Malicious code identification method and device based on honeypot technology and electronic equipment

Abstract

The embodiment of the invention relates to the technical field of computers, in particular to a malicious code recognition method and device based on a honeypot technology and electronic equipment. A specific embodiment of the method comprises the steps of determining whether first behavior path information corresponding to a real-time access behavior exists or not; generating access behavior characteristics corresponding to the real-time access behaviors; according to the access behavior characteristics and a pre-trained first malicious code identification model, generating a behavior type corresponding to the real-time access behavior; in response to the existence, performing path updating on the first behavior path information according to the real-time access behavior; according to the second behavior path information and a pre-trained second malicious code identification model, generating a behavior type corresponding to the real-time access behavior; and in response to the behavior type being the second behavior type, performing behavior control on the real-time access behavior through the honeypot. According to the implementation mode, effective screening of malicious codes is achieved, and effective prevention of unauthorized operation corresponding to the malicious codes is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a malicious code identification method, device and electronic device based on honeypot technology. Background Art

[0002] Malicious code refers to a code segment that can perform unauthorized operations in a computer operating system. It will have an adverse effect on the normal execution of the computer operating system. For example, a Trojan virus can perform malicious operations on the computer operating system and maliciously tamper with data. At present, malicious code is usually identified by a method based on feature code matching.

[0003] However, when the above method is adopted, the following technical problems often occur: Malicious codes often have many forms of variants, which can hide their own behavior paths through disguise. It is difficult to effectively identify the variant malicious codes by using signature matching, and thus it is impossible to effectively prevent the unauthorized operations corresponding to the malicious codes. Summary of the invention

[0004] The content of this application is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this application is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0005] Some embodiments of the present application propose a malicious code identification method, device, electronic device and computer-readable storage medium based on honeypot technology to solve one or more of the technical problems mentioned in the above background technology section.

[0006] In a first aspect, some embodiments of the present application provide a malicious code identification method based on honeypot technology, the method comprising: determining whether there is first behavior path information corresponding to the real-time access behavior, wherein the first behavior path information represents the behavior path corresponding to the historical access behavior, and the real-time access behavior corresponds to the same behavior initiation node and behavior path as the historical access behavior; in response to the absence of the first behavior path information, performing the following first processing step: generating access behavior features corresponding to the real-time access behavior; generating a behavior type corresponding to the real-time access behavior based on the access behavior features and a pre-trained first malicious code identification model, wherein the behavior type comprises: a first behavior type and a second behavior type, the first behavior type representing that the real-time access behavior does not contain malicious code, and the second behavior type representing that the real-time access behavior contains malicious code; in response to the presence of the first behavior path information, performing a path update on the first behavior path information to generate second behavior path information based on the real-time access behavior; generating a behavior type corresponding to the real-time access behavior based on the second behavior path information and a pre-trained second malicious code identification model; in response to the behavior type being the second behavior type, performing behavior control on the real-time access behavior through a honeypot.

[0007] In a second aspect, some embodiments of the present application provide a malicious code identification device based on honeypot technology, the device comprising: a determination unit, configured to determine whether there is first behavior path information corresponding to the real-time access behavior, wherein the first behavior path information represents the behavior path corresponding to the historical access behavior, and the real-time access behavior corresponds to the same behavior initiation node and behavior path as the historical access behavior; a first execution unit, configured to, in response to the absence of the first behavior path information, perform the following first processing step: generate an access behavior feature corresponding to the real-time access behavior; generate a behavior type corresponding to the real-time access behavior based on the access behavior feature and a pre-trained first malicious code identification model, wherein the first behavior path information represents the behavior path corresponding to the historical access behavior; and the real-time access behavior corresponds to the same behavior initiation node and behavior path as the historical access behavior. The behavior types include: a first behavior type and a second behavior type, the first behavior type characterizing that the real-time access behavior does not contain malicious code, and the second behavior type characterizing that the real-time access behavior contains malicious code; the second execution unit is configured to, in response to existence, execute the following second processing steps: according to the real-time access behavior, update the path of the first behavior path information to generate second behavior path information; according to the second behavior path information and a pre-trained second malicious code recognition model, generate a behavior type corresponding to the real-time access behavior; the behavior control unit is configured to, in response to the behavior type being the second behavior type, perform behavior control on the real-time access behavior through a honeypot.

