A botnet threat hunting system based on binary code automated analysis

Abstract

The application discloses a botnet threat hunting system based on binary code automatic analysis, relates to the network field, and comprises a real-time capturing subsystem and an intelligent analysis subsystem, which realize real-time capturing of samples and intelligent analysis of C&C servers respectively. The application successfully constructs corresponding pseudo Bot through the captured malicious samples, successfully accesses the C&C server, receives corresponding attack information, and successfully realizes a high-precision and high-efficiency botnet threat detection system.

Description

Technical Field

[0001] This invention relates to the field of networking, and more particularly to a botnet threat hunting system based on automated binary code analysis. Background Technology

[0002] A botnet is a network of infected computers or devices that are remotely controlled without authorization and are typically used to carry out malicious activities such as distributed denial-of-service (DDoS) attacks, spam distribution, and malware dissemination. In recent years, with the rapid development of wireless technology, the number of various IoT devices has been increasing. However, these devices often lack effective security protection measures, providing hackers with opportunities for intrusion. Once devices are infected, hackers can remotely control them and integrate them into a large-scale botnet to carry out various malicious activities. A botnet constructs a massive attack network that attackers can use to conduct numerous malicious acts. The most common attack method is using a botnet to launch a DDoS attack. Because botnets have a one-to-many structure, one C&C server can control multiple infected devices. Once a large-scale botnet is formed, attackers can simultaneously command thousands of devices to launch DDoS attacks against the same target. This attack method can not only paralyze the target website but also cause economic losses and reputational damage, putting enormous pressure on the victim.

[0003] Current botnet detection technologies primarily utilize methods based on inbound / outbound degree anomalies, scanning events, network flow correlation based on malicious activity, flow metric anomalies, and the periodicity of command and control channel traffic. While these methods can effectively detect botnets, they suffer from high false positive rates and low efficiency. Because these detection methods still rely on a relatively low level of environmental awareness, they are essentially similar to intrusion detection systems (IDS), leaving network administrators facing a massive amount of information, making the identification of valuable information a significant challenge. To address this issue, we can analyze malicious samples from botnets to obtain more precise information such as IOC addresses, attack methods, and target information, thereby improving the accuracy and efficiency of botnet threat detection.

[0004] To capture malicious samples from botnets, honeypot technology is required. A honeypot is a closely monitored network decoy used to attract attackers, thereby capturing important system data, including attack commands and malicious samples. The data captured by honeypots effectively reduces the tedium of log analysis and avoids the lag in signature analysis, offering significant advantages in capturing timely and innovative samples. Depending on their interactivity, honeypots have different security features. Some can present attackers with simulations of various systems and their services, providing extremely high security, while others can significantly reduce the pursuit of security, creating a realistic operating system to obtain more information. To balance security and information acquisition, the interactivity of existing honeypots needs to be modified to meet the requirements for capturing malicious samples from botnets.

[0005] For captured samples, sample analysis is necessary to obtain information. Currently, research on botnet malicious samples typically employs two methods: reverse engineering and traffic analysis. However, traffic analysis often requires running a sandbox to generate traffic files for analysis, which consumes significant time and memory resources. Therefore, reverse engineering of botnet malicious samples is commonly used to obtain potentially differentiated information such as communication methods, IOCs, and attack functions. For reverse engineering of malicious samples, static analysis tools are commonly used, including IDA Pro and Ghidra. IDA Pro is a relatively mainstream choice. IDA Pro is a commonly used static reverse engineering tool developed by Hex-Ray. Using IDA Pro to reverse engineer botnet malicious samples can accurately extract C&C server addresses, communication protocols, and specific information about attack functions. However, current methods typically involve manual analysis of a subset of typical samples, which is inefficient and cannot meet the needs of large-scale sample analysis. Therefore, it is necessary to design algorithms to automate reverse engineering and achieve automatic sample analysis.

