control flow graph carrying the family tag and a third attribute; or

[0021] The malicious family classifier is trained using a control flow graph carrying the third attribute of the family label and a control flow graph carrying the third attribute of the benign label.

[0022] In the above implementation process, if the malicious family classifier only encounters the third attribute control flow graph of malicious functions, it will focus more on malicious functions and will not learn the features of the attribute control flow graph of benign functions, thus avoiding interference in subsequent classifications. However, if the malicious family classifier learns the third attribute control flow graphs of both benign and malicious functions, even if the trained function classifier incorrectly identifies a benign function as malicious, the trained malicious family classifier can still identify and correct it as a benign function, filtering out the interference of benign functions on the software's classification results and improving classification accuracy.

[0023] Furthermore, the semantic embedding sub-model includes a bidirectional coded BERT model; the malicious family classifier includes a graph neural network model.

[0024] A second aspect of this application provides a software classification method, which is implemented based on a software classification model trained by the method described in the first aspect; the software classification model includes a semantic embedding sub-model, a function classifier, and a malicious family classifier; the classification method includes:

[0025] Obtain the fourth control flow graph corresponding to each function in the binary file to be classified;

[0026] The semantic embedding sub-model is used to extract the semantic features of all the fourth control flow graphs to obtain the fourth attribute control flow graph carrying the semantic features corresponding to each fourth control flow graph;

[0027] The function classifier is used to classify the target attribute control flow graph belonging to the malicious category from all the fourth attribute control flow graphs;

[0028] The target attribute control flow graph is input into the malicious family classifier, and the malicious family to which the binary file to be classified belongs is determined based on the output of the malicious family classifier.

[0029] In the above implementation process, malicious family classification of unknown malware was achieved. Furthermore, the function classifier identifies malicious functions from unknown malware, achieving malicious attribution at the function level. This means identifying malicious functions within the malware that may exhibit malicious behavior, thus assisting in subsequent manual analysis and verification. Additionally, the function classifier can filter out benign functions, eliminating interference from benign functions in the final step of malicious family classification, allowing the malicious family classifier to focus more intently on classifying malicious functions into families.

[0030] Furthermore, the method also includes:

[0031] If none of the fourth attribute control flow graphs belong to the malicious category, the binary file to be classified is determined to be benign software.

[0032] In the above implementation process, benign software was identified through a function classifier, enabling the software classification model to distinguish between benign and malicious software, and to classify malicious software into families.

[0033] Further, the output results include the probability distribution of the target attribute control flow graph corresponding to each malicious family category; determining the malicious family to which the binary file to be classified belongs based on the output results of the malicious family classifier includes:

[0034] For each malicious family category, obtain the sum of the probabilities of all the target attribute control flow graphs corresponding to the malicious family category;

[0035] The malicious family to which the binary file to be classified belongs is determined based on the sum of the probabilities of each of the malicious family categories.

[0036] In the above implementation process, the classification of malware into malware families is completed by accumulating the probability of all target attribute control flow graphs corresponding to the malware family category.

[0037] A third aspect of this application provides a training apparatus for a software classification model, the software classification model including a semantic embedding sub-model, a function classifier, and a malicious family classifier, the apparatus comprising:

[0038] The first acquisition module is used to acquire the first control flow graph of the function in the first binary sample, the second control flow graph of the function in the second binary sample, and the third control flow graph of the function in the third binary sample;

[0039] A semantic embedding sub-model training module is used to train the semantic embedding sub-model using the assembly instructions included in the first control flow graph;

[0040] The first extraction module is used to extract semantics from the second control flow graph and the third control flow graph using a trained semantic embedding sub-model, so as to obtain a second attribute control flow graph and a third attribute control flow graph carrying semantic information.

[0041] A function classifier training module is used to train the function classifier using the second attribute control flow graph;

[0042] The malicious family classifier training module is used to classify the third attribute control flow graph using a trained function classifier to obtain the classification label of the function, and to train the malicious family classifier with the third attribute control flow graph carrying the classification label to obtain a trained software classification model.

[0043] A fourth aspect of this application provides a software classification device, which is implemented based on a software classification model trained by the method described in the first aspect; the software classification model includes a semantic embedding sub-model, a function classifier, and a malicious family classifier; the classification device includes:

[0044] The second acquisition module is used to acquire the fourth control flow graph corresponding to each function in the binary file to be classified.

[0045] The second extraction module is used to perform semantic extraction on all the fourth control flow graphs using the semantic embedding sub-model, so as to obtain the fourth attribute control flow graph carrying semantic information corresponding to each fourth control flow graph.

[0046] The malicious function classification module is used to classify target attribute control flow graphs belonging to the malicious function category from all the fourth attribute control flow graphs using the function classifier.

[0047] The malicious family classification module is used to input the target attribute control flow graph into the malicious family classifier and determine the malicious family to which the binary file to be classified belongs based on the output of the malicious family classifier.

[0048] A fifth aspect of this application provides a software classification model, the model including a semantic embedding sub-model, a function classifier, and a malicious family classifier; wherein...

[0049] The semantic embedding sub-model is used to extract semantics from the fourth control flow graph corresponding to each function in the binary file to be classified, so as to obtain a fourth attribute control flow graph carrying semantic information for each fourth control flow graph.

[0050] The function classifier is used to classify target attribute control flow graphs belonging to the malicious function category from all the fourth attribute control flow graphs.

[0051] The malicious family classifier is used to classify the input target attribute control flow graph into families to obtain the malicious family to which the binary file to be classified belongs.

[0052] A sixth aspect of this application provides an electronic device, the electronic device comprising:

[0053] processor;

[0054] Memory used to store processor-executable instructions;

[0055] Wherein, when the processor invokes the executable instructions, it implements the operation of any of the training methods described in the first aspect, or any of the classification methods described in the second aspect.

[0056] A seventh aspect of this application provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of any of the training methods described in the first aspect or any of the classification methods described in the second aspect. Attached Figure Description

[0057] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This is a schematic diagram of the structure of a software classification model provided in an embodiment of this application;

[0059] Figure 2 A flowchart illustrating a training method for a software classification model provided in an embodiment of this application;

[0060] Figure 3 A schematic diagram illustrating the training process of the software classification model provided in the embodiments of this application;

[0061] Figure 4 A schematic diagram illustrating the semantic embedding sub-model training process provided in an embodiment of this application;

[0062] Figure 5 A flowchart illustrating another training method for a software classification model provided in an embodiment of this application;

[0063] Figure 6 A schematic diagram illustrating the training process of a function classifier provided in an embodiment of this application;

[0064] Figure 7A flowchart illustrating another training method for a software classification model provided in an embodiment of this application;

[0065] Figure 8 A flowchart illustrating another training method for a software classification model provided in an embodiment of this application;

[0066] Figure 9 A flowchart illustrating a software classification method provided in an embodiment of this application;

[0067] Figure 10 A flowchart illustrating another software classification method provided in an embodiment of this application;

[0068] Figure 11 A structural block diagram of a training device for a software classification model provided in an embodiment of this application;

[0069] Figure 12 A structural block diagram of a software classification device provided in an embodiment of this application;

[0070] Figure 13 This is a hardware structure diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0071] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0072] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0073] Currently, an increasing number of advanced deep learning methods are being proposed and applied to malware classification tasks. However, most deep learning-based malware classification schemes perform feature analysis and classification based on the entire malware, resulting in poor interpretability of the classification results and an inability to accurately attribute the causes of the classification results with fine granularity. Furthermore, before using deep learning for malware classification, the corresponding neural network model needs to be trained. Supervised training methods are highly dependent on data, requiring sufficiently broad, large-scale, and high-quality datasets as supervised training data to train a high-performance neural network model. This places stringent requirements on the training data. In addition, the performance of deep learning-based malware classification still needs improvement.

