Methods, equipment, and storage media for detecting malware

Abstract

This application discloses a malware detection method, device, and computer-readable storage medium. The method uses a detection model based on a detection dataset of the target software to detect malware. The detection model can preprocess the interface instruction function sequences corresponding to multiple target software programs to obtain initial sequence features corresponding to the target software. This not only reduces the amount of data processing and improves detection efficiency, but also extracts features of the target software more deeply from different dimensions through different encoders and feature processors. Compared with traditional manual feature extraction and machine learning methods, this reduces human bias and improves the accuracy of identification.

Description

Technical Field

[0001] This disclosure generally relates to the field of machine control, and more specifically to a method, apparatus, and computer-readable storage medium for detecting malicious software. Background Technology

[0002] Malware refers to any program designed to harm a computer system or its users, such as ransomware, Trojan horses, and spyware. This type of malware can cause system crashes, data loss, personal information leaks, and other security and privacy issues. The purpose of malware detection is to identify and remove malware from computer systems to protect systems and users from potential threats.

[0003] Traditional malware detection methods are typically based on pattern matching or fingerprint matching. These methods require the continuous building and maintenance of fingerprint databases and rely on expert knowledge, making them very time-consuming and labor-intensive in practical applications. Summary of the Invention

[0004] In view of the above-mentioned defects or deficiencies in the prior art, it is desirable to provide a malware detection method, device, or computer-readable storage medium that can reduce human bias and improve detection accuracy.

[0005] The first aspect provides a method for detecting malware, the method comprising:

[0006] Obtain the detection dataset corresponding to the target software, and input the detection dataset into the detection model. The detection dataset includes multiple interface instruction function sequences.

[0007] The detection model is used to preprocess the sequence of each interface instruction function to obtain the initial sequence features corresponding to the target software.

[0008] The feature selection result of the initial sequence features is obtained by performing feature selection processing on the initial sequence features using the detection model;

[0009] Based on the feature selection results, a target encoder is selected from the detection model, and the initial sequence features are processed by the target encoder to obtain target sequence features. The target encoder includes multiple feature processors, which perform feature processing from different dimensions.

[0010] The detection model linearly maps the target sequence features and outputs the detection results of the target software.

[0011] The malware detection method provided in this application detects malware in target software based on a detection dataset of the target software using a detection model. The detection model can preprocess the interface instruction function sequences corresponding to multiple target software to obtain the initial sequence features corresponding to the target software. This not only reduces the amount of data processing and improves detection efficiency, but also extracts the features of the target software from different dimensions through different encoders and feature processors. Compared with traditional manual feature extraction and machine learning methods, this method can reduce human bias and improve the accuracy of recognition.

[0012] The second aspect provides a detection device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the detection method of the first aspect.

[0013] The third aspect provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the detection method of the first aspect. Attached Figure Description

[0014] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0015] Figure 1 A flowchart illustrating the steps of a malware detection method provided in this application;

[0016] Figure 2 A flowchart illustrating the steps of another malware detection method provided in this application;

[0017] Figure 3 A schematic diagram of the structure of an MOE-Transformer-Encoder layer is provided in this application;

[0018] Figure 4 A flowchart illustrating the steps of another malware detection method provided in this application;

[0019] Figure 5 A flowchart illustrating the steps of another malware detection method provided in this application;

[0020] Figure 6 This is a schematic diagram of the structure of a testing device provided in this application. Detailed Implementation

[0021] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0022] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0023] Please refer to Figure 1 , Figure 1 A flowchart illustrating a method for detecting malware, provided as an exemplary embodiment of this application, includes the following steps:

[0024] Step S20: Obtain the detection dataset corresponding to the target software, input the detection dataset into the detection model, and the detection dataset includes multiple interface instruction function sequences;

[0025] The target software is any software that needs to be detected as malware. The detection dataset includes data that represents the characteristics of the target software, such as the software code, runtime information, and interface information of the target software. For example, this application may select the interface instruction function sequence of the target software as the detection dataset.

