A method, system and readable medium for detecting malicious code in the Internet of Things based on dual representation fusion embedding

Abstract

This invention relates to a method, system, and readable medium for detecting IoT malware based on dual-representation fusion embedding, addressing the shortcomings of existing technologies in terms of accuracy and reliability in detecting IoT malware. The technical solution of this invention includes the following steps: 1) obtaining the assembly code of the IoT based on high-reliability instrumentation dynamic analysis technology; 2) obtaining semantic representations of the assembly code segments based on the CodeBert model; 3) obtaining function call graph representations based on a transitive neural network model; 4) identifying malware based on the fusion embedding of dual representations (assembly code segment semantic representation and function call graph representation). This invention can construct high-confidence and high-reliability dual representations using assembly code segment semantic representation and function call graph representation even when the source code is unknown. Through dual-representation fusion embedding, it achieves malware classification and detection, realizing reliable and accurate IoT malware detection.

Description

Technical Field

[0001] This invention relates to the field of software security, and in particular to a method, system and readable medium for detecting malicious code in the Internet of Things based on dual-representation fusion embedding. Background Technology

[0002] To ensure software availability and security, software engineers need to make various decisions throughout the software lifecycle. However, different execution conditions (such as execution environment, compilation environment, and optimization strategies) and real-time computation states (such as executable path selection and variable updates) can be exploited by attackers to inject malicious code. Developing intelligent function type inference tools is crucial to assist software security testers in discovering malicious code in binary programs. Through function type inference, software security testers can not only perform reverse engineering of binary programs but also promote advancements in areas such as function boundary detection, code similarity analysis, and vulnerability discovery. Furthermore, an accurate function type inference model can improve the efficiency of bug searching, value set inference, and fuzz testing.

[0003] Deep learning is considered a cutting-edge key technology for function type inference. It typically involves two steps. The first step is determining the granularity of analysis (e.g., dataset organization). For example, natural language processing methods can be used to learn the semantics of assembly code in static analysis scenarios. The second step aims to determine the feature representation method based on application requirements. Existing representation methods are mainly divided into two categories: 1) text-based methods, which primarily extract features from the assembly code and control flow information preserved in binary files; and 2) graph-based methods, where software security testers can build graph representation models at the function, basic block, and instruction levels to detect software vulnerabilities. However, these methods do not integrate assembly code semantic features and function dependency graph features, resulting in a lack of global data dependencies and consequently, less than ideal reliability and accuracy in detecting malicious code in the Internet of Things (IoT). Summary of the Invention

[0004] The purpose of this invention is to address the aforementioned problems in existing technologies by providing an IoT malware detection method, system, and readable medium based on dual-representation fusion embedding. First, a layered instrumentation strategy is used to dynamically analyze binary programs, enabling the acquisition of assembly code segment semantic features and function call graph representations in a single execution, while ensuring that the dynamic analysis strategy is unaffected by the execution environment or compilation optimizations. Next, the CodeBert model is used to learn the data flow characteristics within assembly instructions and the data dependency characteristics between assembly instructions, thereby obtaining short-span, independent, and unique assembly code segment semantic feature vectors. Simultaneously, the attribute and structural features of function call graph nodes are learned based on the GAT model, thereby obtaining long-span data dependency feature vectors. Finally, reliable and accurate IoT malware detection is achieved using the assembly code segment semantic representation and the function call graph representation.

[0005] The above-mentioned technical objective of this invention is mainly achieved through the following technical solution: a method for detecting malicious code in the Internet of Things based on dual-representation fusion embedding, characterized in that its steps are as follows:

[0006] Based on instrumentation dynamic analysis technology, binary programs are dynamically analyzed to obtain the assembly code for the Internet of Things. In this step, the interference of the execution environment and compilation environment on dynamic tracing is shielded without affecting the execution efficiency of the software being tested, ensuring that the dynamic analysis strategy is not affected by the execution environment, compilation optimization, etc.

[0007] Assembly code is embedded in the bidirectional encoder Bert model to construct a bidirectional encoder CodeBert model adapted to assembly instructions. The semantic features of assembly code segments within functions in the assembly code are obtained through the CodeBert model. The semantic features of the assembly code segments are short-span data dependency features. The semantic features of the assembly code segments (short-span data dependency features) are short-span, independent and unique assembly code segment semantic feature vectors.