[0074] To this end, this application proposes a software classification model that identifies whether software is malicious by classifying the corresponding binary files; and performs source analysis on the malicious software to determine the malicious family to which it belongs. Figure 1 As shown, the software classification model 100 includes a semantic embedding sub-model 110, a function classifier 120, and a malicious family classifier 130 connected in sequence.

[0075] First, this application provides a method for training a software classification model, used to train a software classification model 100. See [link to relevant documentation]. Figure 2 and Figure 3 The training method includes steps 210-250.

[0076] Step 210: Obtain the first control flow graph of the function in the first binary sample, the second control flow graph of the function in the second binary sample, and the third control flow graph of the function in the third binary sample;

[0077] A binary sample refers to an executable binary file of a compiled software program. The first binary sample can be one or more, including binary files corresponding to benign software (benign samples) and / or binary files corresponding to malicious software (malicious samples). The second binary sample can be one or more, and can include both benign and / or malicious samples. The third binary sample can be one or more, and can include both benign and malicious samples, or only malicious samples.

[0078] Binary samples belonging to the same category (benign or malicious) in the first, second, and third binary samples can be the same or different.

[0079] For example, one or more benign samples and one or more malicious samples can be obtained, and the benign samples and / or malicious samples can be used as the first binary sample mentioned above. The benign samples and / or malicious samples can be used as the second binary sample mentioned above. The benign samples and malicious samples can be used as the third binary sample mentioned above, or the malicious sample can be used as the third binary sample mentioned above.

[0080] Furthermore, the software program includes multiple functions. By disassembling the binary sample, a control flow graph (CFG) corresponding to each function can be obtained. A one-to-one correspondence between functions means that each function corresponds to one control flow graph. The number of control flow graphs included in the binary sample is consistent with the number of functions it contains.

[0081] Therefore, by disassembling the first binary sample, a first control flow graph can be obtained. This first control flow graph comprises multiple graphs, the number of which corresponds to the number of functions included in the first binary sample.

[0082] By disassembling the second binary sample, a second control flow graph can be obtained. This second control flow graph comprises multiple graphs, the number of which corresponds to the number of functions included in the second binary sample.

[0083] By disassembling the third binary sample, a third control flow graph can be obtained. This third control flow graph comprises multiple graphs, the number of which corresponds to the number of functions included in the third binary sample.

[0084] A control flow graph represents all the paths traversed during the execution of a binary sample. A control flow graph consists of basic blocks, each containing one or more assembly instructions executed sequentially. These basic blocks are connected by edges, which represent possible program execution paths. Thus, each first control flow graph includes one or more first basic blocks, each second control flow graph includes one or more second basic blocks, and each third control flow graph includes one or more third basic blocks.

[0085] Step 220: Train the semantic embedding sub-model using the assembly instructions included in the first control flow graph;

[0086] For example, the semantic embedding sub-model 110 can be any language model in the related art.

[0087] The first control flow graph corresponding to each function in the first binary sample includes one or more first basic blocks, and each first basic block includes one or more assembly instructions. Therefore, the assembly instructions included in the first control flow graph can be used as training data for the semantic embedding sub-model 110. The required training data can be determined according to the model size of the semantic embedding sub-model 110, thereby obtaining sufficient training data from all the first control flow graphs corresponding to all the first binary samples.

[0088] For example, assembly instructions can be used as training data to perform unsupervised training on the semantic embedding sub-model 110, so that the semantic embedding sub-model 110 learns the semantic features in the assembly instructions during the unsupervised training process.

[0089] After training the semantic embedding sub-model 110, the trained semantic embedding sub-model 110 can be obtained, and step 230 can be executed.

[0090] Step 230: Extract the semantic features of the second control flow graph and the third control flow graph using the trained semantic embedding sub-model to obtain the second attribute control flow graph and the third attribute control flow graph carrying semantic features;

[0091] The trained semantic embedding sub-model 110 can be used to extract semantic features. By extracting semantic features from the control flow graph using the trained semantic embedding sub-model 110, a corresponding attribute control flow graph can be obtained. There is a one-to-one correspondence between the control flow graph and the attribute control flow graph. That is, each function corresponds to one control flow graph and one attribute control flow graph. Extracting semantic features from each control flow graph yields a corresponding attribute control flow graph.

[0092] Specifically, an attribute control flow graph consists of multiple nodes. Each node in the attribute control flow graph corresponds to a basic block in the control flow graph. The attributes of a node are semantic features; that is, the attributes of each node represent the semantic features of the basic block it corresponds to.

[0093] For example, for each basic block of the control flow graph, the semantic features of each assembly instruction contained in the basic block can be extracted using the trained semantic embedding sub-model 110, and the semantic features of the basic block can be determined based on the semantic features of each assembly instruction in the basic block. The semantic features of the basic block are the attributes of the corresponding node in the attribute control flow graph.

[0094] Optionally, the semantic features of each assembly instruction in the basic block can be averaged and pooled to obtain the semantic features of the basic block.

[0095] Thus, for each second control flow graph corresponding to a function in the second binary sample, the semantic features of the second control flow graph can be extracted using the trained semantic embedding sub-model 110 to obtain the second attribute control flow graph carrying semantic features corresponding to the second control flow graph; for each third control flow graph corresponding to a function in the third binary sample, the semantic features of the third control flow graph can be extracted using the trained semantic embedding sub-model 110 to obtain the third attribute control flow graph carrying semantic features corresponding to the third control flow graph.

[0096] Specifically, for each second basic block in the second control flow graph, the semantic features of each assembly instruction contained in the second basic block are extracted using the trained semantic embedding sub-model 110. Based on the semantic features of each assembly instruction in the second basic block, the semantic features of the second basic block are determined. The semantic features of the second basic block are the attributes of the corresponding nodes in the second attribute control flow graph. After obtaining the attributes of each node, the second attribute control flow graph can be generated. Similarly, the generation process of the third attribute control flow graph is similar to that of the second attribute control flow graph, and will not be described in detail here.

[0097] Step 240: Train the function classifier using the second attribute control flow graph;

[0098] For example, the function classifier 120 can be any neural network model with function classification function in related technologies.

[0099] As a feasible example, the second-attribute control flow graph can carry classification labels, which characterize the category to which the function corresponding to the second-attribute control flow graph belongs. For example, functions can be divided into malicious functions and benign functions. Thus, the classification labels can include malicious labels and benign labels. In this way, the function classifier can be trained in a supervised manner using the second-attribute control flow graph carrying classification labels. During the training process, the function classifier 120 can learn the different features of malicious functions and benign functions on the attribute control flow graph, thereby possessing the ability to classify benign and malicious functions.

[0100] Furthermore, the required training data can be determined according to the model size of the function classifier 120, thereby obtaining a sufficient number of second attribute control flow graphs as training data from all the second binary samples.

[0101] After training the function classifier 120, the trained function classifier 120 can be obtained, and step 250 can be executed.

[0102] Step 250: Classify the third attribute control flow graph using the trained function classifier to obtain the function classification label, and train the malicious family classifier with the third attribute control flow graph carrying the classification label to obtain the trained software classification model.