[0026] The detection model can be a model that has been pre-trained on service devices, terminal devices, etc., and stored in the corresponding memory of the device. This detection model is used to detect whether the target software is malicious software.

[0027] In one embodiment, the detection dataset of the target software can be obtained from the sequence of interface instruction functions generated during the operation of the target software. Then, the service device or terminal device can obtain the detection data sent by the device integrated with the target software by sending an acquisition command to the device integrated with the target software, and then aggregate these data to obtain the detection dataset.

[0028] In another embodiment, such as Figure 2 As shown, Figure 2 An optional method embodiment for obtaining a detection dataset, provided as an exemplary embodiment of this application, includes the following steps:

[0029] Step S201: Simulate the target software using a sandbox program to obtain multiple interface instruction function sequences corresponding to the target software;

[0030] In this context, a sandbox program can be a program in a service device used to simulate the operation of software. When a service device determines that it needs to perform malware detection on a target software, it can run the target software through a sandbox program running on it to obtain multiple interface instruction function sequences obtained by the target software during its operation.

[0031] Step S202: The set of multiple interface instruction function sequences is used as the detection dataset.

[0032] Then, the service device can aggregate multiple interface instruction function sequences obtained by the target software during operation to obtain a set of multiple interface instruction function sequences, and use it as a detection dataset. Therefore, the detection dataset includes multiple interface instruction function sequences generated by the target software during operation.

[0033] This application runs the software to be tested through a pre-set program to obtain the corresponding test data. This makes the application of this application not only limited to the testing of software that carries its own test data, but also able to test software that has not yet been run and does not have test data, thus expanding the scope of application of this application.

[0034] Next, the method for training the detection model in this application will be explained:

[0035] Obtain positive sample data and negative sample data. The positive sample data includes multiple sequences of interface instruction functions corresponding to malicious software, and the negative sample data includes multiple sequences of interface instruction functions corresponding to benign software.

[0036] Positive sample data can be obtained by acquiring a certain number of malware programs and then analyzing the corresponding interface instruction function sequences for each malware. It is understood that the interface instruction function sequences for each malware program can be collected during the execution of the malware or obtained through simulated execution using a sandbox program; this is not limited here.

[0037] Using the same acquisition method, negative sample data is obtained by acquiring a certain number of benign software programs and then analyzing the corresponding interface instruction function sequences for each program. It should be noted that this "certain number" can be determined based on model training requirements, and the number of positive and negative samples can be the same or different; no specific limitation is imposed here.

[0038] After obtaining positive and negative sample data using the above method, this application can combine the positive and negative sample data into a package to obtain training samples, and then perform package-level annotation on the training samples. That is, only the package is annotated, and each API sequence is no longer annotated separately. This simplifies the annotation task, reduces the difficulty of annotation, and can make full use of the multi-instance learning method to better extract the main malicious features, reduce noise interference, and thus improve the accuracy of the classification results.

[0039] Initialize the initial model to set the number of iterations.

[0040] Initializing the initial model involves clearing all previous training traces, defining the starting point and number of iterations for training, so that the initial model can be trained systematically according to preset training rules. For example, the number of iterations could be 10.

[0041] The positive sample data and the negative sample data are sequentially input into the initial model for model training;

[0042] As described above, positive and negative sample data together constitute the training samples. However, during model training, the training samples corresponding to each software are sequentially input into the initial model for training.

[0043] For example, suppose the training samples include multiple interface instruction function sequences corresponding to the first software, the second software, the third software, the fourth software, the fifth software, and the sixth software. And it is known that the first, second, and third software are malicious software; and the fourth, fifth, and sixth software are benign software.