[0006] To achieve preliminary classification of malicious samples captured by honeypots and identification of attack functions, similarity analysis of binary files is required. Traditional binary similarity analysis is usually based on sequence matching or graph matching, such as binary code similarity comparison based on Jaccard coefficients. However, binary code loses a lot of semantic information during compilation. Furthermore, even with the same source code, binary files under different compilation options and architectures can differ significantly. Code obfuscation further complicates binary code similarity comparison, making traditional sequence matching-based binary similarity analysis insufficient. Newer binary code similarity comparison methods are mainly based on machine learning. Currently, mainstream feature extraction methods include those based on code sequence features (such as extracting features from raw characters or assembly instructions) or graph features (such as analysis methods based on control flow graphs (CFG)). Compared to code sequence features, graph features, while reflecting semantic features, also contain information such as code structure, making them more suitable as training features for machine learning. Summary of the Invention

[0007] In view of the above-mentioned deficiencies of the prior art, the technical problem to be solved by the present invention is how to develop a high-precision and high-efficiency botnet detection system.

[0008] To achieve the above objectives, the present invention provides a botnet threat hunting system based on automated binary code analysis, characterized in that it includes a real-time capture subsystem and an intelligent analysis subsystem, which respectively realize the real-time capture of samples and the intelligent analysis of C&C servers.

[0009] Furthermore, the operation of the botnet threat hunting system based on automated binary code analysis includes the following steps:

[0010] Step S1: Honeypot design and deployment, including honeypot selection and deployment, and preliminary classification and processing of captured data;

[0011] Step S2: Perform automated reverse processing on the captured samples to extract important information such as IOC, Token, and communication functions;

[0012] Step S3: Classify attack functions;

[0013] Step S4: Pseudo-Bot construction and integration.

[0014] Furthermore, step S1 also includes:

[0015] Step S1.1: Considering that the honeypot needs to allow attackers to upload malicious samples, but cannot actually become an infected botnet, we chose to add a preliminary classification function based on the Jaccard coefficient to the Cowrie honeypot framework; finally, we selected a Linux device, completed the honeypot deployment through a Docker container, and started capturing malicious samples.

[0016] Step S1.2: Convert the captured malicious samples and files in the known sample library into byte sequences, and divide them into blocks of fixed size. The size of each block is chosen to be 4, which can ensure that the files are divided into sufficiently small parts for comparison, and reduce the computational complexity. By choosing a smaller block size, the features in the files can be captured more meticulously, and the accuracy of similarity analysis can be improved.

[0017] Step S1.3: Add the blocks generated from the files to be compared to different sets to obtain the block set of the file. By calculating the Jaccard similarity coefficient of this file block set, we obtain the similarity of the files to be compared.

[0018] Step S1.4: By comparing the similarity scores, the system will rename the sample with the family name that has the highest similarity score.

[0019] Furthermore, step S2 also includes:

[0020] Step S2.1: Use UPX to automatically unpack the samples;

[0021] Step S2.2: Run the automated analysis script on the unpacked malicious sample;

[0022] Step S2.3: Subsequently, by traversing the functions, check if there are any functions with more than four XOR operations to determine whether the malicious sample has encrypted the IOC;

[0023] Step S2.4: Since the malicious sample needs to pass the IOC address as a parameter when initiating a connect request with the C&C server, the `resolve_cnc_addr` function can be located through the system function `connect`. Then, the string and direct number are extracted from the `resolve_cnc_addr` function. By checking whether the same number is operated on twice in the function, it is determined whether the IOC is encrypted. If it is encrypted, the encryption function located in S2.3 is used for decryption. Next, the number of bytes in the decrypted data is used to determine whether the data is an IP address or a port. A port is an integer less than 65535, which is 2 bytes, while an IP address is 4 bytes. If it is a domain name, it will be more bytes. Finally, it is stored in the database, completing the IOC extraction.

[0024] Step S2.5: Continue to use the system function sys_sendto to locate the token. By reading the parameters of the sys_sendto function, the token length and token memory offset can be obtained. By combining the length and offset, the information of the length corresponding to the address in the sample can be read to extract the token.

[0025] Step S2.6: Finally, verify the accuracy of automated extraction.

[0026] Furthermore, in step S2.1, firstly, the UPX features of the sample are detected to determine whether it is packed. If no UPX features are detected, it means that the sample is not packed. If UPX features are detected, the sample UPX header and p_info are further checked for corruption. If they are corrupted, they are repaired by p_filesize at the end of the file. Finally, the unpacking operation is performed.

[0027] Furthermore, step S2.2 also includes:

[0028] Step 2.2.1: First, by searching for features that consist of only one basic block and call the same function multiple times, the attack_init function of the malicious sample is located, which is the function that initializes all attack functions of the malicious sample;

[0029] Step 2.2.2: Obtain the operands of each mov operator within the function. The obtained operands are the addresses of the attack function.