[0103] For example, the malicious family classifier 130 can be any neural network model with malicious family classification function in related technologies.

[0104] The trained function classifier 120 can be used to classify the attribute control flow graph. Since each function in the third binary sample corresponds to a third attribute control flow graph, the trained function classifier 120 can be used to classify the third attribute control flow graph, thereby achieving function classification.

[0105] When classifying the third-attribute control flow graph using the trained function classifier 120, the classification labels of the functions corresponding to the third-attribute control flow graph can be obtained.

[0106] Optionally, the classification labels may include benign labels and family labels. Thus, the third-attribute control flow graphs carrying benign labels and the third-attribute control flow graphs carrying family labels are used as training data for the malicious family classifier 130. The malicious family classifier 130 can learn the features of the third-attribute control flow graphs corresponding to different malicious families and the features of the third-attribute control flow graphs corresponding to benign samples. Therefore, the trained malicious family classifier 130 can classify malicious samples as malicious families and identify benign samples.

[0107] Optionally, the classification label may include a family label. Thus, the third-attribute control flow graph carrying the family label is used as training data for the malicious family classifier 130. The malicious family classifier 130 can learn the features of the third-attribute control flow graph corresponding to different malicious families. Therefore, the trained malicious family classifier 130 can classify malicious samples into malicious families.

[0108] For example, the malicious family classifier 130 is trained using a control flow graph carrying a classification label, for example, in a supervised manner.

[0109] The required training data can be determined according to the model size of the malicious family classifier 130, thereby obtaining a sufficient number of third attribute control flow graphs carrying classification labels as training data from all third binary samples.

[0110] After training the malicious family classifier 130, a trained malicious family classifier 130 can be obtained. At this point, each sub-model in the software classification model 100 has completed training, thus obtaining a trained software classification model.

[0111] As can be seen, the software classification model trained using the training method provided in this application includes a semantic embedding sub-model that learns semantic features from binary samples. This enables the model to extract semantic features from binary files and utilize these features to assist in the subsequent identification and classification of malicious code. Compared to related technologies that use traditional manual features, such as counting the number of opcodes in basic blocks, using semantic features to assist in classifying malicious code can effectively improve the classification performance of malware.

[0112] Furthermore, the model includes a function classifier that learns the characteristics of the attribute control flow graph of a certain class of functions through training, enabling the model to classify functions. Therefore, the model can also classify functions in malware, and the identified malicious functions can be used to interpret the classification results and perform fine-grained attribution, thus providing efficient assistance to reverse engineers for secondary analysis of key samples.

[0113] The implementation process of steps 210-250 is described in detail below.

[0114] In some embodiments, the semantic embedding sub-model 110 may be a BERT (Bidirectional Encoder Representation from Transformers) model.

[0115] For example, in step 220, the BERT model can be unsupervised trained on one or more of the following tasks: MLM (Mask Language Model), NSP (Next Sentence Prediction), and STS (Semantic Textual Similarity).

[0116] Of course, in addition to the BERT model, the semantic embedding sub-model 110 can also be other language models in the field that can perform unsupervised learning. This application will not list them all here. The BERT model does not constitute the only implementation of the semantic embedding sub-model 110 and does not limit the scope of protection.

[0117] As we can see, since the BERT model can be trained unsupervised, the first binary sample can be selected from data in a large-scale unlabeled dataset. This allows BERT to be trained unsupervised on large-scale unlabeled datasets. On the one hand, it makes efficient use of large-scale datasets; on the other hand, unsupervised training has lower requirements for training data, reducing the difficulty of model training.

[0118] Furthermore, since the binary code of malicious samples and benign samples is syntactically indistinguishable, the first binary sample can be selected from a large-scale unlabeled dataset without concern for the sample category.

[0119] Furthermore, regarding the process of obtaining the assembly instructions used to train the BERT model, exemplarily, as follows: Figure 4 As shown, for each first control flow graph, starting from the first basic block corresponding to the entry node of the first control flow graph, a sequence of instructions to be simulated and executed can be obtained through random walks. The instruction sequence includes assembly instructions. Subsequently, instruction pairs can be obtained from the instruction sequence as training data. Each instruction pair consists of two adjacent or non-adjacent assembly instructions from the instruction sequence. Each instruction pair is one training data point. Therefore, multiple instruction pairs can be obtained from the first control flow graph to form a training dataset, which can then be used to train the BERT model.

[0120] Thus, step 220 above may include:

[0121] Using instruction pairs obtained from the first control flow graph, the BERT model is trained unsupervised based on one or more of the MLM, NSP, and STS tasks.

[0122] Specifically, see [link to relevant documentation] Figure 4 Each instruction pair can be concatenated into a text sequence and input into the BERT model for training. Based on the MLM task, some word segments in the text sequence are masked, and the BERT model predicts the masked words, thus achieving unsupervised training. Based on the NSP task, the BERT model predicts whether two assembly instructions in a text sequence are adjacent, thus achieving unsupervised training. Based on the STS task, the BERT model uses contrastive learning to narrow the distance between similar assembly instructions in the feature space, thus achieving model fine-tuning.

[0123] BERT models trained on MLM, NSP, and STS tasks can be used to extract semantic features of assembly instructions. Specifically, the more similar the assembly instructions, the closer their semantic features are in the feature space.

[0124] In some embodiments, the function classifier 120 can be any neural network model with function classification capabilities in related technologies. For example, the function classifier 120 can be trained in a supervised manner.

[0125] In some embodiments, the function classifier 120 may be a graph reconstruction model. For example, the graph reconstruction model may include, but is not limited to, models capable of image reconstruction such as GAE (Graph Autoencoders) models and VGAE (Variational Graph Autoencoders) models.

[0126] Among them, the graph reconstruction model is used to reconstruct the input graph through an encoding-decoding process, that is, to map the input graph to a certain feature space, and then to map it back from this feature space to the input space to reconstruct the graph.

[0127] Thus, step 240 above may include, for example: Figure 5 Steps 241-242 are shown.

[0128] Step 241: Obtain the target second attribute control flow graph from the second attribute control flow graph;

[0129] Wherein, the function corresponding to the control flow graph of the second attribute of the target belongs to the target category, and the target category includes benign category or malicious category;

[0130] As described above, since the second binary sample may include benign samples and / or malicious samples, and the function in the benign sample is a benign function, while the function in the malicious sample includes both benign and malicious functions, the second attribute control flow graph corresponding to the function in the second binary sample includes the second attribute control flow graph corresponding to the benign function and the second attribute control flow graph corresponding to the malicious function.

[0131] In this embodiment, the target second attribute control flow graph corresponding to the function belonging to the target category is used. The target category includes benign or malicious categories. That is, the second attribute control flow graph corresponding to either benign or malicious functions is used as the training data for the function classifier 120, i.e., the graph reconstruction model.

[0132] Step 242: Train the function classifier using the control flow graph of the target's second attribute.

[0133] For example, after the target second attribute controls the flow graph input graph reconstruction model, the graph reconstruction model performs encoding-decoding reconstruction training on it.

[0134] Specifically, after the graph reconstruction model reconstructs the input target second attribute control flow graph through encoding and decoding, it can output a reconstructed second attribute control flow graph. By comparing the original target second attribute control flow graph with the reconstructed second attribute control flow graph, the model parameters of the graph reconstruction model can be updated, thereby completing the training.