[0008] The function call graph structure and node attributes are extracted using the message passing neural network model GAT to obtain the function call graph representation, which is a long-span data dependency feature;

[0009] The semantic features of the assembly code segment are fused with the function call graph representation to form a dual representation fusion. Malicious code is identified based on the dual representation fusion and used to learn malicious code features to detect IoT malicious code.

[0010] In summary, an IoT malware detection method based on dual-representation fusion embedding utilizes the aforementioned semantic features of assembly code segments and function call graph representations to achieve reliable and accurate IoT malware detection.

[0011] As a further improvement and supplement to the above technical solution, this invention adopts the following technical measures: Dynamic instrumentation analysis technology is used to insert callback functions at function calls and function returns, obtaining the instructions at the instrumentation location and the instruction information before and after the instrumentation location, thus obtaining the boundary of each function. Function calls and function returns make the boundary of each function clear, preventing dynamic tracing loss during function calls and jump pointers. Dynamic instrumentation analysis technology (or dynamic instrumentation strategy) has high reliability. When tracing the execution process of the target software, dynamic instrumentation analysis technology can clearly discover the boundary of each function, thereby solving the problem of dynamic tracing loss caused by hidden function calls and jump pointers.

[0012] The CodeBert model is constructed by fine-tuning the Token type in the BERT bidirectional encoder model. This CodeBert model is used to learn the intra-instruction data flow characteristics and inter-instruction data dependency characteristics within functions. Intra-instruction data flow describes the memory data processing flow in a fine-grained manner, while inter-instruction data dependencies describe the key function logic using local code (i.e., functions). The fine-tuned CodeBert model will then be able to learn both intra-instruction data flow characteristics and inter-instruction data dependency characteristics.

[0013] The BERT model categorizes instruction operands into data type operands and address type operands, and adds a token type to each operand. For data type operands, constant tokens are marked as "[constant]", while for address type operands, tokens for immediate values ​​are marked as "[immediate]", absolute addresses as "[ab_addr]", and relative addresses as "[re_addr]". This is used to identify intra-instruction constraints and improve the accuracy of short-span data dependency features. The BERT model is adaptable to assembly instructions in x86, ARM, and MIPS instruction formats.

[0014] When acquiring the function call graph representation, graph structure information is fused by modifying the attributes of graph nodes to extract function call relationship features. These features include individual node features and relationships between individual nodes and their neighbors. The relationships between individual nodes and their neighbors are further processed by forming a graph self-attention layer using several stacked blocks and generating attention coefficients to achieve joint learning between nodes. The formula for calculating the attention coefficients is as follows:

[0015] (1);

[0016] Since the graph structure formed by a single node and its neighboring nodes cannot fully represent the function call graph, node joints are an important way to improve feature reliability. Combining the obtained single node features and the attention coefficients, the neural network model traverses each node feature and performs joint node learning to obtain the final node features, i.e., long-span data dependency features. The formula for joint node learning is:

[0017] (2);

[0018] in, This is the weight matrix. Attention coefficient Index the target node. For the label of a single node, , All are adjacent node indexes. , respectively with The labels of adjacent adjacent nodes are used to obtain the attention coefficient of the target node. , For the overall set of nodes.

[0019] When representing the semantics of assembly code, function node attributes are constructed. Function node attributes include node number node_id, node feature node_feature, head node head_node, tail node tail_node, and edge feature edge_feature. Among them, node_feature is the main attribute of the node, and the other attributes are auxiliary attributes.

[0020] The message-passing neural network model GAT (a graph neural network model based on an attention mechanism) constructs a graph attention layer by building block layers and stacking block layers. Each node is generated based on the graph structure matrix and neighbor node attributes in the graph attention layer. In order to improve the generalization ability of the learned graph model, the multi-head attention mechanism of the GAT model is used to jointly combine independent node features. Node features are randomly sampled from the graph attention layer and combined to obtain the target node features as long-span data dependency features of the objective function.

[0021] After obtaining short-span semantic features and long-span data dependency features, a data structure containing global code features is constructed by concatenation. Then, a network model LSTM with learnable temporal features is used to achieve dual representation fusion and result prediction. The first layer of the LSTM network in the LSTM model combines the semantic features of the assembly code segment and the long-span data dependency features to obtain the high-dimensional feature vector of the objective function. The second layer of the LSTM network in the LSTM model obtains the result of predicting malicious software behavior based on the function execution order and the high-dimensional features of the objective function.