[0030] Furthermore, in step S2.4, the number of decryption operations is used to determine whether the IOC is encrypted. If it is encrypted, there must be a pair of encryption and decryption processes, so there are two operations. In step 2.5, the malicious sample uses the sys_sendto function to send Token information to the C&C server. The Token is passed to the function as a parameter, thereby realizing the location of the Token.

[0031] Furthermore, step S3 also includes:

[0032] Step S3.1: First, use radare2 to extract information such as CPU architecture, compiler, compilation optimization options, function instruction code, function code block and control flow graph corresponding to the attack function. Then, call the get_fuction_cfg function to generate the JSON tag of the function based on the starting address of the attack function.

[0033] Step S3.2: For each instruction of the function in the json tag, first call the __clean function to remove unnecessary parts of the operands, such as size specifiers and redundant characters, to simplify the operands. Apply different normalization methods to the instructions according to different architectures, uniformly replace immediate values ​​and addresses with CONST, and map specific register names to general identifiers. After normalization, count the frequency of each opcode and operand, filter out useless low-frequency items, and then construct the vocab and save it to the file.

[0034] Step S3.3: Transform the CFG of the function into a control flow graph with edge and node features; first normalize each block and instruction ins of the control function flow graph, then use vocab to map the instruction ins, and finally use a Bi-LSTM network to generate a control flow graph with edge and node features.

[0035] Step S3.4: Input the processed control flow graph into the GatedGCN-E network constructed in this project, which is a gated graph convolutional network with node features and edge features, to generate the vector of the attack function; calculate the cosine similarity between the unknown sample attack function vector and the attack function vector in the sample library, and determine the type of unknown sample attack function based on the similarity.

[0036] Furthermore, step S4 also includes:

[0037] Step S4.1: Since the attack command information structure sent by the server corresponding to different zombie samples is often different, the zombie samples also process the attack command information differently; therefore, for each zombie sample, the attack information processing function needs to be fine-tuned based on the pseudo-bot template of its corresponding bot network. A hinting engineering approach is adopted, that is, the large model is guided to modify the constructed bot template based on the sample attack processing function attack_parse() to generate bot code for the sample.

[0038] Step S4.2: Finally, run the generated pseudo-Bot, connect to the C&C server and maintain the connection status, and wait for attack commands.

[0039] Furthermore, the bot sample generation in step S4.1 includes the following steps:

[0040] Step 4.4.1: Upload the basic bot template to the large model (gpt-4o) so that the large model understands the approximate structure of the bot code it needs to generate;

[0041] Step 4.4.2: Tell the large model IDAPro the decompiled code of the communication information processing function exported by IDAPro, so that it can generate the corresponding Python code based on this code, imitating the attack_parse() function in the pseudo-bot template;

[0042] Step 4.4.3: Tell the large model that it needs to replace the attack_parse() function in the pseudo-bot template with this generated Python code, so as to generate bot code for specific samples.

[0043] The present invention has the following technical effects:

[0044] (1) Successfully constructed the corresponding fake bot using the captured malicious samples and successfully connected to the C&C server to receive the corresponding attack information; successfully implemented a high-precision and high-efficiency botnet threat detection system;

[0045] (2) By constructing an automated reverse analysis script, automated reverse analysis of malicious samples of botnets of different families and variants was realized, and the required key information was extracted with high accuracy.

[0046] (3) By introducing the Bi-LSTM model, we transform ordinary control flow graphs into enhanced control flow graphs with node and edge features, improving the comprehensiveness and accuracy of node information processing. Furthermore, we add five linear layers to the traditional gated graph neural network (GNN) to enhance the model's feature representation capabilities. Combining these two approaches forms BiLSTM_GCNE, enabling attack function identification.

[0047] The following will further explain the concept, specific structure, and technical effects of the present invention in conjunction with the accompanying drawings, so as to fully understand the purpose, features, and effects of the present invention. Attached Figure Description

[0048] Figure 1 This is the overall architecture of a preferred embodiment of the present invention. Detailed Implementation

[0049] The following description, with reference to the accompanying drawings, illustrates several preferred embodiments of the present invention to make its technical content clearer and easier to understand. The present invention can be embodied in many different forms, and the scope of protection of the present invention is not limited to the embodiments mentioned herein.