[0135] Taking the VGAE model as an example, the VGAE model includes a Graph Convolutional Network (GCN) encoder and an inner product decoder. Figure 6 As shown, during training, the GCN encoder can embed the input target second-attribute control flow graph into a high-dimensional vector, and then apply the inner product decoder to reconstruct the original graph structure, obtaining the reconstructed second-attribute control flow graph. For example, the loss function of the graph reconstruction model includes two parts: the first part is the weighted cross-entropy loss between the original target second-attribute control flow graph and the reconstructed second-attribute control flow graph; the second part is the divergence between the latent variable distribution represented by the node vectors and the standard normal distribution.

[0136] As can be seen, the model is updated during training by comparing the difference between the output reconstructed second-attribute control flow graph and the input target second-attribute control flow graph. This training process does not depend on whether the input data carries labels, and the model itself does not need to know the category of the input data. Therefore, this reconstruction training is actually unsupervised training.

[0137] Furthermore, since the graph reconstruction model only encounters the target second attribute control flow graph corresponding to the function belonging to the target category during the training process, the graph reconstruction model can only learn the features of the attribute control flow graph of a certain type of function. Therefore, it can reconstruct the attribute control flow graph of that type of function well, but cannot learn the features of the attribute control flow graph of another type of function. As a result, the reconstruction results of the attribute control flow graph of another type of function are poor.

[0138] For example, if the target category is malicious, the graph reconstruction model can only learn the features of the attribute control flow graph of malicious functions, but cannot learn the features of the attribute control flow graph of benign functions. Therefore, the trained graph reconstruction model can reconstruct the attribute control flow graph of malicious functions relatively well, meaning the reconstructed graph has a high similarity to the original graph; however, it cannot reconstruct the attribute control flow graph of benign functions relatively well, meaning the reconstructed graph has a low similarity to the original graph. Thus, in practical applications, when faced with attribute control flow graphs of unknown categories, the similarity between the original and reconstructed attribute control flow graphs can be used to distinguish their categories, i.e., using the reconstruction error as the classification standard. The trained function classifier 120 can then identify the maliciousness of each function; the specific process will be elaborated below.

[0139] Furthermore, while the training data for graph reconstruction models can be second-attribute control flow graphs corresponding to either benign or malicious functions, it's easier to construct a large-scale set of benign samples than malicious samples. Also, if malicious samples are used as the second binary samples, since they include both malicious and benign functions, it would be necessary to manually or mechanically select the second-attribute control flow graphs corresponding to one type of function from the malicious samples as training data. However, benign samples only include benign functions and do not require selection.

[0140] Therefore, optionally, the second binary sample can include benign samples, and the target category can be the benign category. Thus, in step 241, it can be directly determined that all second-attribute control flow graphs corresponding to functions in the second binary sample are target second-attribute control flow graphs, and can be directly used for training the graph reconstruction model. The graph reconstruction model then learns the features of the attribute control flow graphs corresponding to benign functions. The trained graph reconstruction model performs well in reconstructing attribute control flow graphs corresponding to benign functions, but poorly in reconstructing attribute control flow graphs corresponding to malicious functions. Therefore, attribute control flow graphs of unknown categories can be classified according to the good / bad reconstruction performance.

[0141] As can be seen in this embodiment, by employing a graph reconstruction model as the function classifier and using the target second attribute control flow graph corresponding to the target class function as training data, the graph reconstruction model achieves better reconstruction results for the attribute control flow graphs of functions belonging to the target class, and worse reconstruction results for attribute control flow graphs of functions of other classes. The purpose of function classification is achieved based on the difference in the quality of reconstruction results for different attribute control flow graphs. Compared to other classification models in related technologies, the graph reconstruction model is trained in an unsupervised manner, requiring no labeling of the training data. Therefore, the second binary sample can be selected from data in a large-scale unlabeled dataset, and the graph reconstruction model can be trained unsupervised on a large-scale unlabeled dataset. On the one hand, it efficiently utilizes large-scale datasets; on the other hand, unsupervised training has lower requirements for training data, reducing the difficulty of model training.

[0142] In some embodiments, the third binary sample includes both benign and malicious functions.

[0143] Optionally, the third binary sample includes both benign and malicious samples. Since benign samples include benign functions and malicious samples include both benign and malicious functions, the third binary sample includes both benign and malicious functions.

[0144] Optionally, the third binary sample includes only malicious samples. Since malicious samples include both benign and malicious functions, the third binary sample includes both benign and malicious functions.

[0145] Thus, the training process of the malicious family classifier 130 in step 250 above can include, for example: Figure 7 The steps shown, or including, are as follows Figure 8 The steps are shown.

[0146] exist Figure 7 In the training process of the malicious family classifier 130, the following steps are included:

[0147] Step 251: Classify the third attribute control flow graph using the trained function classifier;

[0148] The trained function classifier 120 can be used to classify attribute control flow graphs and determine whether the function corresponding to the third attribute control flow graph belongs to the malicious category or the benign category.

[0149] Step 252: If the function corresponding to the control flow graph of the third attribute is classified as a malicious category, determine that the classification label is the family label corresponding to the malicious family to which the third binary sample belongs;

[0150] Regarding the malicious samples in the third binary sample, as mentioned above, malicious samples include both benign and malicious functions. Ideally, the malicious functions in the malicious samples would be classified into the malicious category in step 251.

[0151] In addition, malicious samples can be classified into different malicious families, such as, but not limited to, backdoors, generics, viruses, trojans, worms, etc.

[0152] Thus, for a function classified as malicious, the family label corresponding to the malicious family to which the malicious sample to which the function belongs can be used as the classification label and carried in the third attribute control flow graph of the function.

[0153] As an example, malicious samples in the third binary sample can carry family labels. Thus, when the trained function classifier 120 determines that a certain function in the malicious sample belongs to the malicious category, the family label carried by the malicious sample can be used as the classification label and carried in the third attribute control flow graph corresponding to the function, thereby obtaining the third attribute control flow graph carrying the family label.

[0154] Step 253: If the function corresponding to the control flow graph of the third attribute is classified into a benign category, determine that the classification label is a benign label;

[0155] Regarding the malicious samples in the third binary sample, as mentioned above, malicious samples include both benign and malicious functions. Regarding the benign samples in the third binary sample, as mentioned above, benign samples include benign functions. Ideally, both the benign functions in the malicious samples and the benign functions in the benign samples would be classified as benign in step 251.

[0156] Regardless of whether the function classified as benign comes from a malicious or benign sample, it will be labeled as benign, thus obtaining a third-attribute control flow graph carrying the benign label.

[0157] Step 254: Train the malicious family classifier using the third attribute control flow graph carrying the family tag.

[0158] In this embodiment, only the third attribute control flow graph carrying family labels is used as training data. Thus, the trained function classifier 120 actually acts as a function filter during the training process of the malicious family classifier 130, filtering out malicious functions in the third binary sample and labeling them with family labels for training the malicious family classifier 130.

[0159] Since the malicious family classifier 130 only encounters the third attribute control flow graph of malicious functions, it focuses more on malicious functions and does not learn the features of the attribute control flow graph of benign functions, thus avoiding interference in subsequent classifications. In this way, the trained malicious family classifier 130 can be used to infer the category of any unknown malicious sample.

[0160] For example, training the malicious family classifier 130 using a third attribute control flow graph carrying a family label is supervised training.

