A malicious code variant detection method and device based on sequence control flow structure

Abstract

This invention provides a method and apparatus for detecting malware variants based on a sequence control flow structure, comprising: extracting a control flow structure and a basic block sequence from the malware; normalizing the basic block sequence to obtain an opcode sequence; inputting the opcode sequence into a preset Transformer model to extract semantic features of the opcode sequence and generate sequence encoding; fusing the sequence encoding with the control flow structure to construct a feature-rich graph structure; and inputting the graph structure into a preset GraphSAGE model to obtain the malware category. The malware variant detection method provided by this invention emphasizes the semantic information inherent in the opcode sequence itself, encodes the opcode sequence, extracts semantic features, and obtains more efficient and accurate node features, thereby improving detection accuracy.

Description

Technical Field

[0001] This invention relates to the field of malicious code detection technology, and in particular to a method and apparatus for detecting malicious code variants based on a sequence control flow structure. Background Technology

[0002] Malicious code variants refer to modifications, adaptive adjustments, or the addition of new features to existing malicious code to circumvent traditional detection methods and bypass security system defenses. The emergence of malicious code variants makes traditional malware detection methods more difficult because variants may modify code structure, introduce obfuscation techniques, and alter behavior patterns. To address the challenges posed by malicious code variants, the following commonly used existing solutions are proposed.

[0003] Option 1 involves feature extraction and similarity analysis. Early detection of malware variants and families primarily relied on extracting static and dynamic features of samples, such as file hashes, file sizes, API call sequences, and network communications, and then using similarity analysis methods to identify similar samples. However, this method is suitable for relatively simple malware families and is ineffective against highly variable malware families.

[0004] Option two is rule-based detection. For certain known malware variants and their families, security experts can define rules to identify their specific characteristics. These rules can be based on the malware family's behavioral patterns, file structure, etc. However, this method can only address known threats and cannot handle unknown threats.

[0005] Option three is a deep learning approach. Deep learning methods refer to learning features from large amounts of data using convolutional neural networks (CNNs), recurrent neural networks (RNNs), transformer models, etc., to better capture the similarities between malware families for variant detection.

[0006] Option four is the graph neural network method. Malware family detection can be viewed as a graph analysis problem of the relationships between malware. Malware can be modeled as a graph, where nodes represent samples and edges represent similarities or associations between samples. Graph analysis methods can help discover potential family structures and groups. Existing graph neural network-based malware detection techniques typically use statistical features as node features, that is, statistical results of various characters (opcodes, operands, address information, etc.) in the basic blocks of malicious samples are used as node features. However, this feature selection method ignores the rich semantic information inherent in the opcode sequence itself. Summary of the Invention

[0007] In view of this, embodiments of the present invention provide a method and apparatus for detecting malicious code variants based on sequence control flow structure, so as to eliminate or improve one or more defects existing in the prior art, and solve the problem that existing malicious code variant detection schemes based on graph neural networks only use statistical features as node features, ignore the semantic information characteristics of the opcode sequence itself, and have low detection accuracy.

[0008] On the one hand, this invention provides a method for detecting malicious code variants based on a sequence control flow structure, comprising the following steps:

[0009] Extract the control flow structure and basic block sequence from the malicious code; the control flow structure is a directed graph, with basic blocks as nodes, and edges connecting the nodes corresponding to basic blocks that have a call relationship;

[0010] The basic block sequence is normalized to obtain an opcode sequence. The opcode sequence is then input into a preset Transformer model to extract the semantic features of the opcode sequence and generate sequence encoding.

[0011] The sequence encoding is fused with the control flow structure to construct a feature-rich graph structure; the graph structure is then input into a preset GraphSAGE model to obtain the category of the malicious code.

[0012] In some embodiments of the present invention, extracting the control flow structure and basic block sequence from malicious code further includes:

[0013] A preset extraction tool is used to extract assembly files from code files containing the malicious code, and a preset script is used to extract the control flow structure and the basic block sequence from the assembly files.

[0014] In some embodiments of the present invention, obtaining the opcode sequence based on the normalization of the basic block sequence further includes:

[0015] Extract the opcodes of instructions from each basic block and arrange them into a single line of opcode sequence; wherein the opcodes include at least jump instructions, call instructions, arithmetic instructions, comparison instructions, transfer instructions, and definition instructions.

[0016] In some embodiments of the present invention, after inputting the opcode sequence into a preset Transformer model, the method further includes:

[0017] The Transformer model encodes each opcode into a vector of a preset length, and concatenates the vectors obtained from the encoding of all opcodes in the opcode sequence to obtain the sequence encoding.

[0018] In some embodiments of the present invention, after obtaining the sequence code, the sequence code is normalized using principal component analysis dimensionality reduction.