[0022] To integrate assembly code semantic representation and function dependency graph representation, the assembly code semantic representation and function call graph representation are concatenated and connected into a single feature vector. An LSTM model is then used to iteratively learn the concatenated feature vector. In the LSTM model, the first layer of the LSTM network reconstructs the concatenated feature vector into a latent variable containing complete data dependencies. The second layer of the LSTM network iteratively updates the latent variable according to the labeled function call order, resulting in the malicious code detection result.

[0023] The technical solution of the second technical subject of this invention is: an IoT malicious code detection system based on dual representation fusion embedding, characterized in that it executes the above-mentioned IoT malicious code detection method based on dual representation fusion embedding, the IoT malicious code detection system based on dual representation fusion embedding includes: a dynamic analysis module, a module for obtaining semantic features of assembly code segments, a module for obtaining function call graph representations, a dual representation fusion module, and a malicious code feature learning module;

[0024] Dynamic Analysis Module: Based on highly reliable instrumentation, dynamic analysis shields the execution and compilation environments from interference with dynamic tracing without affecting the execution efficiency of the software being tested.

[0025] Assembly code segment semantic feature acquisition module: Embed assembly code in the bidirectional encoder Bert model to build a bidirectional encoder CodeBert model adapted to assembly instructions. The semantic features of assembly code segments within functions in the assembly code are obtained through the CodeBert model. The semantic features of assembly code segments are short-span data dependency features.

[0026] Function call graph representation acquisition module: Extracts function call graph structure and node attributes through a message passing neural network model to acquire function call graph representation, which is a long-span data dependency feature;

[0027] Dual Representation Fusion Module: Fuses the semantic features of the assembly code segment with the function call graph representation to form a dual representation fusion;

[0028] Malicious Code Feature Learning Module: Based on dual-representation fusion embedding, this module learns malicious code features to detect malicious code in the Internet of Things (IoT).

[0029] The technical solution of the third technical subject of this invention is: a readable medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the above-mentioned IoT malicious code detection method based on dual-representation fusion embedding.

[0030] The beneficial effects of this invention are as follows: 1. The IoT malware detection method based on the fusion and embedding of assembly code segment semantic representation and function call graph representation has higher accuracy and robustness, significantly improving the identification accuracy of IoT malware and achieving reliable and accurate IoT malware detection. 2. The hierarchical instrumentation strategy is used to dynamically analyze binary programs, enabling the acquisition of the above two representations in a single execution, while ensuring that the dynamic analysis strategy is not affected by the execution environment, compilation optimization, etc. 3. Based on the CodeBert model, the data flow characteristics within assembly instructions and the data dependency characteristics between assembly instructions are learned, thereby obtaining short-span, independent, and unique assembly code segment semantic feature vectors; simultaneously, based on the GAT model, the attribute and structural characteristics of function call graph nodes are learned, thereby obtaining long-span data dependency feature vectors. Attached Figure Description

[0031] Figure 1 This is a flowchart illustrating an IoT malware detection method based on dual-representation fusion embedding, which is the subject of this invention.

[0032] Figure 2 This invention relates to a comparative experimental curve diagram of an IoT malicious code detection method based on dual-representation fusion embedding, which employs high-level compilation optimization.

[0033] Figure 3 This invention relates to a comparative experimental curve diagram of an IoT malicious code detection method based on dual-representation fusion embedding, which employs compilation-free optimization.

[0034] Figure 1 In this diagram: 'a' represents a node feature; 'T' represents the input to a single-layer neural network node; 'A' represents a single-layer neural network node; 'H' represents the output result; and 'Fn' represents a function (each node represents a function). Detailed Implementation

[0035] The technical solution of the present invention will be further described in detail below through embodiments and in conjunction with the accompanying drawings.

[0036] Example 1: Reference Figure 1 This example demonstrates the specific implementation process of an IoT malware detection method based on dual-representation fusion embedding, including the following four steps:

[0037] S1: Based on instrumentation dynamic analysis technology, it shields the interference of the execution environment and compilation environment on dynamic tracing without affecting the execution efficiency of the software being tested, and obtains the assembly code of the Internet of Things.