[0161] For example, during training, the malicious family classifier 130 can use the third attribute of the input control flow graph to give the probability distribution of different family categories as the prediction result.

[0162] For example, the cross-entropy loss between the predicted results and the ground truth (family label) can be used as a loss function to optimize the malicious family classifier 130.

[0163] For example, the malicious family classifier 130 can be a graph neural network (GNN) model.

[0164] exist Figure 8 In the training process of the malicious family classifier 130, the following steps are included:

[0165] Step 251: Classify the third attribute control flow graph using the trained function classifier;

[0166] Step 252: If the function corresponding to the control flow graph of the third attribute is classified as a malicious category, determine that the classification label is the family label corresponding to the malicious family to which the third binary sample belongs;

[0167] Step 253: If the function corresponding to the control flow graph of the third attribute is classified into a benign category, determine the classification label as a benign label;

[0168] Step 255: Train the malicious family classifier with the third attribute control flow graph carrying the family label and the third attribute control flow graph carrying the benign label.

[0169] For the specific implementation process of steps 251-253, please refer to [link / reference]. Figure 7 The steps described in the embodiments will not be repeated here.

[0170] and Figure 7 The difference from the previous embodiment is that, after executing steps 251-253, this embodiment executes step 255.

[0171] In this embodiment, the control flow graph of the third attribute carrying the family tag and the control flow graph of the third attribute carrying the benign tag are... Figure 1 The same data is used as training data for the malicious family classifier 130. Thus, the trained function classifier 120 actually plays the role of function classification and labeling in the training process of the malicious family classifier 130, distinguishing between malicious functions and benign functions in the third binary sample, and labeling the two types of functions with different labels, which is used to train the malicious family classifier 130.

[0172] Considering that the function classifier 120 can accurately classify functions into the correct categories under ideal conditions, but in practice, the trained function classifier 120 may still make classification errors. During the model usage phase, if the trained function classifier 120 incorrectly identifies a benign function as a malicious category, the benign function will be input into the trained malicious family classifier 130 and classified into a malicious family. Obviously, this will affect the accuracy of the final software classification result. Therefore, in this embodiment, the third attribute control flow graph carrying the benign label is also used as part of the training data, so that the trained malicious family classifier 130 can also classify and identify the attribute control flow graph corresponding to the benign function. Thus, during the model usage phase, even if the trained function classifier 120 incorrectly identifies a benign function as a malicious category, the trained malicious family classifier 130 can still identify and correct it as a benign function, filtering out the interference of benign functions on the software classification result, thereby improving classification accuracy. In this way, the trained malicious family classifier 130 can automatically filter out the interference of benign functions and infer the category of any unknown malicious sample.

[0173] For example, training the malicious family classifier 130 using a third attribute control flow graph carrying a family label and a third attribute control flow graph carrying a benign label is supervised training.

[0174] For example, during training, the malicious family classifier 130 can use the third attribute of the input control flow graph to give the probability distribution of different family categories and benign categories as the prediction result.

[0175] For example, the cross-entropy loss between the predicted results and the ground truth (classification label) can be used as a loss function to optimize the malicious family classifier 130.

[0176] For example, the malicious family classifier 130 can be a graph neural network (GNN) model.

[0177] This completes the training process of the software classification model. The following section introduces the usage phase of the trained software classification model.

[0178] A second aspect of this application provides a software classification method, which is based on, for example... Figure 1 The software classification model 100 shown is implemented, and the software classification model 100 is trained based on the training method provided in any of the above embodiments. For example... Figure 9 As shown, the software classification method includes steps 910-940.

[0179] Step 910: Obtain the fourth control flow graph corresponding to each function in the binary file to be classified;

[0180] For example, the binary file to be classified contains multiple functions. By disassembling the binary file, a fourth control flow graph corresponding to each function can be obtained. The number of fourth control flow graphs is consistent with the number of functions in the binary file to be classified.

[0181] Step 920: Extract the semantic features of all the fourth control flow graphs using the semantic embedding sub-model to obtain the fourth attribute control flow graph carrying semantic features corresponding to each fourth control flow graph;

[0182] The fourth control flow graph includes one or more fourth basic blocks, and each fourth basic block includes one or more assembly instructions. For example, for each fourth basic block, the semantic embedding sub-model 110 can be used to extract semantic features from each assembly instruction contained in the fourth basic block, and the semantic features of the fourth basic block can be determined based on the semantic features of each assembly instruction in the fourth basic block. The semantic features of the fourth basic block are the attributes of the corresponding node in the fourth attribute control flow graph.

[0183] By determining the semantic features of each fourth basic block in the fourth control flow graph, the corresponding fourth attribute control flow graph carrying semantic features can be obtained. The fourth attribute control flow graphs of all functions in the binary file to be classified are generated through the above process, thus obtaining all the fourth attribute control flow graphs of the binary file to be classified.

[0184] Optionally, the semantic embedding sub-model 110 can be a BERT model, or it can be other language models in related technologies.

[0185] Step 930: Use the function classifier to classify the target attribute control flow graph belonging to the malicious category from all the fourth attribute control flow graphs;

[0186] The function classifier 120 can classify each fourth-attribute control flow graph and determine the maliciousness of each fourth-attribute control flow graph through classification. Each fourth-attribute control flow graph may be classified into a malicious category or a benign category. Among all fourth-attribute control flow graphs, the fourth-attribute control flow graph classified into the malicious category is the target attribute control flow graph.

[0187] Optionally, the function classifier 120 can be a graph reconstruction model. During classification using the graph reconstruction model, a similarity threshold can be set, and the reconstruction error can be used as the classification criterion.

[0188] Specifically, the judgment principle can be determined based on the training data category of the graph reconstruction model. For example, if the training data of the graph reconstruction model is the attribute control flow graph corresponding to a benign function, as can be seen from the above examples, the graph reconstruction model has a better reconstruction effect on the attribute control flow graph of a benign function and a worse reconstruction effect on the attribute control flow graph of a malicious function.

[0189] Therefore, the judgment principle is as follows:

[0190] If the similarity between the reconstructed attribute control flow graph output by the graph reconstruction model and the input fourth attribute control flow graph is not less than the similarity threshold, then the function corresponding to the fourth attribute control flow graph is determined to be a benign category.

[0191] If the similarity between the reconstructed attribute control flow graph output by the graph reconstruction model and the input fourth attribute control flow graph is less than the similarity threshold, then the function corresponding to the fourth attribute control flow graph is determined to be malicious.

[0192] Step 940: After using the function classifier 120 to filter out the target attribute control flow graph belonging to the malicious category, the target attribute control flow graph can be input into the malicious family classifier 130 for family classification. Finally, based on the output of the malicious family classifier 130, the malicious family to which the binary file to be classified belongs can be determined, thus completing the task of family classification of malicious software.

[0193] As can be seen, the software classification method provided in this application can classify unknown malicious software into malicious families. Furthermore, the function classifier identifies malicious functions from unknown malicious software, achieving malicious attribution at the function level, that is, identifying malicious functions within the malicious software that may exhibit malicious behavior, thus assisting in subsequent manual analysis and verification. The function classifier can also filter out benign functions, eliminating interference from benign functions in the final step of malicious family classification, allowing the malicious family classifier to focus more on classifying malicious functions into families.

[0194] In some embodiments, the above classification method further includes the step of:

[0195] If none of the fourth attribute control flow graphs belong to the malicious category, the binary file to be classified is determined to be benign software.