[0044] Therefore, the training process can be as follows: input the sequence of multiple interface instruction functions corresponding to the first software into the initial model to complete one full model training; after training the first software once, input the sequence of multiple interface instruction functions corresponding to the second software into the initial model to complete one full model training; after training the second software once, input the sequence of multiple interface instruction functions corresponding to the third software into the initial model to complete one full model training; after training the third software once, input the sequence of multiple interface instruction functions corresponding to the fourth software into the initial model to complete one full model training; after training the fourth software once, input the sequence of multiple interface instruction functions corresponding to the fifth software into the initial model to complete one full model training; after training the fifth software once, input the sequence of multiple interface instruction functions corresponding to the sixth software into the initial model to complete one full model training; repeat the above steps until the training process is completed for the number of iterations.

[0045] Since the training process for the multiple interface instruction function sequences corresponding to each software is the same, the following example of training the model for the multiple interface instruction function sequences corresponding to the first software will be used to illustrate the subsequent model training process.

[0046] First, after inputting the multiple interface instruction function sequences corresponding to the first software into the initial model, the initial model will perform word segmentation on the multiple interface instruction function sequences corresponding to the first software to obtain the word segmentation set corresponding to the multiple interface instruction function sequences.

[0047] To transform the function sequence into a mathematical problem, vector representation is used. However, representing the entire sequence of interface instruction functions as a vector would be too information-intensive, and word representation would fail to accurately convey the meaning. Therefore, this application chooses to represent each interface instruction function sequence as a word. Representing the interface instruction function sequence with the smallest unit that can express the complete meaning not only provides a unique representation of the interface instruction function sequence but also facilitates the subsequent processing of converting the vector into feature values.

[0048] It is understandable that after obtaining the word segmentation set, each word segment can be converted into a vector of fixed size to represent the word segmentation set with word vectors, thereby obtaining the corresponding word vector set.

[0049] For each piece of software, all its interface instruction function sequences constitute a multi-instance package. This application can further select the interface instruction function sequence that best represents the software's characteristics from these sequences using max pooling as the feature for subsequent feature processing. For example, max pooling can be used to calculate the feature values ​​of each word vector in the word vector set, and the word vector with the largest feature value can be used as the feature of the first software. For example, using max pooling to calculate the maximum vector in the first and second dimensions of the word vector matrix can yield a vector of size 1024.

[0050] In addition, the initial model of this application also includes a classification sub-model consisting of an expert-gated binary classification linear layer, two MOE-Transformer-Encoder layers and a linear layer, so as to process and identify the features of the first software through the classification sub-model and obtain the classification result of whether the first software is malicious software.

[0051] Specifically, after obtaining the features of the first software using the method described above, the initial model uses an expert-gated binary classification linear layer to calculate the probability that the feature belongs to malicious software and the probability that it belongs to benign software, respectively, based on the features of the first software. It should be noted that at the beginning of model training, these probability data are randomly assigned to the initial model. After subsequent iterative training and continuous correction of the assignments, more accurate training results will be obtained.

[0052] Then, the initial model calculates the probability that a feature belongs to malware and the probability that it belongs to benign software based on the characteristics of the first software. From the two MOE-Transformer-Encoder layers, it selects one of them to further process the features of the first software. It should be noted that one of the two MOE-Transformer-Encoder layers is used to process the features of malware, and the other is used to process the features of benign software.

[0053] Therefore, if the probability that the first software belongs to malicious software is greater than the probability that it belongs to benign software, the MOE-Transformer-Encoder layer will be selected to process the features of the first software, such as feature extraction and feature transformation.

[0054] like Figure 3 As shown, each MOE-Transformer-Encoder layer includes multiple feature processors. These processors process features from different dimensions. For example, the first feature processor processes features based on semantics, the second on part-of-speech, the third on length, and the fourth on vector dimensions. This means that each feature processor focuses on different aspects of the feature, resulting in different outcomes for the same feature. This allows for the extraction of deeper features, improving the accuracy of software recognition. Furthermore, the linear layers in the MOE-Transformer-Encoder layer use the SwiGLU activation function for feature processing. Compared to the traditional ReLU activation function, this function is smoother, converges more easily, and better captures the relationship between input and output.

[0055] However, in order to save time in feature processing, this application can select two feature processors from multiple feature processors to perform deeper feature processing on the features of the first software. This can not only avoid the situation that the feature processing results obtained by using only one feature processor are inaccurate, but also improve the efficiency of feature processing.

