A malware detection method, device, equipment and product

Abstract

The application discloses a malware detection method, device, equipment and product, and relates to the technical field of network security, and the method comprises the following steps: acquiring a family label of to-be-detected malware; performing similarity analysis processing on the application programming interface group operation frequency of the to-be-detected malware, obtaining the similarity between various application programming interface operations, and determining the similarity feature of the to-be-detected malware based on the similarity; performing folder path operation analysis processing on the to-be-detected malware, obtaining the folder operation frequency feature of the to-be-detected malware; performing feature fusion on the condensed distance feature and the operation frequency feature, obtaining a fusion feature; and determining the category of the to-be-detected malware based on the fusion feature. The application can more effectively detect the category of the malware, improves the detection accuracy, and thus better understands the features of the malware, and facilitates maintenance personnel to take more effective security measures.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a method, apparatus, device, and product for detecting malicious software. Background Technology

[0002] In the field of machine learning-based malware classification, a number of high-precision and high-efficiency classification algorithms have been proposed. However, existing classification algorithms have difficulty extracting the feature data of malware and cannot fully reflect the behavioral characteristics of malware families. Therefore, how to accurately classify malware is an important issue that the industry urgently needs to solve. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a method, apparatus, device and product for detecting malware, thereby solving the problems in the prior art of difficulty in extracting the feature data of malware and the inability to fully reflect the behavioral characteristics of malware families.

[0004] According to a first aspect, embodiments of the present invention provide a method for detecting malicious software, the method comprising:

[0005] Obtain the family tag of the malware to be detected;

[0006] The similarity analysis of the operation frequency between groups of application programming interfaces (APIs) of malware to be detected is performed to obtain the similarity between each API operation, and the similarity features of the malware to be detected are determined based on the similarity.

[0007] The folder path operation analysis of the malware to be detected is performed to obtain the folder operation frequency characteristics of the malware.

[0008] The concentration distance feature and the operation frequency feature are fused to obtain the fused feature;

[0009] The category of malware to be detected is determined based on fusion features.

[0010] In conjunction with the first aspect, in the first embodiment of the first aspect, obtaining the family tag of the malware to be detected specifically includes:

[0011] Obtain an analysis report of the malware to be detected;

[0012] Extract the family tags of the malware to be detected from the analysis report.

[0013] In conjunction with the first aspect, in the second embodiment of the first aspect, the step of performing similarity analysis on the frequency of operations between groups of application programming interfaces (APIs) of the malware to be detected, obtaining the similarity between each API operation, and determining the similarity features of the malware to be detected based on the similarity, specifically includes:

[0014] The frequency of application programming interface operations of the malware to be detected is analyzed to obtain the call frequency of each application programming operation.

[0015] The similarity between various application programming operations is obtained, resulting in a similarity matrix between the various application programming operations. The similarity matrix is ​​then converted into a condensed distance feature, which is the condensed distance matrix obtained after the conversion.

[0016] In conjunction with the first aspect, in the third embodiment of the first aspect, the step of performing folder path operation analysis on the malware to be detected to obtain the folder operation frequency characteristics of the malware to be detected specifically includes:

[0017] Obtain the folder paths where the malware to be detected has been manipulated;

[0018] The frequency of operations on folder paths manipulated by the malware to be detected is statistically analyzed, and folder operation frequency features are generated based on the operation frequency.

[0019] In conjunction with the first aspect, in the fourth embodiment of the first aspect, in determining the category of malware to be detected based on fusion features, the category is obtained through a trained malware detection model.

[0020] In conjunction with the fourth embodiment of the first aspect, in the fifth embodiment of the first aspect, the input data of the malware detection model includes the fusion features and family tags of the malware to be detected; the malware detection model is obtained by training based on samples, the corresponding fusion features and family tags of the samples, and a supervised machine learning approach.

[0021] In conjunction with the fifth embodiment of the first aspect, in the sixth embodiment of the first aspect, the training process of the malware detection model includes:

[0022] The operation frequency characteristics of the malware to be detected are obtained, and the condensed distance characteristics and operation frequency characteristics are fused to obtain the fused characteristics.

[0023] Extract the family tags of the malware to be detected;

[0024] The fused features are used as input data for training, and family labels are used as training labels for the fused features. The model is trained using supervised machine learning to obtain a malware detection model that outputs the category of the malware to be detected.