[0196] For the fourth attribute control flow graphs corresponding to all functions in the binary file to be classified, when using the function classifier to classify all fourth attribute control flow graphs, if all fourth attribute control flow graphs are classified into the benign category, but the target attribute control flow graph belonging to the malicious category cannot be classified, then it can be inferred that the binary file to be classified is benign software, and the classification process ends.

[0197] As can be seen, this embodiment achieves the identification of benign software through a function classifier, enabling the software classification model to not only distinguish between benign and malicious software, but also to classify malicious software into families.

[0198] Regarding step 940, in some embodiments, the output of the malicious family classifier 130 includes the probability distribution of each malicious family category corresponding to the input target attribute control flow graph. Thus, the process of determining the malicious family based on the output in step 940 may include:

[0199] For each malicious family category, obtain the sum of the probabilities of all the target attribute control flow graphs corresponding to the malicious family category;

[0200] The malicious family to which the binary file to be classified belongs is determined based on the sum of the probabilities of each of the malicious family categories.

[0201] If the binary file to be classified is malware, it contains one or more malicious functions. For each malicious function's target attribute control flow graph, the malware family classifier 130 outputs the probability distribution for each malware family category. Therefore, the probabilities of all target attribute control flow graphs for a given malware family category can be summed to obtain the total probability of that malware family category. Finally, based on the total probability of all malware family categories, the malware family to which the binary file to be classified belongs is determined. For example, the malware family category with the highest total probability is determined as the malware family to which the binary file to be classified belongs.

[0202] As can be seen, this embodiment completes the classification of malware into malware families by accumulating the probability of all target attribute control flow graphs corresponding to malware family categories.

[0203] To better understand the technical solution of this application, an example will be used to illustrate it in detail below.

[0204] The training phase of a software classification model can be divided into the data collection process and the training process.

[0205] The data collection process may include:

[0206] 1. Obtain the malicious sample dataset provided by the enterprise. This dataset can include binary files corresponding to malware under multiple malware family categories, i.e., malicious samples.

[0207] 2. Obtain mainstream software packages from open-source software sources, and then obtain a large number of binary files corresponding to benign software from these packages, i.e., benign samples.

[0208] 3. Use a decompiler, such as IDA Pro, to decompile malicious and benign samples to obtain the control flow graph and assembly instructions of the functions in each sample. The assembly instructions are contained in each basic block of the control flow graph.

[0209] Subsequently, the training process may include:

[0210] 1. Train the semantic embedding sub-model

[0211] 1.1 For each first control flow graph of all samples (benign samples and malicious samples, i.e., the first binary sample), start from the entry node of the first control flow graph and perform random traversal to obtain the instruction sequence to be simulated.

[0212] 1.2 Sample instruction pairs from the instruction sequence as training data.

[0213] 1.3. Use the MLM pre-training task and the NSP pre-training task to perform unsupervised pre-training of the BERT model.

[0214] 1.4. Use the STS task to perform unsupervised fine-tuning of the pre-trained BERT model.

[0215] The fine-tuned BERT model is a semantic embedding sub-model, which can extract semantic vectors from assembly instructions. The more similar the assembly instructions are, the closer the extracted semantic vectors are in the feature space.

[0216] 2. Training the function classifier

[0217] 2.1 Obtain the second control flow graph of all functions in the benign sample (i.e., the second binary sample);

[0218] 2.2. Use the trained semantic embedding sub-model to extract semantic features for the second basic block of each second control flow graph, generate a second attribute control flow graph with semantic features as node attributes, and obtain the second attribute control flow graph dataset.

[0219] 2.3 The second attribute control flow graph is input into the VGAE model for unsupervised reconstruction training.

[0220] The trained VGAE model is a function classifier that uses reconstruction error as the distinguishing criterion.

[0221] 3. Train the malicious family classifier

[0222] 3.1 Obtain the third control flow graph of all functions in the malicious sample (i.e., the third binary sample);

[0223] 3.2. Use the trained semantic embedding sub-model to extract semantic features for the third basic block in each third control flow graph, and generate a third attribute control flow graph with semantic features as node attributes.

[0224] 3.3 Use the trained function classifier to classify the malicious functions in the malicious samples and filter out irrelevant benign functions.

[0225] 3.4. Using the control flow graph of the third attribute of the malicious function as input data, and the family label of the malicious family to which the malicious sample containing the malicious function belongs as the classification label, construct the GNN model training dataset. The training dataset includes the control flow graph of the third attribute carrying the family label.

[0226] 3.5 Supervised training of the GNN model using the training dataset.

[0227] The trained GNN model is a malicious family classifier, which is a classifier based on binary code semantics and graph structure features.

[0228] After training the three sub-models mentioned above, a trained software classification model is obtained.

[0229] As can be seen, in the above training process, since both the semantic embedding sub-model and the function classifier are based on unsupervised training, both models can be trained on large-scale datasets. Although the malicious family classifier is trained in a supervised manner, the first two trained sub-models have already selected and labeled the training data suitable for use as the malicious family classifier, so there is no need for additional data selection and labeling.

[0230] Furthermore, the application phases of software classification models can include:

[0231] 1. Disassemble the unknown sample to obtain the fourth control flow graph of each function in the sample.

[0232] 2. Use the semantic embedding sub-model to extract semantic features from the fourth basic block in each fourth control flow graph, and generate a fourth attribute control flow graph with semantic features as node attributes.

[0233] 3. Use the trained function classifier to classify malicious functions and filter out irrelevant benign functions. If no malicious functions are identified at this point, the unknown sample is determined to be benign software, and the classification process ends.

[0234] 4. Using the target attribute control flow graph of the malicious function as input data, input it into the trained malicious family classifier for classification, and obtain the malicious family classification result of each malicious function, that is, the probability distribution of each category.

[0235] 5. Aggregate the family classification results of all malicious functions in the unknown sample to obtain the classification result of the sample.

[0236] This completes the classification process for unknown software.

[0237] To illustrate the effectiveness of the technical solution of this application, this application conducted experiments and evaluations on different malware homology analysis datasets according to the technical solution described in the embodiments.

[0238] First, the technical solution of this application was implemented on a malicious sample dataset provided by Topsec. This dataset contains malware from five families: backdoors, ordinary malware, viruses, Trojans, and worms, with 1000, 1000, 900, 800, and 1000 samples respectively, totaling 4700 malicious samples. All models requiring training described in this embodiment were trained and fine-tuned based on this dataset. Finally, as shown in Table 1, the classification software model achieved an overall classification accuracy of 87.05% on this dataset, with high performance across all categories.

[0239] Table 1

[0240] Backdoor 93.12％ 93.78％ 93.65％ 87.23％ Generic 96.77％ 92.26％ 94.30％ 89.98％ Virus 92.76％ 76.87％ 83.19％ 83.59％ Trojan 74.52％ 70.75％ 72.49％ 82.10％ Worm 84.22％ 85.41％ 84.84％ 90.12％ overall - - - 87.05％

[0241] Furthermore, the performance of the software classification model was evaluated using the BIG 2015 dataset, which includes nine malicious families and a total of 10,869 labeled malicious samples. All models described in this embodiment were trained and fine-tuned based on this dataset. Ultimately, as shown in Table 2, the classification software model achieved an overall classification accuracy of 98.21% on this dataset, with high performance across all categories.