[0050] In the accompanying drawings, components with the same structure are indicated by the same numerical designation, and components with similar structures or functions are indicated by similar numerical designations. The dimensions and thicknesses of each component shown in the drawings are arbitrary, and the present invention does not limit the dimensions and thicknesses of each component. To make the illustrations clearer, the thickness of some components has been appropriately exaggerated in the drawings.

[0051] This invention provides a botnet threat hunting system, the overall architecture of which is as follows: Figure 1 As shown, this system is mainly divided into two subsystems, which respectively realize the real-time capture of samples and the intelligent analysis of C&C servers. Around these two subsystems, we proceed with our work in four steps: honeypot design and deployment, automated reverse engineering script construction, attack function classification, and pseudo-bot construction.

[0052] Step S1: Honeypot design and deployment, including honeypot selection and deployment, and preliminary classification and processing of captured data.

[0053] Step S1.1: Considering that the honeypot needs to allow attackers to upload malicious samples without actually turning it into an infected botnet, we chose to add a preliminary classification function based on the Jaccard coefficient to the Cowrie honeypot framework. Finally, we selected a Linux device, deployed the honeypot using a Docker container, and began capturing malicious samples.

[0054] Step S1.2: Convert the captured malicious samples and files from the known sample library into byte sequences, and divide them into fixed-size blocks. We choose a block size of 4, which ensures that the files are divided into sufficiently small parts for comparison while reducing computational complexity. By choosing a smaller block size, we can capture the features in the files more precisely, improving the accuracy of similarity analysis.

[0055] Step S1.3: Add the blocks generated from the files to be compared to different sets to obtain the file block sets. By calculating the Jaccard similarity coefficient of these file block sets, we obtain the similarity of the files to be compared.

[0056] Step S1.4: By comparing the similarity scores, the system renames the sample to the family name with the highest similarity (e.g., if the sample has the highest similarity to Mirai, it is named Mirai_xx, where xx is the number). In this embodiment, we select four of the most representative families (Mirai, AESDDoS (Dofloo), Prometei, XorDDoS) from the captured families, and extract 100 samples from each family to form the sample set of this embodiment.

[0057] Step S2: The captured samples are automatically reverse-processed to extract important information such as IOC, Token, and communication functions.

[0058] Step S2.1: First, detect the UPX features of the sample to determine if it is packed. If no UPX features are detected, the sample is not packed. If UPX features are detected, further check if the sample's UPX header and p_info are corrupted. If corrupted, repair them using p_filesize at the end of the file. Finally, use UPX to automatically unpack the sample.

[0059] Step S2.2: Run an automated analysis script on the unpacked malicious sample. First, by searching for features that consist of only one basic block and call the same function multiple times, locate the malicious sample's `attack_init` function, which is the function that initializes all attack functions. Then, obtain the operands of each `mov` operator within this function; these operands are the addresses of the attack functions.

[0060] Step S2.3: Subsequently, by traversing the functions, check if there are any functions with more than four XOR operations to determine whether the malicious sample has encrypted the IOC.

[0061] Step S2.4: Then, since the malicious sample needs to pass the IOC address as a parameter when initiating a connect request with the C&C server, the `resolve_cnc_addr` function can be located through the system function `connect`. Subsequently, the string and direct number are extracted from the `resolve_cnc_addr` function. The IOC is determined by checking if the same number is operated on twice within the function (if encrypted, there must be an encryption / decryption process, hence two operations). If encrypted, the encryption function located in S2.3 is used for decryption (XOR encryption re-encrypts the ciphertext, thus achieving decryption). Finally, the number of bytes in the decrypted data determines whether the data is an IP address or a port (a port is an integer less than 65535, 2 bytes; an IP address is 4 bytes; a domain name is even longer), and it is stored in the database, completing the IOC extraction.

[0062] Step S2.5: Continue to use the system function `sys_sendto` to locate the token (the malicious sample uses the `sys_sendto` function to send token information to the C&C server, with the token passed as a parameter to this function). By reading the parameters of the `sys_sendto` function, the token length and token memory offset can be obtained. Combining the length and offset, the information corresponding to the length at the corresponding address in the sample can be read to extract the token.

[0063] Step S2.6: Finally, verify the accuracy of automated extraction.

[0064] Step S3: Classify attack functions.