[0008] In a third aspect, the present application also provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, it implements the method described in any implementation of the first aspect.

[0009] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the method described in any implementation manner of the first aspect is implemented.

[0010] The above-mentioned embodiments of the present application have the following beneficial effects: through the malicious code identification method based on honeypot technology of some embodiments of the present application, effective identification of malicious code is achieved, and effective prevention of unauthorized operations corresponding to malicious code is improved. Specifically, the reason for the inability to effectively identify malicious code is that malicious code often has multiple forms of variants, which can hide its own behavior path in the form of disguise. It is difficult to effectively identify the variant malicious code by using the method of feature code matching, so that the unauthorized operations corresponding to the malicious code cannot be effectively prevented. Based on this, the malicious code identification method based on honeypot technology of some embodiments of the present application first determines whether there is first behavior path information corresponding to the real-time access behavior, wherein the first behavior path information represents the behavior path corresponding to the historical access behavior, and the real-time access behavior corresponds to the same behavior initiation node and behavior path as the historical access behavior. In practice, for malicious code, it often uses disguise to achieve the purpose of tampering with and collecting the content in the computer operating system, so it corresponds to the corresponding behavior execution path. At the same time, for latent malicious code, its tampering and collection often have a certain frequency. Therefore, by judging whether there is the first behavior path information corresponding to the real-time access behavior, it is possible to determine the access behavior with the same behavior path and the same behavior initiating node. Then, in response to the absence of the first behavior path information, the following first processing step is performed: the first step is to generate the access behavior feature corresponding to the above-mentioned real-time access behavior. The behavior characteristics of the real-time access behavior are characterized from the feature perspective in turn. The second step is to generate the behavior type corresponding to the above-mentioned real-time access behavior according to the above-mentioned access behavior feature and the pre-trained first malicious code recognition model, wherein the above-mentioned behavior type includes: the first behavior type and the second behavior type, the above-mentioned first behavior type characterizes that the above-mentioned real-time access behavior does not contain malicious code, and the above-mentioned second behavior type characterizes that the above-mentioned real-time access behavior contains malicious code. When the first behavior path information does not exist, the real-time access behavior can be characterized as the first access behavior or the disguised access behavior. Therefore, the first malicious code recognition model and the access behavior feature can be combined to identify whether the real-time access behavior contains malicious code. Further, in response to the existence of the first processing step, the following second processing step is performed: the first step is to update the path of the first behavior path information according to the above-mentioned real-time access behavior to generate the second behavior path information. When the first behavior path information exists, it indicates that there is a historical access behavior similar to the real-time access behavior. Therefore, the first behavior path information and the real-time access behavior can be combined. In the second step, based on the second behavior path information and the pre-trained second malicious code recognition model, a behavior type corresponding to the real-time access behavior is generated. In this way, the historical access behavior and the current access behavior are combined to analyze whether the real-time access behavior contains malicious code from the perspective of access behavior at different times.Finally, in response to the above behavior type being the above second behavior type, the above real-time access behavior is controlled through the honeypot. In practice, when malicious code is contained, corresponding behavior control is performed to avoid harm to the computer operating system. In this way, effective identification of malicious code is achieved, and effective prevention of unauthorized operations corresponding to malicious code is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0012] Figure 1 is a flow chart of some embodiments of the malicious code identification method based on honeypot technology according to the present application; Figure 2 It is a schematic diagram of the structure of some embodiments of the malicious code identification device based on the honeypot technology according to the present application; Figure 3 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present application. DETAILED DESCRIPTION

[0013] Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0014] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0015] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0016] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0017] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0018] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0019] refer to Figure 1 , shows a process 100 of some embodiments of the malicious code identification method based on honeypot technology according to the present application. The malicious code identification method based on honeypot technology includes the following steps: Step 101: determine whether there is first behavior path information corresponding to the real-time access behavior.