[0242] Table 2

[0243] Rammit 99.29％ 97.14％ 99.08％ 97.75％ Lollipop 98.86％ 99.80％ 99.06％ 99.77％ Kelihos_ver3 100％ 98.82％ 99.73％ 99.44％ Vundo 98.74％ 100％ 99.00％ 97.30％ Simda 94.99％ 96.10％ 96.04％ 97.82％ Tracur 98.65％ 98.65％ 98.65％ 94.41％ Kelihos_ver1 100％ 99.82％ 99.90％ 99.95％ Obfuscator.ACY 98.86％ 95.48％ 96.22％ 97.59％ Gatak 94.10％ 87.21 93.74％ 85.14％ overall - - - 98.21％

[0244] As can be seen, the software classification model provided in this application completes the malware classification task with high accuracy on multiple datasets, and the software classification model can also identify functions with malicious behavior in binary files, which has very important practical significance for the analysis and verification of malware.

[0245] To better understand the technical solution of this application, an example will be used to illustrate it in detail below.

[0246] Taking a malicious sample from the Virus family in the malicious sample dataset as an example. The malicious sample's name is 01ca3d1961d2bc31e213a88d43abe0bf. First, a decompiler was used to decompile the malicious sample, identifying 7676 functions and obtaining the control flow graph and assembly instructions for each function. The control flow graph of the function sub_10001eae is shown below. Figure 10 As shown in (a).

[0247] Subsequently, semantic features are extracted from the basic blocks in each control flow graph using a semantic embedding sub-model, generating an attribute control flow graph with semantic features as node attributes. The attribute control flow graph of the function sub_10001ee is shown below. Figure 10 As shown in (b).

[0248] Next, a function classifier was used to detect malicious functions. 5152 benign functions were filtered out from the malicious sample, accounting for about 67.12% of the total number of functions in the malicious sample. The remaining malicious functions were used as analysis data for subsequent malicious sample classification.

[0249] Finally, the attribute control flow graph of the malicious function is used as input data and fed into a malicious family classifier for classification, yielding the malicious family classification result for each malicious function, i.e., the probability distribution of each category. For example... Figure 10 As shown in (c), the classification probability distributions of all malicious functions are aggregated to obtain the final sample classification result. The malicious family category with the highest probability is the malicious family to which the malicious sample belongs.

[0250] As can be seen, the software classification method provided in this application, firstly, enables the software classification model to better capture the semantic information of binary code through semantic learning, thereby improving the classification effect.

[0251] Second, the graph reconstruction-based function classifier can infer the maliciousness of each function in unknown samples, thus filtering out benign functions. The malicious family classifier only needs to focus on malicious functions and will not be interfered with by a large number of benign functions. Furthermore, when reverse engineers need to perform secondary analysis of malware or manually review classification results, they can use this as a basis to focus on malicious functions.

[0252] Third, the semantic embedding sub-model based on the BERT model and the function classifier based on the graph reconstruction model

[120] are both trained in an unsupervised manner and can be trained on large-scale datasets. Addressing the well-known limitation of neural networks heavily relying on large-scale, high-quality data, the training method in this application can effectively utilize large-scale datasets, helping the model to cover real-world data distributions.

[0253] Based on the training methods described in any of the above embodiments, a third aspect of this application also provides a training apparatus for a software classification model, such as... Figure 11 As shown, the training device 1100 includes:

[0254] The first acquisition module 1110 is used to acquire the first control flow graph of the function in the first binary sample, the second control flow graph of the function in the second binary sample, and the third control flow graph of the function in the third binary sample;

[0255] The semantic embedding sub-model training module 1120 is used to train the semantic embedding sub-model using the assembly instructions included in the first control flow graph;

[0256] The first extraction module 1130 is used to extract semantics from the second control flow graph and the third control flow graph using a trained semantic embedding sub-model to obtain a second attribute control flow graph and a third attribute control flow graph carrying semantic information.

[0257] The function classifier training module 1140 is used to train the function classifier using the second attribute control flow graph;

[0258] The malicious family classifier training module 1150 is used to classify the third attribute control flow graph using a trained function classifier to obtain the classification label of the function, and to train the malicious family classifier with the third attribute control flow graph carrying the classification label to obtain a trained software classification model.

[0259] In some embodiments, the function classifier includes a graph reconstruction model; the function classifier training module 1140 is specifically used for:

[0260] Obtain the target second attribute control flow graph from the second attribute control flow graph; wherein, the function corresponding to the target second attribute control flow graph belongs to the target category, and the target category includes benign category or malicious category;

[0261] The function classifier is trained using the control flow graph of the target's second attribute.

[0262] In some embodiments, the third binary sample includes benign functions and malicious functions; the malicious family classifier training module 1150 is specifically used for:

[0263] The third attribute control flow graph is classified using a trained function classifier;

[0264] If the function corresponding to the control flow graph of the third attribute is classified into a malicious category, the classification label is determined to be the family label corresponding to the malicious family to which the third binary sample belongs;

[0265] If the function corresponding to the control flow graph of the third attribute is classified into a benign category, the classification label is determined to be a benign label;

[0266] The malicious family classifier is trained using a control flow graph carrying the family tag and a third attribute; or

[0267] The malicious family classifier is trained using a control flow graph carrying the third attribute of the family label and a control flow graph carrying the third attribute of the benign label.

[0268] In some embodiments, the semantic embedding sub-model includes a bidirectional encoded BERT model; the malicious family classifier includes a graph neural network model.

[0269] The specific implementation process of the functions and roles of each module in the above-mentioned device can be found in the implementation process of the corresponding steps in the above-mentioned training method, and will not be repeated here.

[0270] Based on the classification method described in any of the above embodiments, a fourth aspect of this application also provides a software classification device, such as... Figure 12 As shown, the sorting device 1200 includes:

[0271] The second acquisition module 1210 is used to acquire the fourth control flow graph corresponding to each function in the binary file to be classified.

[0272] The second extraction module 1220 is used to perform semantic extraction on all the fourth control flow graphs using the semantic embedding sub-model, so as to obtain a fourth attribute control flow graph carrying semantic information corresponding to each fourth control flow graph.

[0273] The malicious function classification module 1230 is used to classify target attribute control flow graphs belonging to the malicious function category from all the fourth attribute control flow graphs using the function classifier.

[0274] The malicious family classification module 1240 is used to input the target attribute control flow graph into the malicious family classifier and determine the malicious family to which the binary file to be classified belongs based on the output result of the malicious family classifier.

[0275] In some embodiments, the sorting device 1200 further includes:

[0276] The benign software classification module is used to determine that the binary file to be classified is benign software if none of the fourth attribute control flow graphs belong to the malicious category.

[0277] In some embodiments, the output results include the probability distribution of each malicious family category corresponding to the target attribute control flow graph, and the malicious family classification module 1240 is specifically used for:

[0278] For each malicious family category, obtain the sum of the probabilities of all the target attribute control flow graphs corresponding to the malicious family category;

[0279] The malicious family to which the binary file to be classified belongs is determined based on the sum of the probabilities of each of the malicious family categories.

[0280] The specific implementation process of the functions and roles of each module in the above-mentioned device can be found in the implementation process of the corresponding steps in the above classification method, and will not be repeated here.

[0281] Furthermore, the fifth aspect of this application also provides a software classification model, such as... Figure 1 As shown, the software classification model 100 includes a semantic embedding sub-model 110, a function classifier 120, and a malicious family classifier 130.

