A method, medium, and system for detecting software malware based on assembly instructions.

Abstract

This invention provides a method, medium, and system for detecting malicious software code based on assembly instructions, belonging to the field of malicious code detection technology. The method includes: obtaining the reverse-engineered assembly instruction set of the software to be detected; dividing the assembly instruction set into multiple logical blocks according to the execution order; performing exclusive filtering on the first logical block set based on instruction content to obtain a second logical block set; sequentially numbering each logical block in the first and second logical block sets; assigning the second parameter of each logical block in the second logical block to the logical block of the first logical block set with the same assembly instruction; establishing two-dimensional coordinates and an assembly curve for each logical block in the first logical block set; searching for non-smooth segments in the assembly curve; using a pre-trained malicious code detection model to calculate the code corresponding to each non-smooth segment, determining whether the corresponding code is malicious code, and outputting the malicious code from the model calculation results to the detection personnel.

Description

Technical Field

[0001] This invention belongs to the field of malicious code detection technology, and specifically relates to a method, medium, and system for detecting software malicious code based on assembly instructions. Background Technology

[0002] In computer science, malicious code is a computer program that contains harmful functionality or is used to perform malicious acts. Types of malicious code include viruses, worms, Trojan horses, spyware, ransomware, and more. This malicious code can steal users' personal information, damage system data, and even crash computer systems. Therefore, the detection and protection against malicious code is a crucial task in computer security.

[0003] Currently, malware detection primarily relies on two methods: feature matching and behavioral analysis. Feature matching compares the characteristics of the code against those of known malware; if a match is found, the code is identified as malicious. This method is fast, but it cannot detect novel or unknown malware. Behavioral analysis, on the other hand, determines malware by analyzing its execution behavior. This method is slow and resource-intensive. Summary of the Invention

[0004] In view of this, the present invention provides a software malicious code detection method, medium and system based on assembly instructions, which can solve the technical problems of slow detection speed and high resource consumption of existing technologies for malicious code.

[0005] This invention is implemented as follows:

[0006] The first aspect of the present invention provides a method for detecting malicious software code based on assembly instructions, comprising the following steps:

[0007] S10. Obtain the assembly instruction set of the reverse engineering of the software to be tested; divide the assembly instruction set into multiple logical blocks according to the execution order, each logical block containing one assembly instruction; combine the multiple logical blocks obtained into a first logical block set;

[0008] S20. Use long integers to sequentially number each logic block in the first logic block set as the first parameter of the logic block;

[0009] S30. The first set of logic blocks is selectively filtered according to the instruction content to obtain the second set of logic blocks;

[0010] S40. Use long integers to sequentially number each logic block in the second logic block set as the second parameter of the logic block;

[0011] S50. Assign the second parameter of each logic block in the second logic block to the logic block with the same assembly instruction in the first logic block set as the second parameter.

[0012] S60. Establish two-dimensional coordinates for each logic block in the first logic block set;

[0013] S70. Establish assembly curves based on the two-dimensional coordinates of each logic block in the first logic block set;

[0014] S80. Find non-smooth segments in the assembly curve;

[0015] S90. Utilize a pre-trained malicious code detection model to calculate the code corresponding to each non-smooth segment, determine whether the corresponding code is malicious code, and output the malicious code in the model calculation results to the detection personnel.

[0016] Based on the above technical solution, the software malicious code detection method based on assembly instructions of the present invention can be further improved as follows:

[0017] Specifically, the step of sequentially numbering each logic block in the first logic block set using long integers as the first parameter of the logic block is as follows: first, traverse each logic block in the first logic block set; then, number each logic block with long integers according to its order in the logic block set, and use the number as the first parameter of the logic block.

[0018] The step of performing exclusive filtering on the first set of logic blocks according to the instruction content to obtain the second set of logic blocks specifically involves: traversing the first set of logic blocks, and for the current logic block being traversed, if there is no logic block in the second set that is the same as the current logic block, then the current logic block is added to the second set of logic blocks.