[0020] In some embodiments, the execution subject (e.g., a computing device) of the malicious code identification method based on honeypot technology can determine whether there is first behavior path information corresponding to the real-time access behavior. The first behavior path information represents the behavior path corresponding to the historical access behavior. In practice, the behavior path represents each specific access behavior of the historical access behavior in time sequence. For example, the historical access behavior may include access behavior A and access behavior B. Specifically, access behavior A can be executed at time T1 and access behavior B can be executed at time T2. Wherein, time T1 is earlier than time T2. Wherein, access behavior A can be used to obtain access rights for a file. Access behavior B can be tampering with the content of a file after executing the access behavior. The real-time access behavior corresponds to the same behavior initiation node and behavior path as the above-mentioned historical access behavior. The behavior initiation node can be a terminal that initiates the access behavior. In practice, the historical access behavior and the real-time access behavior correspond to the terminal that initiates the access behavior corresponding to the same IP address. In practice, the above-mentioned execution subject can read the historical access record to determine whether there is first behavior path information.

[0021] In practice, when the network risk is high, the above-mentioned execution entity can take the access behavior corresponding to each real-time access request as the real-time access behavior. When the network risk is low and the network traffic is high, that is, the number of access requests per unit time is high, the behavior type judgment is performed on the real-time access behavior corresponding to each real-time access request, which occupies more network resources. Therefore, the access behavior corresponding to the real-time access requests transmitted by certain ports can be taken as the real-time access behavior.

[0022] It should be noted that the above-mentioned computing device can be hardware or software. When the computing device is hardware, it can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or it can be implemented as a single server or a single terminal device. When the computing device is embodied as software, it can be installed in the hardware devices listed above. It can be implemented as multiple software or software modules for providing distributed services, for example, or it can be implemented as a single software or software module. No specific limitation is made here. In practice, the above-mentioned computing device can be an intermediate server arranged between a server cluster and the Internet, which is used to forward requests transmitted via the Internet to the server cluster, and forward the data stored in the requested server cluster to the corresponding terminal.

[0023] In some optional implementations of some embodiments, the execution subject determines whether there is first behavior path information corresponding to the real-time access behavior, which may include the following steps: The first step is to activate the target container.

[0024] The target container is an isolated container. In practice, the target container can replicate the container of resources stored in the server cluster. By setting the target container, it is possible to avoid the real-time network behavior from damaging the resources in the server cluster when the behavior type of the real-time access behavior is not determined.

[0025] In the second step, in response to successful activation, the real-time access behavior is executed in the target container, and the execution content of the real-time access behavior is recorded as candidate behavior path information.

[0026] Among them, the above-mentioned candidate behavior path information includes: a candidate behavior path node queue. The candidate behavior nodes in the above-mentioned candidate behavior path node queue include: behavior commands, behavior execution environment, behavior execution status, and behavior operation content. In practice, since the target container is the same as the cluster environment of the server cluster to be accessed to implement the access behavior, the above-mentioned real-time access behavior can be executed in the target container to obtain the specific access behavior operations of the above-mentioned real-time access behavior in time sequence as the candidate behavior path node queue. The behavior command represents a specific straight-line behavior command. For example, the behavior command can be "reg add XX", which means to modify the registration list. The behavior execution environment represents the container state of the current target container when the behavior command is executed. Specifically, it can represent the file status, system status, etc. The behavior execution status represents the execution status of the behavior command. Specifically, it can include: executing, execution failed, and execution successful. The behavior operation content represents the operation object corresponding to the behavior command and the execution result after the behavior command is executed. For example, when the behavior command is "reg add XX", the corresponding behavior operation content can be adding "XX" to the registration list.

[0027] The third step is to perform the following path finding steps based on the candidate behavior node sequence: Step 1: Determine the candidate behavior path node at the head of the candidate behavior path node queue as the target behavior path node.