[0025] According to a second aspect, embodiments of the present invention also provide a malware detection device, the device comprising:

[0026] The tag extraction module is used to obtain the family tags of the malware to be detected;

[0027] The first analysis module is used to perform similarity analysis on the frequency of operations between application programming interface groups of malware to be detected, obtain the similarity between each application programming interface operation, and determine the similarity features of malware to be detected based on the similarity.

[0028] The second analysis module is used to analyze and process the folder path operations of the malware to be detected, and obtain the folder operation frequency characteristics of the malware to be detected.

[0029] The feature fusion module is used to fuse the condensation distance feature and the operation frequency feature to obtain the fused feature.

[0030] The category detection module is used to determine the category of malware to be detected based on fused features.

[0031] According to a third aspect, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the malware detection methods described above.

[0032] According to a third aspect, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the malware detection methods described above.

[0033] According to a fourth aspect, embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the malware detection method as described in any of the preceding claims.

[0034] The malware detection method, apparatus, device, and product of this invention perform similarity analysis of API group operation frequencies of the malware to be detected to obtain similarity features. Then, it performs folder path operation analysis to obtain folder operation frequency features. Finally, it fuses the condensed distance feature and the operation frequency feature to obtain fused features. Since the similarity between API groups reflects the behavioral patterns of malware families (i.e., the condensed distance feature better reflects the behavioral patterns of the malware to be detected), and the folder path operation frequency reflects the representative behavior of malware families (i.e., the folder operation frequency feature better reflects the representative behavior of the malware to be detected), the fused features can more accurately reflect the behavioral characteristics of the malware family to be detected. Therefore, using these fused features to determine the category of the malware to be detected is more accurate and effective, improving detection accuracy and leading to a better understanding of malware characteristics, attacker behavior, and motivations, thus facilitating maintenance personnel to take more effective security measures. Attached Figure Description

[0035] The features and advantages of the invention will be more clearly understood by referring to the accompanying drawings, which are schematic and should not be construed as limiting the invention in any way. In the drawings:

[0036] Figure 1 A flowchart illustrating the malware detection method provided by this invention is shown.

[0037] Figure 2 The diagram illustrates the specific flow of step S10 in the malware detection method provided by the present invention.

[0038] Figure 3 The diagram illustrates the specific flow of step S20 in the malware detection method provided by the present invention.

[0039] Figure 4 The diagram illustrates the specific flow of step S30 in the malware detection method provided by the present invention.

[0040] Figure 5 This diagram illustrates the training process of the malware detection model in the malware detection method provided by the present invention.

[0041] Figure 6 A schematic diagram of the structure of the malware detection device provided by the present invention is shown;

[0042] Figure 7 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] In the field of machine learning-based malware classification, various high-precision and high-efficiency classification algorithms have been proposed. However, existing classification algorithms struggle with extracting sufficient features from malware and cannot fully reflect the behavioral characteristics of malware families. For example:

[0045] In the opcode-based malware family classification, it is difficult to extract opcodes that truly reflect behavioral characteristics due to the influence of packing and code obfuscation. In the network traffic-based malware family classification, the interception of communication traffic and the fact that some malware will not execute when no network communication is detected will increase the difficulty of extracting the network communication content of malware.

[0046] Therefore, accurately classifying malware is a crucial issue that the industry urgently needs to address.

[0047] To address the aforementioned issues, this specification provides a method for detecting malware, designed to more effectively identify malware categories. This malware detection method can be applied to electronic devices with suspicious file analysis capabilities. These electronic devices may include laptops, desktop computers, smartphones, smart wearable devices (virtual reality glasses, smartwatches, etc.), tablets, etc. Of course, the malware detection method provided in this specification can also be applied to applications running on the aforementioned electronic devices. For example, this malware detection method can be applied to browsers with suspicious file analysis capabilities, or to suspicious file processing software. Figure 1 This is a flowchart illustrating a malware detection method according to an embodiment of the present invention, such as... Figure 1 As shown, the method may include the following steps:

[0048] S10. Obtain the family tag of the malware to be detected. The family tag is used to subsequently determine the category of the malware to be detected.

[0049] S20. Perform similarity analysis on the frequency of operations between groups of application programming interfaces (APIs) to obtain the similarity between the operations of each API, and determine the similarity features of the malware to be detected based on the similarity.

[0050] S30. Perform folder path operation analysis on the malware to be detected to obtain the folder operation frequency characteristics of the malware to be detected.

[0051] S40. Perform feature fusion on the concentration distance feature and the operation frequency feature to obtain the fused feature.