[0056] Depend on Figure 3As can be seen, this application also sets an expert-gated linear layer before multiple feature processors. By setting this expert-gated linear layer, the probability of the first software selecting each feature processor is calculated. Similarly, these probability data are all randomly assigned values ​​in the initial model. After subsequent iterative training, the assignments are continuously corrected to obtain more accurate training results.

[0057] Then, the initial model can select the feature processors with the highest probability and those with probabilities only less than the highest probability as the target feature processors, and input the probability of the first software into the target feature processors to perform feature extraction and feature transformation processing on the features of the first software.

[0058] For example, the MOE-Transformer-Encoder layer can perform feature processing operations on the features of the first software using the following method:

[0059] Step 1: To Perform a linear mapping to form three matrices, for ,in, denoted as the target feature of the software; Q is the query matrix; K is the key matrix; and V is the value matrix.

[0060]

[0061] Among them, W Q The weight corresponding to Q; W K W represents the weight corresponding to K; V The weights corresponding to V;

[0062] Step 2: Self-attention mechanism:

[0063]

[0064] Where, d k The dimension that represents the feature vector of the software.

[0065] Step 3: Residual Joins and Layer Normalization:

[0066]

[0067]

[0068] Step 4: Expert Hybrid Gating:

[0069] Calculate the Gate's Weight using Linear(X_L).

[0070] Select the two largest FFN level indices in Weight: i, j = Top2[Weight]

[0071] Calculate the mixing results:

[0072]

[0073] Step 5: Residual Joins and Layer Normalization:

[0074]

[0075]

[0076] Step 6: Repeat steps 1 to 5 8 times:

[0077] Step 7: Obtain the data extracted by the Transformer .

[0078] Since the features of the first software are extracted and transformed by two feature processors, two processing results are obtained, which are referred to here as the first feature result and the second feature result.

[0079] Since only one identification result for the first software can exist, this application merges the first feature result and the second feature result to obtain the target feature of the first software. This allows a final binary classification linear layer to linearly map this target feature and output a binary classification result, which can be represented as a probability. For example, if the linear layer outputs 0.3, it means the probability that the first software is malicious software is 0.3. If we define software with a probability of 1 as malicious software and software with a probability of 0 as benign software, and since the first software is known to be malicious, we want a result of 1 or a result infinitely close to 1. Therefore, during the next round of training on the multiple interface instruction function sequences corresponding to the first software, we can adjust the data that can be adjusted during the above training process based on the known result, thereby obtaining the desired training result.

[0080] The adjustable data includes, for example, the numerical value of the feature, the probability that the software is malicious based on the software features, the probability that the software is benign based on the software features, and the selected feature processor.

[0081] The above detection model is obtained after training the positive sample data and negative sample data corresponding to each software for a number of iterations.

[0082] For example, training is performed sequentially on multiple interface instruction function sequences of the first software, the second software, the third software, the fourth software, the fifth software, and the sixth software once as one iteration. After the above 10 iterations, the required detection model can be trained.

[0083] To verify the robustness of the detection model, this application can further validate the detection model using validation sample data after obtaining the detection model, and output the detection model when the validation result reaches the predetermined result.

[0084] For example, dividing the dataset into training and validation sets in a 7:3 ratio, and achieving 96% accuracy, 95% recall, and an F1 score of 0.96 on the validation set, indicates that the detection model can be output. Here, Recall represents recall, and Precision represents accuracy.

[0085]

[0086]

[0087]

[0088] Step S30: Preprocess the sequence of instruction functions for each interface using a detection model to obtain the initial sequence features corresponding to the target software;

[0089] The purpose of preprocessing the instruction function sequences of each interface is to obtain the initial sequence features corresponding to the target software, so as to facilitate more refined feature processing and obtain a more accurate judgment result on the target software.