[0019] Specifically, the step of assigning the second parameter of each logic block in the second logic block to a logic block with the same assembly instruction as the first logic block set as the second parameter is as follows: First, traverse each logic block in the second logic block set; then, find the logic block in the first logic block set that has the same assembly instruction as the current logic block; and assign the second parameter of the current logic block to the found logic block as its second parameter.

[0020] In the step of establishing two-dimensional coordinates for each logic block in the first logic block set, the horizontal axis represents the first parameter of the logic block, and the vertical axis represents the second parameter of the logic block.

[0021] Specifically, the step of finding non-smooth segments in the assembly curve is as follows:

[0022] Iterate through each point in the assembly curve, check the slope between adjacent points. If the slope is within the smoothness threshold range, it is considered a smooth point; if the slope exceeds the threshold, it is considered a non-smooth point.

[0023] The assembly curve is divided into segments every M points starting from the first point. For each segment, the segment with a non-smooth point ratio greater than ε is a non-smooth segment.

[0024] The steps for establishing and training the malicious code detection model specifically include:

[0025] Building a training dataset: Collecting a large amount of malicious code as a training dataset;

[0026] Establishing a prototype model: A convolutional neural network is used to establish a prototype model;

[0027] Training the model: The prototype model is trained using the training dataset to obtain the malicious code detection model.

[0028] Furthermore, M = 100; ε = 0.12.

[0029] A second aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores program instructions, which, when executed, are used to perform the above-described method for detecting software malicious code based on assembly instructions.

[0030] A third aspect of the present invention provides a software malicious code detection system based on assembly instructions, wherein the system includes the aforementioned computer-readable storage medium.

[0031] Compared with existing technologies, the beneficial effects of the software malware detection method, medium, and system based on assembly instructions provided by this invention are as follows: First, by logically dividing and numbering assembly instructions, complex code structures can be simplified into one-dimensional sequences, greatly reducing computational complexity. Second, by filtering assembly instructions, duplicate assembly instructions can be removed, further reducing computational load. Third, by searching for non-smooth segments in the assembly curve, code portions that may contain malware can be filtered out. The filtered code portions are then detected using a malware detection model, greatly improving detection efficiency with low resource consumption. This solves the technical problems of slow malware detection speed and high resource consumption in existing technologies. Attached Figure Description

[0032] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 A flowchart of the method provided by the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0035] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0036] like Figure 1 The illustration shows an embodiment of a software malware detection method based on assembly instructions provided by the first aspect of the present invention. This embodiment includes the following steps:

[0037] S10. Obtain the assembly instruction set of the reverse engineering of the software to be tested; divide the assembly instruction set into multiple logical blocks according to the execution order, each logical block containing one assembly instruction; combine the obtained multiple logical blocks into a first logical block set;

[0038] S20. Use long integers to sequentially number each logic block in the first logic block set as the first parameter of the logic block;

[0039] S30. Perform exclusive filtering on the first logic block set according to the instruction content to obtain the second logic block set;

[0040] S40. Use long integers to sequentially number each logic block in the second logic block set as the second parameter of the logic block;

[0041] S50. Assign the second parameter of each logic block in the second logic block to the logic block with the same assembly instruction in the first logic block set as the second parameter.

[0042] S60. Establish two-dimensional coordinates for each logic block in the first logic block set;

[0043] S70. Establish assembly curves based on the two-dimensional coordinates of each logic block in the first logic block set;

[0044] S80. Find non-smooth segments in the assembly curves;

[0045] S90. Utilize a pre-trained malicious code detection model to calculate the code corresponding to each non-smooth segment, determine whether the corresponding code is malicious code, and output the malicious code in the model calculation results to the detection personnel.

[0046] The specific steps for finding non-smooth segments in the assembly curve are as follows:

[0047] Iterate through each point in the assembly curve, check the slope between adjacent points. If the slope is within the smoothness threshold, it is considered a smooth point; if the slope exceeds the threshold, it is considered a non-smooth point.