[0065] Step S3.1: First, use radare2 to extract information such as CPU architecture, compiler, compilation optimization options, function instruction code, function code block and control flow graph corresponding to the attack function. Then, call the get_fuction_cfg function to generate the JSON tag of the function based on the starting address of the attack function.

[0066] Step S3.2: For each instruction in the function within the json tag, first call the __clean function to remove unnecessary parts of the operands, such as size specifiers and redundant characters, to simplify the operands. Apply different normalization methods to the instructions based on different architectures, uniformly replacing immediate values ​​and addresses with CONST, and mapping specific register names to general identifiers. After normalization, we count the frequency of each opcode and operand, filter out useless low-frequency items, and then construct the vocab and save it to a file.

[0067] Step S3.3: Transform the function's CFG into a control flow graph with edge and node features. First, normalize each block and instruction ins of the control function flow graph. Then, use vocab to map the instructions ins. Finally, use a Bi-LSTM network to generate a control flow graph with edge and node features.

[0068] Step S3.4: Input the processed control flow graph into the GatedGCN-E network constructed in this project, which is a gated graph convolutional network with node and edge features, to generate the attack function vector. Calculate the cosine similarity between the unknown sample attack function vector and the attack function vector in the sample library. The type of the unknown sample attack function can be determined based on the similarity level.

[0069] Step S4: Pseudo-Bot Construction and Integration:

[0070] Step S4.1: Since the attack command information structures sent by servers corresponding to different zombie samples often vary, the processing of attack command information by zombie samples also differs. Therefore, for each zombie sample, we need to fine-tune the attack information processing function based on its corresponding botnet pseudo-bot template. We adopted a hinting engineering approach, that is, guiding the large model to modify the constructed bot template based on the sample attack processing function attack_parse() to generate bot code specific to the sample. First, we upload the basic bot template to the large model (gpt-4o) so that it understands the approximate structure of the bot code it needs to generate. Then, we tell it the decompiled code of the communication information processing function exported by IDAPro, so that it can generate the corresponding Python code based on this code, mimicking the attack_parse() function in the pseudo-bot template. Finally, we tell it that it needs to replace the attack_parse() function in the pseudo-bot template with this generated Python code to generate bot code specific to the sample.

[0071] Step S4.2: Finally, run the generated pseudo-Bot, connect to the C&C server and maintain the connection, waiting for attack commands. During this month-long connection period, a total of five attack commands were received from the C&C server.

[0072] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A botnet threat hunting system based on automated binary code analysis, characterized in that, It includes a real-time capture subsystem and an intelligent analysis subsystem, which respectively realize the real-time capture of samples and the intelligent analysis of C&C servers; The operation of the botnet threat hunting system based on automated binary code analysis includes the following steps: Step S1: Honeypot design and deployment, including honeypot selection and deployment, and preliminary classification and processing of captured data; Step S2: Perform automated reverse processing on the captured samples to extract three important pieces of information: IOC, Token, and communication function. Step S3: Classify attack functions; Step S4: Pseudo-Bot Construction and Integration; Step S1 further includes: Step S1.1: Considering that the honeypot needs to allow attackers to upload malicious samples, but cannot actually become an infected botnet, we chose to add a preliminary classification function based on the Jaccard coefficient to the Cowrie honeypot framework; finally, we selected a Linux device, completed the honeypot deployment through a Docker container, and started capturing malicious samples. Step S1.2: Convert the captured malicious samples and files in the known sample library into byte sequences, and divide them into fixed-size blocks, with each block size set to 4; Step S1.3: The blocks generated from the files to be compared are added to different sets to obtain the block set of the file. The similarity of the files to be compared is obtained by calculating the Jaccard similarity coefficient of this file block set. Step S1.4: By comparing the similarity scores, the system will rename the sample using the family name with the highest similarity score; Step S2 further includes: Step S2.1: Use UPX to automatically unpack the samples; Step S2.2: Run the automated analysis script on the unpacked malicious sample; Step S2.3: Subsequently, by traversing the functions, check if there are any functions with more than four XOR operations to determine whether the malicious sample has encrypted the IOC; Step S2.4: Since the malicious sample needs to pass the IOC address as a parameter when initiating a connect request with the C&C server, the `resolve_cnc_addr` function can be located through the system function `connect`. Then, the string and direct number are extracted from the `resolve_cnc_addr` function. By checking whether the same number is operated on twice in the function, it is determined whether the IOC is encrypted. If it is encrypted, the encryption function located in S2.3 is used for decryption. Next, the number of bytes in the decrypted data is used to determine whether the data is an IP address or a port. A port is an integer less than 65535, which is 2 bytes, while an IP address is 4 bytes. If it is a domain name, it will be more bytes. Finally, it is stored in the database, completing the IOC extraction. Step S2.5: Continue to use the system function sys_sendto to locate the token. By reading the parameters of the sys_sendto function, the token length and token memory offset can be obtained. By combining the length and offset, the information of the length corresponding to the address in the sample can be read to extract the token. Step S2.6: Finally, verify the accuracy of automated extraction.