[0019] In some embodiments of the present invention, after obtaining the sequence encoding, the method further includes:

[0020] The sequence encoding is pooled and dimensionality reduced using the average pooling method. The average value of each column of the sequence encoding is calculated as the representative value of that column to obtain the average sequence encoding of the preset length.

[0021] In some embodiments of the present invention, fusing the sequence encoding with the control flow structure to construct a feature-rich graph structure further includes:

[0022] The control flow structure includes nodes and edges. The sequence encoding obtained based on each basic block is merged with the node corresponding to each basic block to obtain the graph structure, which includes nodes, edges, and node features.

[0023] In some embodiments of the present invention, inputting the graph structure into a preset GraphSAGE model to obtain the category of the malicious code further includes:

[0024] The GraphSAGE sample and aggregate the neighbors of each node in the graph structure to learn node representations. Based on the node representations, it calculates the probability distribution of the corresponding nodes to obtain the category of the malicious code.

[0025] On the other hand, the present invention provides a malicious code variant detection device based on a sequence control flow structure, comprising a processor and a memory, characterized in that the memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the malicious code variant detection method based on a sequence control flow structure as described above.

[0026] On the other hand, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the malicious code variant detection method based on any of the above-mentioned methods for detecting malicious code variants based on a sequence control flow structure.

[0027] The beneficial effects of the present invention are at least as follows:

[0028] This invention provides a method and apparatus for detecting malware variants based on sequence control flow structures, comprising: extracting control flow structures and basic block sequences from malware; normalizing the basic block sequences to obtain opcode sequences; inputting the opcode sequences into a preset Transformer model to extract semantic features of the opcode sequences and generate sequence encoding; fusing the sequence encoding with the control flow structure to construct a feature-rich graph structure; and inputting the graph structure into a preset GraphSAGE model to obtain the malware category. The malware variant detection method provided by this invention is based on graph neural networks for malware variant detection. It models the control flow structure in the malware as the graph structure of a graph neural network and emphasizes the semantic information inherent in the opcode sequences themselves. By encoding the opcode sequences and extracting semantic features, more efficient and accurate node features are obtained, improving detection accuracy.

[0029] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the description, or may be learned by practice of the invention. The objects and other advantages of the invention can be realized and obtained by means of the structures specifically pointed out in the description and drawings.

[0030] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0031] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, are not intended to limit the scope of the invention. In the drawings:

[0032] Figure 1 This is a schematic diagram illustrating the steps of a malicious code variant detection method based on a sequence control flow structure in one embodiment of the present invention.

[0033] Figure 2 This is a schematic diagram of the overall framework of a malicious code variant detection method based on a sequence control flow structure in one embodiment of the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0035] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0036] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0037] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0038] In the following description, embodiments of the invention will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0039] It should be emphasized here that the step markers mentioned below are not a limitation on the order of the steps, but should be understood as meaning that the steps can be executed in the order mentioned in the embodiments, or in a different order than in the embodiments, or several steps can be executed simultaneously.

[0040] As mentioned in Background Technology Solution 4, malicious code variant detection can be achieved based on graph neural networks. In this invention, considering that the Control Flow Graph (CFG) structure in malicious code can be used as the graph structure of a graph neural network to model malicious code samples, this invention also uses graph neural network methods for malicious code variant detection. Existing malicious code detection techniques based on graph neural networks typically use statistical features as node features, that is, statistical results of various characters (opcodes, operands, address information, etc.) in the basic blocks of malicious samples are used as node features. This feature selection method ignores the rich semantic information inherent in the opcode sequence itself. However, with the rise of language models, it has become possible to extract semantic information from numerous opcode sequences. Therefore, this invention proposes a malicious code variant detection method based on sequence control flow structure. This method extracts the control flow structure and opcode sequences of basic blocks from malicious code samples, encodes the opcode sequences using a model, extracts semantic features, and combines the control flow graph structure with the extracted semantic features as the graph structure input to the graph neural network model for classification and detection. Specifically, as shown... Figure 1 As shown, the method includes the following steps S101 to S103:

[0041] Step S101: Extract the control flow structure and basic block sequence from the malicious code. The control flow structure is a directed graph, with basic blocks as nodes, and edges connecting nodes corresponding to basic blocks that have call relationships.

[0042] Step S102: Normalize the basic block sequence to obtain the opcode sequence, input the opcode sequence into the preset Transformer model, extract the semantic features of the opcode sequence, and generate sequence encoding.

[0043] Step S103: Fuse sequence encoding with control flow structure to construct a graph structure with features; input the graph structure into the preset GraphSAGE model to obtain the category of malicious code.

[0044] like Figure 2 The diagram shown is an overall framework diagram of a malicious code variant detection method based on a sequence control flow structure.