[0282] The semantic embedding sub-model 110 is used to extract semantics from the fourth control flow graph corresponding to each function in the binary file to be classified, so as to obtain a fourth attribute control flow graph carrying semantic information corresponding to each fourth control flow graph.

[0283] The function classifier 120 is used to classify target attribute control flow graphs belonging to the malicious function category from all the fourth attribute control flow graphs;

[0284] The malicious family classifier 130 is used to classify the input target attribute control flow graph into a malicious family to obtain the malicious family to which the binary file to be classified belongs.

[0285] In addition, the sixth aspect of this application also provides, as follows Figure 13 The diagram shows the structure of an electronic device. Figure 13 At the hardware level, the electronic device includes a processor, an internal bus, a network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to implement a software classification model training method and / or a software classification method as described in any of the above embodiments.

[0286] A seventh aspect of this application also provides a computer storage medium storing a computer program, which, when executed by a processor, can be used to perform a training method for a software classification model and / or a software classification method as described in any of the above embodiments.

[0287] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flow diagrams and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flow diagram or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flow diagram, and combinations of blocks in block diagrams and / or flow diagrams, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0288] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0289] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0290] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0291] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0292] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A training method for a software classification model, characterized in that, The software classification model includes a semantic embedding sub-model, a function classifier, and a malicious family classifier; the function classifier includes a graph reconstruction model; the method includes: Obtain the first control flow graph of the function in the first binary sample, the second control flow graph of the function in the second binary sample, and the third control flow graph of the function in the third binary sample; The semantic embedding sub-model is trained using the assembly instructions included in the first control flow graph; The semantic features of the second control flow graph and the third control flow graph are extracted using the trained semantic embedding sub-model to obtain the second attribute control flow graph and the third attribute control flow graph carrying semantic features; The function classifier is reconstructed and trained by encoding and decoding using the target second attribute control flow graph in the second attribute control flow graph; wherein, the function corresponding to the target second attribute control flow graph belongs to the target category, and the target category includes benign category or malicious category; The third attribute control flow graph is classified using a trained function classifier to obtain the function's classification label. The third attribute control flow graph carrying the classification label is then used to train the malicious family classifier to obtain a trained software classification model.

2. The method according to claim 1, characterized in that, The third binary sample includes benign functions and malicious functions; the step of classifying the third attribute control flow graph using a trained function classifier to obtain the function classification labels, and then training the malicious family classifier with the third attribute control flow graph carrying the classification labels, includes: The third attribute control flow graph is classified using a trained function classifier; If the function corresponding to the control flow graph of the third attribute is classified into a malicious category, the classification label is determined to be the family label corresponding to the malicious family to which the third binary sample belongs; If the function corresponding to the control flow graph of the third attribute is classified into a benign category, the classification label is determined to be a benign label; The malicious family classifier is trained using a control flow graph carrying the family label as a third attribute; or The malicious family classifier is trained using a control flow graph carrying the third attribute of the family label and a control flow graph carrying the third attribute of the benign label.

3. The method according to any one of claims 1-2, characterized in that, The semantic embedding sub-model includes a bidirectional encoding BERT model; the malicious family classifier includes a graph neural network model.

4. A software classification method, characterized in that, The classification method is implemented based on a software classification model trained according to the method described in claim 1; the software classification model includes a semantic embedding sub-model, a function classifier, and a malicious family classifier; the classification method includes: Obtain the fourth control flow graph corresponding to each function in the binary file to be classified; The semantic embedding sub-model is used to extract the semantic features of all the fourth control flow graphs to obtain the fourth attribute control flow graph carrying the semantic features corresponding to each fourth control flow graph; The function classifier is used to classify the target attribute control flow graph belonging to the malicious category from all the fourth attribute control flow graphs; The target attribute control flow graph is input into the malicious family classifier, and the malicious family to which the binary file to be classified belongs is determined based on the output of the malicious family classifier.

5. The method according to claim 4, characterized in that, The method further includes: If none of the fourth attribute control flow graphs belong to the malicious category, the binary file to be classified is determined to be benign software.

6. The method according to claim 4, characterized in that, The output includes the probability distribution of each malicious family category corresponding to the target attribute control flow graph; determining the malicious family to which the binary file to be classified belongs based on the output of the malicious family classifier includes: For each malicious family category, obtain the sum of the probabilities of all the target attribute control flow graphs corresponding to the malicious family category; The malicious family to which the binary file to be classified belongs is determined based on the sum of the probabilities of each of the malicious family categories.

7. A training device for a software classification model, characterized in that, The software classification model includes a semantic embedding sub-model, a function classifier, and a malicious family classifier; the function classifier includes a graph reconstruction model; the device includes: The first acquisition module is used to acquire the first control flow graph of the function in the first binary sample, the second control flow graph of the function in the second binary sample, and the third control flow graph of the function in the third binary sample; A semantic embedding sub-model training module is used to train the semantic embedding sub-model using the assembly instructions included in the first control flow graph; The first extraction module is used to extract semantics from the second control flow graph and the third control flow graph using a trained semantic embedding sub-model, so as to obtain a second attribute control flow graph and a third attribute control flow graph carrying semantic information. The function classifier training module is used to perform encoding-decoding reconstruction training on the function classifier using the target second attribute control flow graph in the second attribute control flow graph; wherein, the function corresponding to the target second attribute control flow graph belongs to the target category, and the target category includes benign category or malicious category; The malicious family classifier training module is used to classify the third attribute control flow graph using a trained function classifier to obtain the classification label of the function, and to train the malicious family classifier with the third attribute control flow graph carrying the classification label to obtain a trained software classification model.

8. A software classification device, characterized in that, The classification device is implemented based on a software classification model trained by the method described in claim 1; the software classification model includes a semantic embedding sub-model, a function classifier, and a malicious family classifier; the classification device includes: The second acquisition module is used to acquire the fourth control flow graph corresponding to each function in the binary file to be classified. The second extraction module is used to perform semantic extraction on all the fourth control flow graphs using the semantic embedding sub-model, so as to obtain the fourth attribute control flow graph carrying semantic information corresponding to each fourth control flow graph. The malicious function classification module is used to classify target attribute control flow graphs belonging to the malicious function category from all the fourth attribute control flow graphs using the function classifier. The malicious family classification module is used to input the target attribute control flow graph into the malicious family classifier and determine the malicious family to which the binary file to be classified belongs based on the output of the malicious family classifier.

9. A software classification model, characterized in that, The model is trained based on the method described in claim 1; the model includes a semantic embedding sub-model, a function classifier, and a malicious family classifier; the function classifier includes a graph reconstruction model; wherein... The semantic embedding sub-model is used to extract semantics from the fourth control flow graph corresponding to each function in the binary file to be classified, so as to obtain a fourth attribute control flow graph carrying semantic information for each fourth control flow graph. The function classifier is used to classify target attribute control flow graphs belonging to the malicious function category from all the fourth attribute control flow graphs. The malicious family classifier is used to classify the input target attribute control flow graph into families to obtain the malicious family to which the binary file to be classified belongs.

10. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store processor-executable instructions; When the processor invokes the executable instructions, it implements the training method according to any one of claims 1-3, or the classification method according to any one of claims 4-6.

11. A computer-readable storage medium, characterized in that, It stores computer instructions, which, when executed by a processor, implement the steps of the training method according to any one of claims 1-3, or the classification method according to any one of claims 4-6.

Images