[0038] To reduce the risk of losing pointers to the currently executing instruction, this invention uses stack and queue data structures to record the program stack, thereby filtering out hidden function calls in dynamic tracing and solving the problem of lost traces. The queue stores function attributes with addresses as keys and the complete function call order. The stack simulates the program stack execution process, recording the _ebp and _esp register values ​​and the target address of the calling instruction to closely track the target binary execution process. When the %ret instruction is called, the tracer compares the most recently recorded _ebp and _esp register values ​​in the stack with the address to which the return value jumps. If the two values ​​are equal or the difference between the two values ​​is within 15 bytes (maximum instruction length), the value is recorded. Otherwise, the jump target address is recorded in the program stack. Similarly, when the %call instruction is called, the tracer compares the most recent _ebp and _esp register values ​​with the address to which the %call instruction jumps, following the same rules as above. All adopted values ​​are recorded in a dictionary according to these rules.

[0039] S2: Embed assembly code in the bidirectional encoder Bert model to build a bidirectional encoder CodeBert model adapted to assembly instructions. Obtain the semantic features of assembly code segments within functions in the assembly code through the CodeBert model. The semantic features of the assembly code segments are short-span data dependency features.

[0040] To achieve effective assembly code semantic representation embedding, this invention constructs an improved PalmTree model based on the bidirectional encoder BERT model to predict the true labels of random mask tokens and iteratively learn the contextual semantic relationships of the assembly code. The improved PalmTree model features bidirectional connectivity and is structured into a multi-layered structure (e.g., encoder and decoder) within a Transformer unit. The encoder is trained to predict mask tokens. The entire training task consists of two sub-tasks. The first sub-task is to obtain a mask language model (MLM) that understands the internal structure and data flow of assembly instructions. The second sub-task aims to jointly tune the embedding model and the instruction order prediction model to learn the data dependencies between instructions.

[0041] S3: Extract the function call graph structure and node attributes through the message passing neural network model GAT to obtain the function call graph representation, which is a long-span data dependency feature.

[0042] The graph learning process combines the call relationships between functions with the execution state of the target binary file, improving the long-span data dependencies between functions. The GAT model's learning process constructs a graph attention layer by stacking block layers, generating a feature vector for each node based on the graph structure matrix and the attributes of neighboring nodes. Then, to improve the generalization ability of the learned graph model, this invention uses a multi-head attention mechanism to combine the independent node features. This multi-head attention mechanism utilizes the graph attention layer to randomly sample node features and concatenate them to obtain the target node features as the long-span data dependencies of the objective function.

[0043] S4: The semantic features of the assembly code segment are fused with the function call graph representation to form a dual representation fusion. Malicious code is identified based on the dual representation fusion and used to learn malicious code features to detect IoT malicious code.

[0044] Assembly code semantic feature vectors (i.e., assembly code semantic features) are generated by a semantic learning model, while function dependency graph feature vectors (i.e., function dependency graph features) are generated by a graph learning model. These two representations can be used to extract short-span and long-span data dependencies, which is crucial for improving the accuracy and robustness of malware detection. For example... Figure 1 As shown in step (g), to fuse the two features mentioned above, this invention connects them to the same vector instead of addressing feature loss through mathematical operations. Then, to obtain complete data dependencies for each function and reliable prediction results, we use a cascaded LSTM model to iteratively learn the connected feature vectors. In this model, the first LSTM network reconstructs the connected feature vectors into implicit variables containing complete data dependencies. The second LSTM network iteratively updates the implicit variables according to the well-labeled function call order. Through this design, high-confidence malware detection results can be obtained.

[0045] The advantages of this technical solution compared to existing technologies are:

[0046] (1) The IoT malware detection method based on dual-representation fusion embedding has higher accuracy and robustness. To demonstrate the effectiveness of this invention, tests were also conducted using datasets dynamically analyzed by four tool libraries with a compilation optimization level of O2. The results were compared with those using high compilation optimization (such as...) Figure 2 (as shown) and no compilation optimization (such as) Figure 3 As shown in the diagram, the impact of these two execution paths on the present invention demonstrates that the execution path retaining more information exhibits higher robustness in identification. Furthermore, the present invention demonstrates high accuracy and strong stability when using the same test set as input to detect different software or tool libraries. Compared to existing work, the identification accuracy has been significantly improved.