[0028] In practice, candidate behavior path nodes can be stored in the form of a queue.

[0029] Step 2: According to the behavior command, behavior execution environment and behavior execution status included in the target behavior path node, traverse the behavior path graph to determine whether the target behavior path node is included in the behavior path graph.

[0030] Among them, the behavior path graph is a directed graph generated according to different access behaviors. The behavior path graph can be a path graph constructed according to various historical operation behaviors before the real-time operation behavior. Specifically, since each operation behavior corresponds to at least one path node, and the path nodes are ordered, and there are repeated and crossed path nodes between different operation behaviors, the above-mentioned behavior path graph can be constructed according to each historical operation behavior. In practice, the above-mentioned execution subject can determine whether there is a path node in the behavior path graph that is the same as the behavior command, behavior execution environment and behavior execution status included in the target behavior path node by graph traversal.

[0031] Step 3: In response to the absence of the first behavior, generating a determination result indicating the absence of the path information of the first behavior Step 4: In response to the existence of a candidate behavior node sequence excluding the target behavior path node and being empty, a determination result indicating the existence of the first behavior path information is generated.

[0032] In the fourth step, in response to the existence of a candidate behavior node sequence excluding the target behavior path node and being non-empty, the candidate behavior node sequence excluding the target behavior path node is used as the candidate behavior node sequence, and the above path search step is performed again.

[0033] Step 102, in response to the absence of the first processing step, execute the following first processing step: Step 1021: Generate access behavior features corresponding to the real-time access behavior.

[0034] In some embodiments, the execution entity may generate access behavior features corresponding to the real-time access behavior.

[0035] As an example, first, the execution subject may extract static features from the access content corresponding to the real-time access behavior to obtain static access behavior features. Then, the execution subject may extract dynamic features from each specific access behavior corresponding to the real-time access behavior to obtain dynamic access behavior features. Next, the static access behavior features and the dynamic access behavior features are combined to obtain the access behavior features.

[0036] In some optional implementations of some embodiments, generating access behavior features corresponding to the above-mentioned real-time access behavior may include the following steps: In the first step, for each candidate behavior path node in the candidate behavior path node queue, the following feature processing steps are performed: Step 1: Disassemble the behavior commands included in the candidate behavior path nodes to generate an assembly instruction set.

[0037] In practice, the execution subject may disassemble the behavior commands included in the candidate behavior path node through dynamic debugging tools and static debugging tools to generate an assembly instruction set. In practice, since different high-level languages ​​have different language formats, the behavior commands included in the candidate behavior path node may be converted into an assembly instruction set of the same expression form through disassembly.

[0038] Step 2: Extract instruction features from each assembly instruction in the above assembly instruction set to generate instruction features and obtain an instruction feature set.

[0039] In practice, the execution subject can extract instruction features from assembly instructions by accessing the instruction feature extractor included in the behavior feature extractor to generate instruction features. Specifically, the instruction feature extractor can be a downsampling network consisting of 5 layers of serially connected convolutional layers. Specifically, the streamlined network structure can reduce the amount of feature processing in the feature extraction process. In addition, the network structure design of the downsampling network can reduce the feature length.

[0040] Step 3: Extract environmental features of the behavior execution environment included in the candidate behavior path node to obtain environmental features.

[0041] In practice, the above-mentioned execution subject can access the environment feature extractor included in the behavior feature extractor. In practice, the environment feature extractor can extract indicator features of key execution indicators in the behavior execution environment. Specifically, in order to ensure the execution of behavior commands, it is often necessary to keep a large number of processes and resources in use, and to perform full feature extraction on the behavior execution environment, which requires a huge amount of data processing. Therefore, the above-mentioned execution subject can use the environment feature extractor to extract indicator features of key execution indicators in the behavior execution environment to obtain environmental features. In practice, key indicators may include: read operation permission status, current process list, current hardware resource occupancy status, etc.

[0042] Step 4: Perform state mapping on the behavior execution states included in the candidate behavior path nodes to obtain a behavior execution state vector.