[0045] In step S101, the control flow structure and basic block sequence are first extracted as meta-features from the malicious code. The control flow structure refers to the structure in the code that controls the program's execution flow, such as conditional statements, loop statements, and function calls. A basic block is a continuous sequence of instructions without branching statements, containing only one entry point and one exit point. By combining the analysis of the syntax and call structure of the malicious code using the control flow structure with the acquisition of semantic information from the basic block sequence, malicious code and its variants are identified and detected.

[0046] In some embodiments, the control flow structure and basic block sequence in malicious code can be extracted by the following method: using a preset extraction tool, such as IDAPro, Ollydbg, Ghidra, etc., to extract the assembly file (usually a .asm file) from the code file (usually a .exe file) containing malicious code, and using a preset script to extract the control flow structure and basic block sequence from the .asm assembly file.

[0047] In some embodiments, when extracting control flow structures and basic block sequences, methods such as symbolic execution, static analysis, and dynamic debugging are also combined to improve the accuracy and reliability of the extraction.

[0048] The extracted control flow structure is defined as a directed graph, with basic blocks as nodes, and edges connecting nodes corresponding to basic blocks that have call relationships. For example, the control flow structure is denoted as G = (V, E), where V = {v1, v2, v3, ..., v...}. i} represents the set of nodes in the control flow structure, v i This represents the basic block at address i in the control flow structure; E = {e 12 ,e 13,e 14 ,...,e ij} represents the set of directed edges in the control flow structure, representing the call relationships of basic blocks in the malicious code. If basic block v i The basic block v was called directly. j Then e ij =1, otherwise e ij =0.

[0049] In step S102, the basic block sequence obtained in step S101 is filtered according to preset requirements and normalized into an opcode sequence. Specifically, the opcode of the instruction is extracted from each basic block, and the extracted opcodes are classified according to a pre-defined opcode classification rule. The classified opcodes are then arranged in a single line to represent the final opcode sequence. For example, the opcode sequence format is [opcode1, opcode2, opcode3,...]. The opcode classification rule refers to classifying opcodes according to their common function types, since there are hundreds of different opcodes in actual use. In this invention, opcodes are divided into the following seven types: jump instruction (trans), call instruction (call), arithmetic instruction (math), comparison instruction (cmp), transfer instruction (mov), definition instruction (def), and other instructions (other). For example, based on the opcode classification rule, the opcode sequence Seq = [mov,and,or,jmp,align,add] extracted from the basic block sequence can be converted into a unified Seq = [mov,cmp,cmp,trans,def,math].

[0050] The classified opcode sequence is input into the pre-trained Transformer model for encoding, and the semantic features of the opcode sequence are extracted to generate sequence encoding containing the semantic features.

[0051] In some embodiments, the Transformer model encodes each opcode as a vector of a preset length, and concatenates the vectors obtained from the encoding of all opcodes in the opcode sequence to obtain the sequence encoding. For example, the preset length is L, and the classified opcode sequence is Seq = [oper1, oper2, oper3, ..., oper...]. n This sequence of opcodes consists of n opcodes. The opcode sequence is input into the Transformer model, and each opcode is encoded as a vector of length L. That is, the opcode oper1 is encoded as [a...]. 11 ,a 12 ,a 13 ,...,a 1L The opcode oper2 is encoded as [a 21 ,a 22 ,a23 ,...,a 2L ], ..., opcode oper n Encoded as [a n1 ,a n2 ,a n3 ,...,a nL The sequence code is obtained by concatenating the vectors encoded by all opcodes in the opcode sequence, as shown in formula (1):

[0052]

[0053] In some embodiments, the sequence encoding is typically normalized after encoding. For example, Principal Component Analysis (PCA) dimensionality reduction methods, whitening methods, etc., are used to normalize the sequence encoding.

[0054] In some embodiments, considering that different basic blocks contain different numbers of instructions, i.e., different numbers of opcodes, in order to ensure that the input format of subsequent inputs to the GraphSAGE model is consistent, the sequence codes obtained by encoding are required to have the same dimension. For example, the mean pooling method is used to pool and reduce the dimension of the sequence code, and the average value of each column of the sequence code is calculated as the representative value of that column to obtain the mean sequence code of a preset length. Based on formula (1), the sequence code after mean pooling, Emb = [mean... 11 ,mean 12 ,...,mean 1L ,].

[0055] In step S103, the sequence encoding with semantic features is fused with the control flow structure to construct a feature-rich graph structure. The control flow structure includes nodes and edges. The sequence encoding obtained based on each basic block is merged with the nodes corresponding to each basic block to obtain the graph structure, which includes nodes, edges, and node features. In the example above, the control flow structure is denoted as G = (V, E), and the fused graph structure can be denoted as G = (V, E, X), where X = {x1, x2, x3, ..., x...}. i} represents the set of node features, x i This represents the node sequence characteristics of the basic block at address i.