[0047] (2) An experiment was designed to compare the results of this invention with those of other recent excellent studies to evaluate the practical effect of this invention in different scenarios. This invention uses compiler optimization levels (including O2 and O3) that have a significant impact on assembly code to compile the target software. Since O0 and O1 are general optimization levels, O1 and O0 are the baselines. Then, the robustness and running efficiency of this invention were tested when encountering data dependencies of different intensities. The evaluation results are shown in Table 1. First, this invention is slower than other binary similarity inference strategies (such as Asm2vec and EKLAVYA). To achieve higher code coverage, this invention uses a larger dataset than other static analysis strategies, which is expected. However, when the data dependencies become sparse, the recognition accuracy does not decrease significantly, which proves that this invention is still an excellent strategy under the condition of known limited data dependencies.

[0048] Table 1:

[0049]

[0050] Next, the above technical solution will be described in another way:

[0051] Dynamic instrumentation analysis uses callback functions to insert at function calls and return points, obtaining the instructions at the instrumentation location and the instructions before and after the instrumentation location to determine the boundaries of each function. Function calls and return points clearly define these boundaries, preventing dynamic tracing loss during function calls and jump pointers. Dynamic instrumentation analysis (or dynamic instrumentation strategy) is highly reliable; it clearly identifies the boundaries of each function when tracing the execution of target software, thus solving the problem of dynamic tracing loss caused by hidden function calls and jump pointers.

[0052] The CodeBert model is constructed by fine-tuning the Token type in the BERT bidirectional encoder model. This CodeBert model is used to learn the intra-instruction data flow characteristics and inter-instruction data dependency characteristics within functions. Intra-instruction data flow describes the memory data processing flow in a fine-grained manner, while inter-instruction data dependencies describe the key function logic using local code (i.e., functions). The fine-tuned CodeBert model will then be able to learn both intra-instruction data flow characteristics and inter-instruction data dependency characteristics.

[0053] The BERT model categorizes instruction operands into data type operands and address type operands, and adds a token type to each operand. For data type operands, constant tokens are marked as "[constant]", while for address type operands, tokens for immediate values ​​are marked as "[immediate]", absolute addresses as "[ab_addr]", and relative addresses as "[re_addr]". This is used to identify intra-instruction constraints and improve the accuracy of short-span data dependency features. The BERT model is adaptable to assembly instructions in x86, ARM, and MIPS instruction formats.

[0054] When acquiring the function call graph representation, graph structure information is fused by modifying the attributes of graph nodes to extract function call relationship features. These features include individual node features and relationships between individual nodes and their neighbors. The relationships between individual nodes and their neighbors are further processed by forming a graph self-attention layer using several stacked blocks and generating attention coefficients to achieve joint learning between nodes. The formula for calculating the attention coefficients is as follows:

[0055] (1);

[0056] Since the graph structure formed by a single node and its neighboring nodes cannot fully represent the function call graph, node joints are an important way to improve feature reliability. Combining the obtained single node features and the attention coefficients, the neural network model traverses each node feature and performs joint node learning to obtain the final node features, i.e., long-span data dependency features. The formula for joint node learning is:

[0057] (2);

[0058] in, This is the weight matrix. Attention coefficient Index the target node. For the label of a single node, , All are adjacent node indexes. , respectively with The labels of adjacent adjacent nodes are used to obtain the attention coefficient of the target node. , For the overall set of nodes.

[0059] When representing the semantics of assembly code, function node attributes are constructed. Function node attributes include node number node_id, node feature node_feature, head node head_node, tail node tail_node, and edge feature edge_feature. Among them, node_feature is the main attribute of the node, and the other attributes are auxiliary attributes.

[0060] The message-passing neural network model GAT (a graph neural network model based on an attention mechanism) constructs a graph attention layer by building block layers and stacking block layers. Each node is generated based on the graph structure matrix and neighbor node attributes in the graph attention layer. In order to improve the generalization ability of the learned graph model, the multi-head attention mechanism of the GAT model is used to jointly combine independent node features. Node features are randomly sampled from the graph attention layer and combined to obtain the target node features as long-span data dependency features of the objective function.