[0052] Since the similarity between API groups can reflect the behavioral patterns of malware families, i.e., the condensed distance feature can better reflect the behavioral patterns of the malware to be detected, and the frequency of folder path operations can reflect the representative behavior of malware families, i.e., the frequency of folder operations can better reflect the representative behavior of the malware to be detected, the fused feature obtained by feature fusion based on the condensed distance feature and the operation frequency feature can more accurately reflect the behavioral characteristics of the malware family to be detected.

[0053] S50. Determine the category of the malware to be detected based on the fusion features obtained from the above fusion.

[0054] In this embodiment, the category of malware to be detected can be determined by a trained malware detection model. The malware detection model is used to classify the malware to be detected and output the category corresponding to the malware.

[0055] Malware detection models use machine learning classifiers Examples include support vector machine classifiers, random forest classifiers, and Bayesian-based classifiers. This malware detection model is based on samples, their corresponding fusion features, and family labels, and is trained using supervised machine learning.

[0056] The malware detection method of this invention performs API group operation frequency similarity analysis on the malware to be detected to obtain similarity features. Then, it performs folder path operation analysis on the malware to obtain folder operation frequency features. Finally, it fuses the condensed distance feature and the operation frequency feature to obtain a fused feature. Since API group similarity reflects the behavioral patterns of malware families (i.e., condensed distance feature better reflects the behavioral patterns of the malware to be detected), and folder path operation frequency reflects the representative behavior of malware families (i.e., folder operation frequency feature better reflects the representative behavior of the malware to be detected), the fused feature can more accurately reflect the behavioral characteristics of the malware family to be detected. Using this fused feature to determine the category of the malware to be detected is more accurate and effective, improving detection accuracy and providing a better understanding of malware characteristics, attacker behavior, and motivations, thus facilitating maintenance personnel to take more effective security measures.

[0057] The following is combined Figure 2 The method for detecting malware according to the present invention, step S10 specifically includes:

[0058] S11. Obtain the analysis report of the malware to be detected, for example, obtain the analysis report of the malware to be detected from VirusTotal. The analysis report may contain the analysis results of up to 70 antivirus engines.

[0059] S12. Use a tag extraction tool such as Avclass to extract the family tags (Ground Truth) of the malware to be detected from the analysis report, thereby obtaining the family tag vector of the malware to be detected. .

[0060] The following is combined Figure 3 The method for detecting malware according to the present invention, step S20 specifically includes:

[0061] S21. Analyze the frequency of application programming interface operations of the malware to be detected to obtain the call frequency of each application programming operation.

[0062] Using tools such as Cuckoo Sandbox, dynamic analysis is performed on the malware to be detected, and the malware to be detected is collected in the API group. The frequency of API operations within each subgroup, where each subgroup is equivalent to one API operation.

[0063] Specifically, the API group There are five subgroups, namely the file operation API group. Encryption Operation API Group Registry operation API group Communication Operation API Group as well as ,Right now:

[0064]

[0065] S22. Obtain the similarity between each application programming operation, obtain the similarity matrix between each application programming operation, and convert the similarity matrix into condensed distance features. The similarity features are the condensed distance matrix obtained after conversion.

[0066] Then, use the similarity calculation function. Calculate the similarity between each subgroup in API group G to obtain the API group similarity matrix of the malware to be detected. ,in All represent API groups API subgroups.

[0067] Then use the condensed matrix calculation function number Transform the above similarity matrix This is a condensed distance matrix, which allows us to obtain the condensed distance matrix of the malware to be detected. , This indicates malware to be detected.

[0068] The following is combined Figure 4 The method for detecting malware according to the present invention, step S30 specifically includes:

[0069] S31. Obtain the folder path where the malware to be detected has been manipulated.

[0070] Using tools like Cuckoo Sandbox, the malware to be detected is dynamically analyzed, collecting a set of folder paths it has opened, copied, written to, read from, and deleted. .

[0071] In this embodiment, the folder containing the file that has been manipulated by malware is also the target of the folder operation path frequency statistics. That is, the file name is removed from the file path string, and only the path of the folder containing the file is retained.

[0072] S32. Calculate the frequency of operation on folder paths operated by the malware to be detected, and generate folder operation frequency features based on the operation frequency. The folder operation frequency features are the folder operation frequency matrix.