[0056] The graph structure is input into the pre-trained GraphSAGE model. GraphSAGE samples and aggregates the neighbors of each node in the graph structure to learn the node representation. Based on the node representation, the probability distribution of the corresponding node is calculated to obtain the category of the malicious code variant.

[0057] In some embodiments, the pre-training method for the GraphSAGE model includes the following:

[0058] Construct a training sample set, which includes multiple samples. Each sample contains graph data of malicious code. Basic blocks are used as nodes, and edges are connected between nodes corresponding to basic blocks that have call relationships. Each node is given semantic features based on the opcode sequence. Add a real category label to each sample.

[0059] Obtain the initial GraphSAGE model. Input each sample into the initial GraphSAGE model in batches, sample and aggregate the neighbors of each node in each sample to learn the node representation, and calculate the probability distribution of the corresponding node based on the node representation to obtain the category of the malware variant of the sample.

[0060] The initial GraphSAGE model is trained using a training sample set, a loss between the true class label and the prediction result is constructed, and the initial GraphSAGE model is optimized using the loss, finally obtaining the GraphSAGE model usable in this invention.

[0061] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of a malicious code variant detection method based on a sequence control flow structure.

[0062] Corresponding to the above method, the present invention also provides a malicious code variant detection device based on a sequence control flow structure. The device includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the method described above.

[0063] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned edge computing server deployment method. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0064] In summary, this invention provides a method and apparatus for detecting malicious code variants based on sequence control flow structures, comprising: extracting control flow structures and basic block sequences from malicious code; normalizing the basic block sequences to obtain opcode sequences; inputting the opcode sequences into a preset Transformer model to extract semantic features of the opcode sequences and generate sequence encoding; fusing the sequence encoding with the control flow structure to construct a feature-rich graph structure; and inputting the graph structure into a preset GraphSAGE model to obtain the category of malicious code. The malicious code variant detection method provided by this invention is based on graph neural network methods for malicious code variant detection. It models the control flow structure in the malicious code as a graph structure of a graph neural network and emphasizes the semantic information inherent in the opcode sequences themselves. By encoding the opcode sequences and extracting semantic features, more efficient and accurate node features are obtained, improving detection accuracy.

[0065] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0066] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0067] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0068] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method of detecting a malicious code variant based on a sequence control flow structure, characterized by, Includes the following steps: Extracting control flow structure and basic block sequences from malicious code; The control flow structure is a directed graph, with basic blocks as nodes, and edges connecting the nodes corresponding to basic blocks that have a calling relationship. The basic block sequence is normalized, and the opcode of the instruction is extracted from each basic block, arranged into a single opcode sequence, and input into a preset Transformer model. The Transformer model encodes each opcode into a vector of a preset length, and concatenates the vectors obtained from all the opcode encodings in the opcode sequence to obtain the sequence encoding. The opcode includes at least jump instructions, call instructions, arithmetic instructions, comparison instructions, transfer instructions, and definition instructions. The sequence encoding obtained based on each basic block is merged with the node corresponding to each basic block to obtain a graph structure, which is then input into a preset GraphSAGE model. The graph structure includes nodes, edges, and node features. The GraphSAGE model samples and aggregates the neighbors of each node in the graph structure to learn node representations. Based on the node representations, the probability distribution of the corresponding nodes is calculated to obtain the category of the malicious code.

2. The sequence-based control flow structure-based malicious code variant detection method according to claim 1, characterized by, Extracting control flow structures and basic block sequences from malicious code also includes: A preset extraction tool is used to extract assembly files from code files containing the malicious code, and a preset script is used to extract the control flow structure and the basic block sequence from the assembly files.

3. The sequence-based control flow structure-based malicious code variant detection method according to claim 1, characterized by, After obtaining the sequence code, the sequence code is normalized using principal component analysis dimensionality reduction.

4. The sequence-based control flow structure-based malicious code variant detection method according to claim 1, characterized by, After obtaining the sequence encoding, the method further includes: The sequence encoding is pooled and dimensionality reduced using the average pooling method. The average value of each column of the sequence encoding is calculated as the representative value of that column to obtain the average sequence encoding of the preset length.

5. A malicious code variant detection apparatus based on sequence control flow structure, comprising a processor and a memory, characterized in that, The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the malicious code variant detection method based on the sequence control flow structure as described in any one of claims 1 to 4.

6. A computer-readable storage medium having stored thereon a computer program, characterized in that, When the program is executed by the processor, it implements the steps of the malicious code variant detection method based on the sequence control flow structure as described in any one of claims 1 to 4.

Images