[0061] After obtaining short-span semantic features and long-span data dependency features, a data structure containing global code features is constructed by concatenation. Then, a network model LSTM with learnable temporal features is used to achieve dual representation fusion and result prediction. The first layer of the LSTM network in the LSTM model combines the semantic features of the assembly code segment and the long-span data dependency features to obtain the high-dimensional feature vector of the objective function. The second layer of the LSTM network in the LSTM model obtains the result of predicting malicious software behavior based on the function execution order and the high-dimensional features of the objective function.

[0062] To integrate assembly code semantic representation and function dependency graph representation, the assembly code semantic representation and function call graph representation are concatenated and connected into a single feature vector. An LSTM model is then used to iteratively learn the concatenated feature vector. In the LSTM model, the first layer of the LSTM network reconstructs the concatenated feature vector into a latent variable containing complete data dependencies. The second layer of the LSTM network iteratively updates the latent variable according to the labeled function call order, resulting in the malicious code detection result.

[0063] Example 2: The technical solution of the second technical subject of this invention: an IoT malicious code detection system based on dual representation fusion embedding, characterized in that it executes the above-mentioned IoT malicious code detection method based on dual representation fusion embedding, the IoT malicious code detection system based on dual representation fusion embedding includes: a dynamic analysis module, a module for obtaining semantic features of assembly code segments, a module for obtaining function call graph representations, a dual representation fusion module and a malicious code feature learning module;

[0064] Dynamic Analysis Module: Based on highly reliable instrumentation, dynamic analysis shields the execution and compilation environments from interference with dynamic tracing without affecting the execution efficiency of the software being tested.

[0065] Assembly code segment semantic feature acquisition module: Embed assembly code in the bidirectional encoder Bert model to build a bidirectional encoder CodeBert model adapted to assembly instructions. The semantic features of assembly code segments within functions in the assembly code are obtained through the CodeBert model. The semantic features of assembly code segments are short-span data dependency features.

[0066] Function call graph representation acquisition module: Extracts function call graph structure and node attributes through a message passing neural network model to acquire function call graph representation, which is a long-span data dependency feature;

[0067] Dual Representation Fusion Module: Fuses the semantic features of the assembly code segment with the function call graph representation to form a dual representation fusion;

[0068] Malicious Code Feature Learning Module: Based on dual-representation fusion embedding, this module learns malicious code features to detect malicious code in the Internet of Things (IoT).

[0069] Example 3: The technical solution of the third technical subject of the present invention: a readable medium having a computer program stored thereon, characterized in that the computer program, when executed by a processor, implements the above-mentioned IoT malicious code detection method based on dual representation fusion embedding.

[0070] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Various modifications and variations can be made to the above embodiments. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting malicious code in the Internet of Things based on dual-representation fusion embedding, characterized in that, The steps are as follows: Based on instrumentation dynamic analysis technology, the assembly code for the Internet of Things is obtained; Assembly code is embedded in the bidirectional encoder Bert model to construct the bidirectional encoder CodeBert model adapted to assembly instructions. The semantic features of the assembly code segment within the function in the assembly code are obtained through the CodeBert model. The semantic features of the assembly code segment are short-span data dependency features. The function call graph structure and node attributes are extracted using the message passing neural network model GAT to obtain the function call graph representation, which is a long-span data dependency feature; The semantic features of the assembly code segment are fused with the function call graph representation to form a dual representation fusion. Malicious code is identified based on the dual representation fusion and used to learn malicious code features to detect IoT malicious code. The CodeBert model is constructed by fine-tuning the Token type in the bidirectional encoder model BERT. The CodeBert model is used to learn the data flow characteristics within instructions and the data dependency characteristics between instructions in functions. The data flow within instructions describes the memory data processing flow in a fine-grained manner, and the data dependency between instructions describes the key function logic in the form of local code. The operands of instructions are divided into data type operands and address type operands through a type model, and a token type is added to the operands.

2. The IoT malware detection method based on dual-representation fusion embedding according to claim 1, characterized in that, Dynamic instrumentation analysis is used to insert callback functions at function calls and function returns, obtain the instructions at the instrumentation location and the instruction information before and after the instrumentation location, obtain the boundary of each function, and make the boundary of each function clear through function calls and function returns, so as to prevent dynamic tracking loss during function calls and jump pointers.