[0043] In practice, since the number of behavior execution states is limited, a one-hot encoding method can be used to perform state mapping on the behavior execution states included in the candidate behavior path nodes to obtain a behavior execution state vector.

[0044] Step 5: Extract the operation content of the behavior operation content included in the above candidate behavior path node to generate operation content features.

[0045] In practice, the execution subject can extract the operation content of the behavior operation content included in the candidate behavior path node by accessing the operation content extraction model included in the behavior feature extractor to generate the operation content feature. The operation content extraction model uses the Word2Vec model to embed the behavior operation content included in the candidate behavior path node to obtain the operation content feature.

[0046] Step 6: Perform feature mapping on the instruction feature set, the environment feature, the behavior execution state vector and the operation content feature to obtain mapped features.

[0047] In practice, the feature dimensions of the above-mentioned instruction feature set, the above-mentioned environmental features, the above-mentioned behavior execution state vector, and the above-mentioned operation content features are all different. In order to facilitate subsequent splicing, the above-mentioned execution subject can access the first upsampling network, the second upsampling network, the third upsampling network, and the fourth upsampling network included in the behavior feature extractor. Among them, the first upsampling network is used to perform feature upsampling on the instruction feature set. The second upsampling network is used to perform feature upsampling on the environmental features. The third upsampling network is used to perform feature upsampling on the behavior execution state vector. The fourth upsampling network is used to perform feature upsampling on the operation content features. Among them, the feature dimensions output by the first upsampling network, the second upsampling network, the third upsampling network, and the fourth upsampling network are N×M1, N×M2, N×M3, and N×M4, respectively. Then, since the horizontal dimensions of the dimensions of the output features are the same, the features output by different upsampling networks can be vertically spliced ​​as the above-mentioned mapped features.

[0048] In the second step, each mapped feature in the obtained mapped feature set is concatenated to obtain a mapped feature graph for the above real-time access behavior as the above access behavior feature.

[0049] Step 1022: Generate a behavior type corresponding to the real-time access behavior based on the access behavior characteristics and the pre-trained first malicious code recognition model.

[0050] In some embodiments, the execution subject may generate a behavior type corresponding to the real-time access behavior based on the access behavior characteristics and the pre-trained first malicious code recognition model. The behavior type includes: a first behavior type and a second behavior type, the first behavior type indicates that the real-time access behavior does not contain malicious code, and the second behavior type indicates that the real-time access behavior contains malicious code.

[0051] Optionally, the first malicious code identification model includes: an access behavior feature extractor and a malicious code classifier. The access behavior feature extractor is used to generate the above-mentioned access behavior features based on the above-mentioned real-time access behavior. Specifically, the specific way in which the access behavior feature extractor extracts the access behavior features is detailed in step 1021 and will not be repeated here. The malicious code classifier may include K deep feature extractors, a feature overlay layer and a binary classifier. Among them, the network structure of the K deep feature extractors is the same and is arranged in parallel. The deep feature extractor adopts a ResNet model. The K deep feature extractors are connected to 1 feature overlay layer, which is used to implement the Add operation to superimpose the features output by the K deep feature extractors. The binary classifier is used to output the behavior type.

[0052] In some optional implementations of some embodiments, the execution subject generates a behavior type corresponding to the real-time access behavior according to the access behavior characteristics and a pre-trained first malicious code recognition model, which may include the following steps: In the first step, according to the input size of the malicious code classifier, the access behavior feature is segmented into horizontal feature graphs to obtain a set of candidate sub-access behavior features.

[0053] In practice, the input size is the lateral size included in the input size of the deep feature extractor. The number of candidate sub-access behavior features in the candidate sub-access behavior feature set is K.

[0054] In the second step, according to the input size, each candidate sub-access behavior feature in the candidate sub-access behavior feature set is zero-filled to generate a sub-access behavior feature, thereby obtaining a sub-access behavior feature set.

[0055] The feature size of the sub-access behavior feature in the sub-access behavior feature set is consistent with the input size. In practice, the execution subject may perform zero-filling on the selected sub-access behavior feature according to the vertical size included in the input size to generate the sub-access behavior feature.