[0073] Calculate the above set of folder paths For each folder path, calculate the operation frequency for each operation type to obtain a folder operation frequency vector, i.e.:

[0074]

[0075] in, This indicates the opening operation of the malware to be detected; This indicates the copying operation of the malware to be detected; This indicates a write operation by the malware to be detected; This indicates a read operation to detect malware; This indicates the deletion operation for the malware to be detected. Of course, the operation types for folder paths are not limited to the five types mentioned above; the number of operation types can be reduced according to specific scenario requirements.

[0076] Then obtain the folder operation frequency matrix for the malware to be detected, namely:

[0077]

[0078] The following is combined Figure 5 The present invention describes a method for detecting malware, wherein the malware detection model is trained in the following manner:

[0079] Obtaining samples Analysis reports, such as those obtained from VirusTotal, of the aforementioned samples. The analysis report, and then the sample The analysis results.

[0080] Then use a label extraction tool such as Avclass to extract samples from the analysis report. The family tag (Ground Truth) is used to obtain all samples. Family tag collection and family tag vectors .

[0081] Understandably, the sample set All samples These are all sample malware, which can collect various malware as sample data to provide massive data support for subsequent training.

[0082] The sample malware can be pre-stored on the electronic device or obtained by the electronic device from an external source. There are no restrictions on the specific method of obtaining the sample malware, as long as the electronic device can access the sample. That's all.

[0083] For a certain sample Using tools such as Cuckoo Sandbox to test samples Perform dynamic analysis and collect API data. The frequency of API calls within each subgroup.

[0084] Then, use the similarity calculation function. Calculate the similarity between the subgroups in API group G to obtain the samples. API group similarity matrix ,in All represent API groups API subgroups.

[0085] Then use the condensed matrix calculation function Transform the above similarity matrix The condensed distance matrix is:

[0086]

[0087] In this way, we can obtain the sample set. All samples The condensed distance matrix, i.e. , Indicates sample The total number.

[0088] For a certain sample The samples were processed using tools such as Cuckoo Sandbox. Perform dynamic analysis to collect the folder paths that it has opened, copied, written to, read, and deleted. That is, sample The file contains all the folder paths that have been manipulated, and all the folder paths that have been manipulated in all samples are merged into one. .

[0089] Similarly, the folder containing files manipulated by malware is also the target of folder operation path frequency statistics, which involves removing the filename from the file's path string and keeping only the path of the folder containing the file.

[0090] And for each sample Count the above set of folder paths For each folder path, calculate the operation frequency for each operation type to obtain a folder operation frequency vector, i.e.:

[0091]

[0092] in, Indicates sample The open operation; Indicates sample Copy operation; Indicates sample Write operations; Indicates sample Read operations; Indicates sample The deletion operation. Of course, the operation types for folder paths are not limited to the five types mentioned above; the number of operation types can be reduced according to specific scenario requirements.

[0093] Therefore, it is also possible to obtain data for the sample set. All samples The folder operation frequency matrix, namely:

[0094]

[0095] In this embodiment, feature fusion refers to the fusion of sample sets. All samples Condensed distance matrix With sample set All samples Folder operation frequency matrix Feature fusion is performed to obtain fused features. The corresponding fused features are:

[0096]

[0097] Number of features

[0098] Malware detection models use machine learning classifiers Examples include support vector machine classifiers, random forest classifiers, and Bayesian-based classifiers. The data used for training includes: fused features and family tag vector Then, supervised machine learning was used to refine the machine learning classifier based on 10-fold cross-validation. Perform parameter optimization until the optimal parameter set is found. .

[0099] Train a malware detection model using the optimal parameter set. The malware to be detected is classified into families, and predicted labels for the malware are obtained. ,Right now:

[0100]

[0101] Specifically, the malware model first obtains the fusion features of the malware to be detected, then obtains the family labels of the malware to be detected, and then uses the fusion features as input data for training and the family labels as training labels for the fusion features, and uses supervised machine learning to train.

[0102] The malware detection device provided in the embodiments of the present invention will be described below. The malware detection device described below can be referred to in correspondence with the malware detection method described above.

[0103] To address the aforementioned issues, this specification provides a malware detection device designed to obtain a more accurate and realistic resistance value. Figure 6 This is a schematic diagram of the structure of a malware detection device according to an embodiment of the present invention, such as... Figure 6 As shown, the device may include:

[0104] The tag extraction module 10 is used to obtain the family tags of the malware to be detected. The family tags are used to subsequently determine the category of the malware to be detected.

[0105] The first analysis module 20 is used to perform similarity analysis on the frequency of operations between groups of application programming interfaces of the malware to be detected, obtain the similarity between each API operation, and determine the similarity features of the malware to be detected based on the similarity.