3. The IoT malware detection method based on dual-representation fusion embedding according to claim 2, characterized in that, In data type operands, constant tokens are marked as "[constant]", and in address type operands, immediate tokens are marked as "[immediate]", absolute address tokens are marked as "[ab_addr]", and relative address tokens are marked as "[re_addr]". This is to identify intra-instruction constraints and improve the accuracy of short-span data dependency features.

4. The IoT malware detection method based on dual-representation fusion embedding according to any one of claims 1-3, characterized in that, When acquiring the function call graph representation, graph structure information is fused by modifying the attributes of graph nodes to extract function call relationship features. These features include individual node features and relationships between individual nodes and their neighbors. The relationships between individual nodes and their neighbors are further processed by forming a graph self-attention layer using several stacked blocks and generating attention coefficients to achieve joint learning between nodes. The formula for calculating the attention coefficients is as follows: (1)； Combining the obtained individual node features and the attention coefficients, the neural network model traverses each node feature and performs joint learning to obtain the final node features, i.e., long-span data dependency features. The formula for joint learning of nodes is: (2)； in, This is the weight matrix. Attention coefficient Index the target node. For the label of a single node, , All are adjacent node indexes. , respectively with The labels of adjacent adjacent nodes are used to obtain the attention coefficient of the target node. , For the overall set of nodes.

5. The IoT malware detection method based on dual-representation fusion embedding according to claim 4, characterized in that, The function node attributes are constructed, including node ID (node_id), node feature (node_feature), head node (head_node), tail node (tail_node), and edge feature (edge_feature). The message passing neural network model GAT constructs a graph attention layer by building block layers and stacking block layers. Each node is generated based on the graph structure matrix and neighbor node attributes in the graph attention layer. Independent node features are jointly combined through the multi-head attention mechanism of the GAT model. Node features are randomly sampled from the graph attention layer and combined to obtain the target node features as the long-span data dependency features of the objective function.

6. The IoT malware detection method based on dual-representation fusion embedding according to any one of claims 1-3, characterized in that, After obtaining short-span semantic features and long-span data dependency features, a data structure containing global code features is constructed by concatenation. Then, a network model LSTM with learnable temporal features is used to achieve dual representation fusion and result prediction. The first layer of the LSTM network in the LSTM model combines the semantic features of the assembly code segment and the long-span data dependency features to obtain the high-dimensional feature vector of the objective function. The second layer of the LSTM network in the LSTM model obtains the result of predicting malicious software behavior based on the function execution order and the high-dimensional features of the objective function.

7. The IoT malware detection method based on dual-representation fusion embedding according to claim 6, characterized in that, By concatenating the semantic representation of assembly code and the function call graph representation, a feature vector is constructed and connected. The LSTM model is then used to iteratively learn the connected feature vector. In the LSTM model, the first layer of the LSTM network reconstructs the connected feature vector into a latent variable containing complete data dependencies. The second layer of the LSTM network iteratively updates the latent variable according to the labeled function call order, resulting in the malicious code detection result.

8. An IoT malware detection system based on dual-representation fusion embedding, characterized in that, The method for detecting IoT malicious code based on dual representation fusion embedding according to any one of claims 1-7 is described above. The IoT malicious code detection system based on dual representation fusion embedding includes: a dynamic analysis module, a module for obtaining semantic features of assembly code segments, a module for obtaining function call graph representations, a dual representation fusion module, and a malicious code feature learning module. Dynamic Analysis Module: Based on highly reliable instrumentation, dynamic analysis shields the execution and compilation environments from interference with dynamic tracing without affecting the execution efficiency of the software being tested. Assembly code segment semantic feature acquisition module: Embed assembly code in the bidirectional encoder Bert model to build a bidirectional encoder CodeBert model adapted to assembly instructions. The semantic features of assembly code segments within functions in the assembly code are obtained through the CodeBert model. The semantic features of assembly code segments are short-span data dependency features. Function call graph representation acquisition module: Extracts function call graph structure and node attributes through a message passing neural network model to acquire function call graph representation, which is a long-span data dependency feature; Dual Representation Fusion Module: Fuses the semantic features of the assembly code segment with the function call graph representation to form a dual representation fusion; Malicious Code Feature Learning Module: Based on dual-representation fusion embedding, this module learns malicious code features to detect malicious code in the Internet of Things (IoT).

9. A readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the IoT malicious code detection method based on dual-representation fusion embedding as described in any one of claims 1-7.

Images