[0090] In an optional embodiment, such as Figure 4 As shown, Figure 4 A preprocessing method embodiment provided for an exemplary embodiment of this application includes the following steps:

[0091] Step S401: The detection model is used to perform word segmentation on each interface instruction function sequence to obtain the word segmentation corresponding to each interface instruction function sequence, and a word segmentation sequence set is obtained based on the word segmentation corresponding to each interface instruction function sequence.

[0092] As described above regarding model training, segmenting the sequence of interface instruction functions facilitates the subsequent acquisition of vectors to determine the feature values ​​of each vector. This segmentation process can be performed by detecting the operations executed by the segmenter in the model; the type of segmenter is not limited here.

[0093] After segmenting each interface instruction function sequence by a word segmenter, the corresponding word segments for each interface instruction function sequence can be obtained. After aggregating the word segments corresponding to each interface instruction function sequence, a set of word segment sequences can be obtained.

[0094] Step S402: The word segmentation sequence set is obtained by vectorizing each word in the word segmentation sequence set using the detection model;

[0095] Representing word segments as vectors facilitates the calculation of feature values ​​for each segment, and the vectors all have a fixed size, thus avoiding discrepancies.

[0096] By representing each word in the word segmentation sequence set using a vector of fixed size, a word vector set can be obtained.

[0097] Step S403: Calculate the feature value of each word vector in the word vector set using the detection model, and select the target word vector as the initial sequence feature based on the feature value of each word vector.

[0098] For each software, all its interface instruction function sequences constitute a multi-instance package. This application can further select the interface instruction function sequence that best represents the characteristics of the target software from these sequences using max pooling as the initial sequence feature for subsequent feature processing. For example, max pooling can be used to calculate the feature values ​​of each word vector in the word vector set, and the word vector with the largest feature value can be used as the initial sequence feature of the target software.

[0099] Step S40: The initial sequence features are processed by the detection model to obtain the feature selection results of the initial sequence features;

[0100] After obtaining the initial sequence features of the target software using the above method, feature filtering processing is performed through a first expert-gated linear layer to obtain the feature filtering results of the initial sequence features. Specifically: the first expert-gated linear layer in the detection model calculates a first probability that the initial sequence features are malicious software features, and calculates a second probability that the initial sequence features are benign software features; the first probability and the second probability are used as the feature filtering results.

[0101] Step S50: Select a target encoder from the detection model based on the feature selection results, and perform feature processing on the initial sequence features through the target encoder to obtain the target sequence features. The target encoder includes multiple feature processors, which perform feature processing from different dimensions.

[0102] Based on the above description, the detection model of this application includes two MOE-Transformer-Encoder layers. One of the two MOE-Transformer-Encoder layers is used to process the characteristics of malicious software, and the other is used to process the characteristics of benign software.

[0103] Therefore, based on the first and second probabilities mentioned above, it is possible to initially screen whether the target software is malicious or benign software. For example, the target encoder can be determined from two encoders in the detection model based on the first probability, the second probability, and a probability threshold. Specifically, if the first probability is greater than the probability threshold, the MOE-Transformer-Encoder layer, used for processing features of malicious software, can be selected to further process the initial sequence features of the target software. Conversely, if the second probability is greater than the probability threshold, the MOE-Transformer-Encoder layer, used for processing features of benign software, can be selected to further process the initial sequence features of the target software.

[0104] In another embodiment, such as Figure 5 As shown, it can be done through Figure 5 The method shown performs feature processing on the initial sequence features using the target encoder to obtain the target sequence features:

[0105] Step S501: Calculate the third probability of each feature processor by using the second expert-gated linear layer in the detection model to select the initial sequence features;

[0106] Step S502: Select the feature processors corresponding to the first target probability with the largest probability value and the second target probability with a probability value that is only less than the first target probability from the third probability, and use them as target feature processors;

[0107] Step S503: Input the initial sequence features into the target feature processor for feature extraction and feature transformation to obtain the first feature and the second feature;

[0108] Step S504: Merge the first feature and the second feature to obtain the target sequence features.