2. The botnet threat hunting system based on automated binary code analysis as described in claim 1, characterized in that, In step S2.1, firstly, the UPX features of the sample are detected to determine whether it is packed. If no UPX features are detected, it means that the sample is not packed. If UPX features are detected, the sample UPX header and p_info are further checked for corruption. If they are corrupted, they are repaired by p_filesize at the end of the file. Finally, the unpacking operation is performed.

3. The botnet threat hunting system based on automated binary code analysis as described in claim 2, characterized in that, Step S2.2 further includes: Step 2.2.1: First, by searching for features that consist of only one basic block and call the same function multiple times, the attack_init function of the malicious sample is located, which is the function that initializes all attack functions of the malicious sample; Step 2.2.2: Obtain the operands of each mov operator within the function. The obtained operands are the addresses of the attack function.

4. The botnet threat hunting system based on automated binary code analysis as described in claim 3, characterized in that, In step S2.4, the number of decryption operations is used to determine whether the IOC is encrypted. If it is encrypted, there must be a pair of encryption and decryption processes, so there are two operations. In step S2.5, the malicious sample uses the sys_sendto function to send Token information to the C&C server. The Token is passed to the function as a parameter, thereby realizing the location of the Token.

5. The botnet threat hunting system based on automated binary code analysis as described in claim 4, characterized in that, Step S3 further includes: Step S3.1: First, use radare2 to extract the CPU architecture, compiler, compilation optimization options, function instruction code, function code block and control flow graph information corresponding to the attack function. Then, call the get_fuction_cfg function to generate the JSON tag of the function based on the starting address of the attack function. Step S3.2: For each instruction of the function in the json tag, first call the __clean function, and take different normalization methods for the instructions according to different architectures, uniformly replace immediate values ​​and addresses with CONST, and map register names to general identifiers; after completing the normalization, count the frequency of each opcode and operand, filter out useless low-frequency items, and then construct the vocab and save it to the file. Step S3.3: Transform the CFG of the function into a control flow graph with edge and node features; first normalize each block and instruction ins of the control function flow graph, then use vocab to map the instruction ins, and finally use a Bi-LSTM network to generate a control flow graph with edge and node features. Step S3.4: Input the processed control flow graph into the GatedGCN-E network constructed in this project, which is a gated graph convolutional network with node features and edge features, to generate the vector of the attack function; calculate the cosine similarity between the unknown sample attack function vector and the attack function vector in the sample library, and determine the type of unknown sample attack function based on the similarity.

6. The botnet threat hunting system based on automated binary code analysis as described in claim 5, characterized in that, Step S4 further includes: Step S4.1: Since the attack command information structure sent by the server corresponding to different zombie samples is often different, the zombie samples also process the attack command information differently; therefore, for each zombie sample, the attack information processing function needs to be fine-tuned based on the pseudo-bot template of its corresponding bot network. A hinting engineering approach is adopted, that is, the large model is guided to modify the constructed bot template based on the sample attack processing function attack_parse() to generate bot code for the sample. Step S4.2: Finally, run the generated pseudo-Bot, connect to the C&C server and maintain the connection status, and wait for attack commands.

7. The botnet threat hunting system based on automated binary code analysis as described in claim 6, characterized in that, The bot sample generation in step S4.1 includes the following steps: Step 4.4.1: Upload the basic bot template to the large model so that the large model understands the structure of the bot code it needs to generate; Step 4.4.2: Tell the large model IDA Pro the decompiled code of the communication information processing function exported, so that it can generate the corresponding Python code based on this code, imitating the attack_parse() function in the pseudo-bot template; Step 4.4.3: Tell the large model that it needs to replace the attack_parse() function in the pseudo-bot template with this generated Python code, so as to generate bot code for specific samples.

Images