[0056] The third step is to generate the above behavior type according to the above sub-access behavior feature set and the above malicious code classifier.

[0057] In practice, first, the execution subject can perform parallel feature extraction on the sub-access behavior features in the sub-access behavior feature set through K deep feature extractors. Then, the extracted features are superimposed through the feature superposition layer. Finally, the superimposed features are input into the above binary classifier to obtain the behavior type.

[0058] The content of "in some optional implementation methods of some embodiments" in the above steps 1021 and 1022, as an inventive point of the present application, realizes the determination of the corresponding behavior type when the real-time access behavior is the first access behavior. Specifically, first, for each candidate behavior path node, the present application performs feature extraction from the perspectives of behavior command, behavior execution environment, behavior execution status, and behavior operation content. Next, considering that the number of behavior path nodes contained in different access behaviors is different, resulting in differences in the size of the obtained access behavior features, therefore, the present application first performs horizontal feature graph segmentation on the above access behavior features according to the input size of the above malicious code classifier to obtain a candidate sub-access behavior feature set. Parallel feature extraction is performed on the sub-access behavior features in the sub-access behavior feature set by K deep feature extractors set in parallel. Then the obtained features are processed by feature superposition, and finally, the behavior type is determined by a binary classifier. In this way, the determination of the corresponding behavior type is realized when the real-time access behavior is the first access behavior.

[0059] Step 103, in response to existence, execute the following second processing step: Step 1031: Update the path of the first behavior path information according to the real-time access behavior to generate the second behavior path information.

[0060] In some embodiments, the execution entity may update the first behavior path information according to the real-time access behavior to generate the second behavior path information.

[0061] Optionally, the first behavior path information includes: a first behavior path node queue, and the first behavior path node in the above-mentioned first behavior path node queue includes: behavior execution status and behavior operation content. In practice, since the operation behavior is often composed of multiple specific operation behaviors, the historical operation behavior also corresponds to a corresponding path node queue. Due to changes in time, the data stored in the file corresponding to the behavior operation content may change. Therefore, the operation object corresponding to the behavior command and the execution result after the behavior command is executed will also change. Therefore, it is necessary to update the path of the first behavior path information according to the real-time access behavior to generate the second behavior path information.

[0062] In some optional implementations of some embodiments, the execution subject updates the path of the first behavior path information according to the real-time access behavior to generate the second behavior path information, which may include the following steps: According to the above-mentioned real-time access behavior, the behavior execution status and behavior operation content included in each first behavior path node in the above-mentioned first behavior path node queue are updated to generate a second behavior path node, and a second behavior path node queue is obtained as the above-mentioned second behavior path information.

[0063] In practice, since the real-time access behavior and the historical access behavior correspond to the same behavior path, there is a one-to-one correspondence between the candidate behavior path nodes in the candidate behavior path node queue and the first behavior path nodes in the first behavior path node sequence. Therefore, for each first behavior path node in the first behavior path node sequence, the execution subject can update the behavior execution status and behavior operation content included in the first behavior path node according to the corresponding candidate behavior path node. In practice, the update method does not use overwrite update, but append update, so as to record the changes for the same path node at different times.

[0064] Step 1032: Generate a behavior type corresponding to the real-time access behavior according to the second behavior path information and the pre-trained second malicious code recognition model.

[0065] In some embodiments, the execution entity may generate a behavior type corresponding to the real-time access behavior according to the second behavior path information and a pre-trained second malicious code recognition model.

[0066] In some optional implementations of some embodiments, the execution subject generates a behavior type corresponding to the real-time access behavior according to the second behavior path information and a pre-trained second malicious code recognition model, which may include the following steps: The first step is to generate a sparse signal for each second behavior path node in the second behavior path node queue according to the behavior execution state and behavior operation content included in the second behavior path node, wherein the potential state in the sparse signal represents the execution state for the behavior operation content. In practice, the sparse signal can use a unipolar signal encoding method to represent the behavior execution state for the behavior operation content. A high potential can be used during operation and at the end of operation. A low potential can be used when no operation is performed. Since access behaviors containing malicious code are often sparse, that is, in order to ensure confidentiality, they often have a low access frequency, and at the same time, the access is directional. Therefore, a sparse signal is used to represent the second behavior path node.