[0109] The method for processing the initial sequence features to obtain the target sequence features is detailed in the above description of the detection model training process, and will not be repeated here.

[0110] Step S60: Linearly map the target sequence features using the detection model and output the detection results of the target software.

[0111] The detection model includes a linear layer, which performs linear mapping on the target sequence features. The detection result can be represented as a probability. For example, a detection result of 0.95 could identify the target software as malware.

[0112] The malware detection method provided in this application detects malware in target software based on a detection dataset of the target software using a detection model. The detection model can preprocess the interface instruction function sequences corresponding to multiple target software to obtain the initial sequence features corresponding to the target software. This not only reduces the amount of data processing and improves detection efficiency, but also extracts the features of the target software from different dimensions through different encoders and feature processors. Compared with the traditional manual feature extraction + machine learning method, this method can reduce human bias and improve the accuracy of recognition.

[0113] It should be noted that although the operations of the method of the present invention are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all of the operations shown must be performed to achieve the desired result. On the contrary, the steps depicted in the flowchart may be performed in a different order.

[0114] Further reference Figure 6 It illustrates an exemplary structural block diagram of a detection device for detecting malware according to an embodiment of this application. The device includes a memory and a processor, which, when executing the computer program, implements:

[0115] Obtain the detection dataset corresponding to the target software, and input the detection dataset into the detection model. The detection dataset includes multiple interface instruction function sequences.

[0116] The detection model is used to preprocess the sequence of each interface instruction function to obtain the initial sequence features corresponding to the target software.

[0117] The feature selection result of the initial sequence features is obtained by performing feature selection processing on the initial sequence features using the detection model;

[0118] Based on the feature selection results, a target encoder is selected from the detection model, and the initial sequence features are processed by the target encoder to obtain target sequence features. The target encoder includes multiple feature processors, which perform feature processing from different dimensions.

[0119] The detection model linearly maps the target sequence features and outputs the detection results of the target software.

[0120] In one embodiment, the processor, when executing the computer program, also implements:

[0121] The first probability that the initial sequence feature is a malicious software feature is calculated by the first expert-gated linear layer in the detection model, and the second probability that the initial sequence feature is a benign software feature is calculated.

[0122] The first probability and the second probability are used as the feature selection results.

[0123] In one embodiment, when the processor executes the computer program, it further implements: determining the target encoder from two encoders in the detection model based on the first probability, the second probability, and a probability threshold.

[0124] In one embodiment, when the processor executes the computer program, it further implements: calculating a third probability for selecting each of the feature processors from the initial sequence features through a second expert-gated linear layer in the detection model;

[0125] From the third probabilities, select the feature processors corresponding to the first target probability with the largest probability value and the second target probability with a probability value that is only less than the first target probability, and use them as target feature processors;

[0126] The initial sequence features are input into the target feature processor for feature extraction and feature transformation to obtain the first feature and the second feature.

[0127] The first feature and the second feature are merged to obtain the target sequence feature.

[0128] In one embodiment, when the processor executes the computer program, it further performs the following: performs word segmentation processing on each of the interface instruction function sequences through the detection model to obtain the word segments corresponding to each of the interface instruction function sequences, and obtains a set of word segmentation sequences based on the word segments corresponding to each of the interface instruction function sequences;

[0129] The detection model is used to represent each word in the word segmentation sequence set as a vector to obtain a word vector set.

[0130] The detection model calculates the feature value of each word vector in the word vector set, and selects the target word vector as the initial sequence feature based on the feature value of each word vector.

[0131] In one embodiment, when the processor executes the computer program, it further implements the following: determining the word vector with the largest feature value as the target word vector through the detection model.

[0132] In one embodiment, when the processor executes the computer program, it further performs the following: simulates the target software through a sandbox program to obtain multiple interface instruction function sequences corresponding to the target software;

[0133] The set of the multiple interface instruction function sequences is used as the detection dataset.

[0134] In one embodiment, when the processor executes the computer program, it further implements: acquiring positive sample data and negative sample data, wherein the positive sample data includes multiple sequences of interface instruction functions corresponding to malicious software, and the negative sample data includes multiple sequences of interface instruction functions corresponding to benign software;

[0135] Initialize the initial model to set the number of iterations.