[0048] The assembly curve is divided into segments every M points starting from the first point. For each segment, the segment with a non-smooth point ratio greater than ε is a non-smooth segment. Generally, M = 50 to 200; ε = 0.1 to 0.2; preferably, M = 100; ε = 0.12.

[0049] The specific implementation methods of steps S10 to S90 described above are described below:

[0050] Detailed implementation of step S10:

[0051] First, the assembly instruction set of the software under test is obtained through reverse engineering. Let the assembly instruction set of the software under test be I = {i1, i2, ..., i...} n}, where i j This represents the j-th assembly instruction, and n represents the total number of assembly instructions.

[0052] Then, these assembly instructions are sequentially divided according to logical order to obtain multiple logic blocks. Let the set of logic blocks be B = {b1, b2, ..., b...} n}, where b j This represents the j-th logic block, where each logic block contains one assembly instruction, namely b. j =i j .

[0053] Finally, these logic blocks are combined into the first logic block set, denoted as B1 = B.

[0054] Detailed implementation of step S20:

[0055] Each logic block in the first logic block set is sequentially numbered using a long integer, and this number serves as the first parameter of the logic block. Let the first parameter set be P1 = {p1, p2, ..., p...}n}, where p j p represents the first parameter of the j-th logic block. j =j.

[0056] Specific implementation of step S30:

[0057] Based on the instruction content, the first set of logic blocks is filtered to obtain the second set of logic blocks. Let the second set of logic blocks be... in Let m represent the j-th logic block in the second logic block set, and m represent the number of logic blocks in the second logic block set, satisfying m≤n.

[0058] Detailed implementation of step S40:

[0059] Each logic block in the second logic block set is sequentially numbered using a long integer, and this number serves as the second parameter of the logic block. Let the second parameter set be... in This represents the second parameter of the j-th logic block, i.e.

[0060] Specific implementation of step S50:

[0061] The second parameter of each logic block in the second logic block is assigned to the logic block with the same assembly instruction in the first logic block set as its second parameter. That is, for each... Find the corresponding logic block b in B1. i and will Assign a value to p i .

[0062] Detailed implementation of step S60:

[0063] For each logic block in the first logic block set, establish a two-dimensional coordinate system, where the horizontal axis represents the first parameter of the logic block, and the vertical axis represents the second parameter of the logic block. Let the two-dimensional coordinate set be C = {c1, c2, ..., c...}. n},in Represents the two-dimensional coordinates of the j-th logic block.

[0064] Specific implementation of step S70:

[0065] Based on the two-dimensional coordinates of each logic block in the first logic block set, an assembly curve is constructed. Let the assembly curve be... in This represents the j-th point on the assembly curve.

[0066] Specific implementation of step S80:

[0067] Find non-smooth segments in the assembly curve. Let the set of non-smooth segments be S = {s1, s2, ..., s...}. k}, where s j Let j represent the j-th non-smooth segment, and k represent the number of non-smooth segments.

[0068] Specific implementation of step S90:

[0069] Using a pre-trained malware detection model M, each non-smooth code segment is calculated to determine whether the corresponding assembly instructions are malicious code, and the malicious code from the model's calculation results is output to the detection personnel. Let the malicious code set be D = {d1, d2, ..., d...} l}, where d j Let represent the j-th malicious code, and l represent the number of malicious codes. For each s j Calculate M(s) j If M(s) j If ) is true, then s j The corresponding assembly instructions are added to D. The malicious code detection model uses a convolutional neural network.

[0070] In addition, there are many established malware detection models available in the current technology, all of which can be used in this step.