[0106] The second analysis module 30 is used to perform folder path operation analysis on the malware to be detected, and obtain the folder operation frequency characteristics of the malware to be detected.

[0107] The feature fusion module 40 is used to fuse the condensation distance feature and the operation frequency feature to obtain the fused feature.

[0108] Since the similarity between API groups can reflect the behavioral patterns of malware families, i.e., the condensed distance feature can better reflect the behavioral patterns of the malware to be detected, and the frequency of folder path operations can reflect the representative behavior of malware families, i.e., the frequency of folder operations can better reflect the representative behavior of the malware to be detected, the fused feature obtained by feature fusion based on the condensed distance feature and the operation frequency feature can more accurately reflect the behavioral characteristics of the malware family to be detected.

[0109] The category detection module 50 is used to determine the category of the malware to be detected based on the fusion features obtained by the above fusion.

[0110] In this embodiment, the category of malware to be detected can be determined by a trained malware detection model. The malware detection model is used to classify the malware to be detected and output the category corresponding to the malware.

[0111] Malware detection models use machine learning classifiers Examples include support vector machine classifiers, random forest classifiers, and Bayesian-based classifiers. This malware detection model is based on samples, their corresponding fusion features, and family labels, and is trained using supervised machine learning.

[0112] The malware detection device of this invention performs API group operation frequency similarity analysis on the malware to be detected to obtain similarity features. Then, it performs folder path operation analysis on the malware to obtain folder operation frequency features. Finally, it fuses the condensed distance feature and the operation frequency feature to obtain a fused feature. Since API group similarity reflects the behavioral patterns of malware families (i.e., condensed distance feature better reflects the behavioral patterns of the malware to be detected), and folder path operation frequency reflects the representative behavior of malware families (i.e., folder operation frequency feature better reflects the representative behavior of the malware to be detected), the fused feature can more accurately reflect the behavioral characteristics of the malware family to be detected. Therefore, using this fused feature to determine the category of the malware to be detected is more accurate and effective, improving detection accuracy and leading to a better understanding of malware characteristics, attacker behavior, and motivations. This facilitates maintenance personnel in taking more effective security measures.

[0113] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7 As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 communicate with each other via the communication bus 740. The processor 710 can invoke logical commands stored in the memory 730 to execute a malware detection method, which includes:

[0114] Obtain the family tag of the malware to be detected;

[0115] The similarity analysis of the operation frequency between groups of application programming interfaces (APIs) of malware to be detected is performed to obtain the similarity between each API operation, and the similarity features of the malware to be detected are determined based on the similarity.

[0116] The folder path operation analysis of the malware to be detected is performed to obtain the folder operation frequency characteristics of the malware.

[0117] The concentration distance feature and the operation frequency feature are fused to obtain the fused feature;

[0118] The category of malware to be detected is determined based on fusion features.

[0119] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0120] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, wherein when the program instructions are executed by a computer, the computer is capable of executing the malware detection method provided by the above methods, the method comprising:

[0121] Obtain the family tag of the malware to be detected;

[0122] The similarity analysis of the operation frequency between groups of application programming interfaces (APIs) of malware to be detected is performed to obtain the similarity between each API operation, and the similarity features of the malware to be detected are determined based on the similarity.

[0123] The folder path operation analysis of the malware to be detected is performed to obtain the folder operation frequency characteristics of the malware.

[0124] The concentration distance feature and the operation frequency feature are fused to obtain the fused feature;

[0125] The category of malware to be detected is determined based on fusion features.

[0126] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the aforementioned methods for detecting malicious software, the methods comprising:

[0127] Obtain the family tag of the malware to be detected;

[0128] The similarity analysis of the operation frequency between groups of application programming interfaces (APIs) of malware to be detected is performed to obtain the similarity between each API operation, and the similarity features of the malware to be detected are determined based on the similarity.

[0129] The folder path operation analysis of the malware to be detected is performed to obtain the folder operation frequency characteristics of the malware.

[0130] The concentration distance feature and the operation frequency feature are fused to obtain the fused feature;

[0131] The category of malware to be detected is determined based on fusion features.