[0136] The positive sample data and the negative sample data are sequentially input into the initial model for model training;

[0137] The detection model is obtained after training each of the positive sample data and each of the negative sample data for the number of iterations.

[0138] In particular, according to embodiments of this disclosure, the above references Figure 1 The described process can be implemented as a computer software program. For example, embodiments of this disclosure include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program containing instructions for performing... Figure 1 The program code for the method. In such an embodiment, the computer program can be downloaded and installed from a network.

[0139] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0140] The units or modules described in the embodiments of this application can be implemented in software or hardware. The described units or modules can also be located in a processor.

[0141] In another aspect, this application also provides a computer-readable storage medium, which may be a computer-readable storage medium included in the apparatus described in the above embodiments; or it may be a standalone computer-readable storage medium not assembled into a device. The computer-readable storage medium stores one or more programs, which are used by one or more processors to execute the formula input method described in this application.

[0142] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A method for detecting malicious software, characterized in that, The method includes: Obtain the detection dataset corresponding to the target software, and input the detection dataset into the detection model. The detection dataset includes multiple interface instruction function sequences. The detection model is used to preprocess the sequence of each interface instruction function to obtain the initial sequence features corresponding to the target software. The first probability that the initial sequence feature is a malicious software feature is calculated by the first expert-gated linear layer in the detection model, and the second probability that the initial sequence feature is a benign software feature is calculated. The first probability and the second probability are used as the feature selection results; The target encoder is determined from the two encoders in the detection model based on the first probability, the second probability, and the probability threshold, and the third probability of selecting each feature processor for the initial sequence features is calculated through the second expert-gated linear layer in the detection model. From the third probabilities, select the feature processors corresponding to the first target probability with the largest probability value and the second target probability with a probability value that is only less than the first target probability, and use them as target feature processors; The initial sequence features are input into the target feature processor for feature extraction and feature transformation to obtain the first feature and the second feature. The first feature and the second feature are merged to obtain the target sequence features. The target encoder includes multiple feature processors, which perform feature processing from different dimensions. The detection model linearly maps the target sequence features and outputs the detection results of the target software.

2. The detection method according to claim 1, characterized in that, The preprocessing of each interface instruction function sequence using the detection model includes: The detection model is used to segment each of the interface instruction function sequences to obtain the segmented words corresponding to each of the interface instruction function sequences, and a set of segmented word sequences is obtained based on the segmented words corresponding to each of the interface instruction function sequences. The detection model is used to represent each word in the word segmentation sequence set as a vector to obtain a word vector set. The detection model calculates the feature value of each word vector in the word vector set, and selects the target word vector as the initial sequence feature based on the feature value of each word vector.

3. The detection method according to claim 2, characterized in that, The step of selecting a target word vector as the initial sequence feature from the word vectors based on the feature values ​​of each word vector includes: The detection model determines the word vector with the largest feature value as the target word vector.

4. The detection method according to claim 1, characterized in that, The acquisition of the detection dataset corresponding to the target software includes: The target software is simulated and run using a sandbox program to obtain multiple interface instruction function sequences corresponding to the target software; The set of the multiple interface instruction function sequences is used as the detection dataset.

5. The detection method according to claim 1, characterized in that, The method further includes: the training process of the detection model: Obtain positive sample data and negative sample data. The positive sample data includes multiple sequences of interface instruction functions corresponding to malicious software, and the negative sample data includes multiple sequences of interface instruction functions corresponding to benign software. Initialize the initial model to set the number of iterations. The positive sample data and the negative sample data are sequentially input into the initial model for model training; The detection model is obtained after training each of the positive sample data and each of the negative sample data for the number of iterations.

6. A testing device, characterized in that, The method includes a memory and a processor, the memory storing a computer program, characterized in that the processor executes the computer program to implement the steps of the method according to any one of claims 1 to 5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images