[0071] Specifically, the principle of this invention is as follows: The solution of this invention is based on the characteristics of assembly instructions for malicious code detection. Assembly instructions are the basic units of computer programs; by analyzing assembly instructions, the program's execution logic and behavioral characteristics can be obtained. Malicious code often contains a large number of non-smooth assembly instructions such as jumps and calls, and these instructions are often hallmarks of malicious code. Therefore, by searching for non-smooth segments in the assembly curve, potentially malicious code segments can be filtered out. The filtered code segments are then used to detect malicious code using a malicious code detection model, greatly improving detection efficiency with low resource consumption.

[0072] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting malicious software code based on assembly instructions, characterized in that, Includes the following steps: S10. Obtain the assembly instruction set of the reverse engineering of the software to be tested; divide the assembly instruction set into multiple logical blocks according to the execution order, each logical block containing one assembly instruction; combine the multiple logical blocks obtained into a first logical block set; S20. Use long integers to sequentially number each logic block in the first logic block set as the first parameter of the logic block; S30. The first set of logic blocks is selectively filtered according to the instruction content to obtain the second set of logic blocks; S40. Use long integers to sequentially number each logic block in the second logic block set as the second parameter of the logic block; S50. Assign the second parameter of each logic block in the second logic block to the logic block with the same assembly instruction in the first logic block set as the second parameter. S60. Establish two-dimensional coordinates for each logic block in the first logic block set; S70. Establish assembly curves based on the two-dimensional coordinates of each logic block in the first logic block set; specifically: Iterate through each point in the assembly curve, check the slope between adjacent points. If the slope is within the smoothness threshold range, it is considered a smooth point; if the slope exceeds the threshold, it is considered a non-smooth point. The assembly curve is divided into segments every M points starting from the first point. For each segment, the segment with a non-smooth point ratio greater than ε is a non-smooth segment. S80. Find non-smooth segments in the assembly curve; S90. Utilize a pre-trained malicious code detection model to calculate the code corresponding to each non-smooth segment, determine whether the corresponding code is malicious code, and output the malicious code in the model calculation results to the detection personnel.

2. The software malware detection method based on assembly instructions according to claim 1, characterized in that, The step of sequentially numbering each logic block in the first logic block set using long integers as the first parameter of the logic block is as follows: First, traverse each logic block in the first logic block set. Then, number each logic block with a long integer according to its order in the logic block set, and use the number as the first parameter of the logic block.

3. The software malware detection method based on assembly instructions according to claim 1, characterized in that, The step of performing exclusive filtering on the first set of logic blocks according to the instruction content to obtain the second set of logic blocks specifically involves: traversing the first set of logic blocks, and for the current logic block being traversed, if there is no logic block in the second set that is the same as the current logic block, then the current logic block is added to the second set of logic blocks.

4. The software malware detection method based on assembly instructions according to claim 1, characterized in that, The step of assigning the second parameter of each logic block in the second logic block to the logic block with the same assembly instruction in the first logic block set as the second parameter is as follows: First, traverse each logic block in the second logic block set. Then, find the logic block in the first logic block set with the same assembly instruction as the current logic block, and assign the second parameter of the current logic block to the found logic block as its second parameter.

5. The software malware detection method based on assembly instructions according to claim 1, characterized in that, In the step of establishing two-dimensional coordinates for each logic block in the first logic block set, the horizontal axis represents the first parameter of the logic block, and the vertical axis represents the second parameter of the logic block.

6. The software malicious code detection method based on assembly instructions according to claim 1, characterized in that, The steps for establishing and training the malicious code detection model specifically include: Building a training dataset: Collecting a large amount of malicious code as a training dataset; Establishing a prototype model: A convolutional neural network is used to establish a prototype model; Training the model: The prototype model is trained using the training dataset to obtain the malicious code detection model.

7. The software malicious code detection method based on assembly instructions according to claim 1, characterized in that, M=100; ε=0.

12.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores program instructions, which, when executed, are used to perform the software malicious code detection method based on assembly instructions as described in any one of claims 1-7.

9. A software malware detection system based on assembly instructions, characterized in that, It includes the computer-readable storage medium of claim 8.

Images