[0132] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0133] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0134] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting malicious software, characterized in that, The method includes: Obtain the family tag of the malware to be detected; The similarity analysis of the operation frequency between groups of application programming interfaces (APIs) of malware to be detected is performed to obtain the similarity between each API operation, and the similarity features of the malware to be detected are determined based on the similarity. The folder path operation analysis of the malware to be detected is performed to obtain the folder operation frequency characteristics of the malware. The concentration distance feature and the operation frequency feature are fused to obtain the fused feature; The category of malware to be detected is determined based on fusion features; In the process of determining the category of malware to be detected based on fusion features, the category is obtained through a trained malware detection model; The input data of the malware detection model includes the fusion features and family labels of the malware to be detected; the malware detection model is obtained by training based on samples, the corresponding fusion features and family labels of the samples, and a supervised machine learning approach. The process involves performing similarity analysis on the frequency of operations between application programming interface (API) groups of the malware to be detected, obtaining the similarity between each API operation, and determining the similarity features of the malware to be detected based on the similarity, specifically including: The frequency of application programming interface operations of the malware to be detected is analyzed to obtain the call frequency of each application programming operation. Obtain the similarity between various application programming operations to obtain the similarity matrix between various application programming operations, and convert the similarity matrix into condensed distance features. The similarity features are the condensed distance matrix obtained after the conversion. The similarity between various application programming operations is obtained, resulting in a similarity matrix. This similarity matrix is ​​then converted into condensed distance features, which are the condensed distance matrix obtained after the conversion. Specifically, these features include: The similarity between the subgroups in the application programming interface group is calculated using a similarity calculation function to obtain the similarity matrix between the application programming operations of the malware to be detected. The malware to be detected has several subgroups in the application programming interface group, and each subgroup is equivalent to an application programming operation. The similarity matrix is ​​converted into a condensed distance matrix using the condensed matrix calculation function.

2. The method for detecting malicious software according to claim 1, characterized in that, The acquisition of the family tag of the malware to be detected specifically includes: Obtain an analysis report of the malware to be detected; Extract the family tags of the malware to be detected from the analysis report.

3. The method for detecting malicious software according to claim 1, characterized in that, The process of analyzing folder path operations on the malware to be detected to obtain the frequency characteristics of folder operations of the malware specifically includes: Obtain the folder paths where the malware to be detected has been manipulated; The frequency of operations on folder paths manipulated by the malware to be detected is statistically analyzed, and folder operation frequency features are generated based on the operation frequency.

4. The method for detecting malicious software according to claim 1, characterized in that, The training process of the malware detection model includes: The operation frequency characteristics of the malware to be detected are obtained, and the condensed distance characteristics and operation frequency characteristics are fused to obtain the fused characteristics. Extract the family tags of the malware to be detected; The fused features are used as input data for training, and family labels are used as training labels for the fused features. The model is trained using supervised machine learning to obtain a malware detection model that outputs the category of the malware to be detected.

5. A malware detection device, characterized in that, The device includes: The tag extraction module is used to obtain the family tags of the malware to be detected; The first analysis module is used to perform similarity analysis on the frequency of operations between application programming interface groups of malware to be detected, obtain the similarity between each application programming interface operation, and determine the similarity features of malware to be detected based on the similarity. The second analysis module is used to analyze and process the folder path operations of the malware to be detected, and obtain the folder operation frequency characteristics of the malware to be detected. The feature fusion module is used to fuse the condensation distance feature and the operation frequency feature to obtain the fused feature. The category detection module is used to determine the category of malware to be detected based on fused features; In the category detection module, the category is obtained through a trained malware detection model; The input data of the malware detection model includes the fusion features and family labels of the malware to be detected; the malware detection model is obtained by training based on samples, the corresponding fusion features and family labels of the samples, and a supervised machine learning approach. The first analysis module specifically includes: The frequency of application programming interface operations of the malware to be detected is analyzed to obtain the call frequency of each application programming operation. Obtain the similarity between various application programming operations to obtain the similarity matrix between various application programming operations, and convert the similarity matrix into condensed distance features. The similarity features are the condensed distance matrix obtained after the conversion. The similarity between various application programming operations is obtained, resulting in a similarity matrix. This similarity matrix is ​​then converted into condensed distance features, which are the condensed distance matrix obtained after the conversion. Specifically, these features include: The similarity between the subgroups in the application programming interface group is calculated using a similarity calculation function to obtain the similarity matrix between the application programming operations of the malware to be detected. The malware to be detected has several subgroups in the application programming interface group, and each subgroup is equivalent to an application programming operation. The similarity matrix is ​​converted into a condensed distance matrix using the condensed matrix calculation function.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the malware detection method as described in any one of claims 1 to 4.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the malware detection method as described in any one of claims 1 to 4.

Images