[0067] In the second step, each sparse signal in the obtained sparse signal set is compressed to generate a compressed sparse signal, thereby obtaining a compressed sparse signal set.

[0068] In practice, due to the high sparsity of the signal, especially for access behaviors containing malicious code, the above-mentioned execution subject can use 0 compression to compress the sparse signal to generate a compressed sparse signal.

[0069] The third step is to generate the above-mentioned behavior type according to the above-mentioned compressed sparse signal set and the above-mentioned second malicious code recognition model.

[0070] The second malicious code recognition model adopts a spike neural network model. The second malicious code recognition model includes 1 input layer, M hidden layers and 1 output layer. The hidden layer contains W neurons. In practice, compared with the traditional neural network model, the calculation speed is faster, and for access behaviors with a high proportion of zero, it can better extract features to determine the corresponding behavior type.

[0071] Step 104: In response to the behavior type being the second behavior type, behavior control is performed on the real-time access behavior through a honeypot.

[0072] In some embodiments, the execution subject may control the real-time access behavior through a honeypot in response to the behavior type being the second behavior type. In practice, the execution subject may deny access to the real-time access behavior.

[0073] In some optional implementations of some embodiments, the execution subject performs behavior control on the real-time access behavior through a honeypot in response to the behavior type being the second behavior type, which may include the following steps: The first step is to determine the behavioral interaction degree corresponding to the above real-time access behavior.

[0074] The above-mentioned behavior interactivity is determined by the behavior execution state, behavior operation content and behavior operation object corresponding to the above-mentioned real-time access behavior.

[0075] In practice, the above-mentioned execution subject can obtain the behavior interaction degree by weighted summing up the behavior execution state, behavior operation content and behavior operation object corresponding to the real-time access behavior. In practice, the behavior execution state, behavior operation content and behavior operation object correspond to different incentive basic scores. The above-mentioned execution subject can obtain the behavior interaction degree by weighted summing up the candidate behavior path nodes in the candidate behavior path node queue corresponding to the real-time access behavior.

[0076] In the second step, in response to the behavior interaction degree being in the first behavior interaction degree interval, redirecting the real-time access behavior to the first interaction honeypot.

[0077] Among them, the first interactive honeypot is a low-interaction honeypot.

[0078] In the third step, in response to the behavior interaction degree being in the second behavior interaction degree interval, redirecting the real-time access behavior to the second interaction honeypot.

[0079] Among them, the second interactive honeypot is a medium-interaction honeypot.

[0080] In the third step, in response to the behavior interaction degree being in a third behavior interaction degree interval, redirecting the real-time access behavior to a third interaction honeypot.

[0081] The third interactive honeypot is a high-interaction honeypot.

[0082] The above-mentioned embodiments of the present application have the following beneficial effects: through the malicious code identification method based on honeypot technology of some embodiments of the present application, effective identification of malicious code is achieved, and effective prevention of unauthorized operations corresponding to malicious code is improved. Specifically, the reason for the inability to effectively identify malicious code is that malicious code often has multiple forms of variants, which can hide its own behavior path in the form of disguise. It is difficult to effectively identify the variant malicious code by using the method of feature code matching, so that the unauthorized operations corresponding to the malicious code cannot be effectively prevented. Based on this, the malicious code identification method based on honeypot technology of some embodiments of the present application first determines whether there is first behavior path information corresponding to the real-time access behavior, wherein the first behavior path information represents the behavior path corresponding to the historical access behavior, and the real-time access behavior corresponds to the same behavior initiation node and behavior path as the historical access behavior. In practice, for malicious code, it often uses disguise to achieve the purpose of tampering with and collecting the content in the computer operating system, so it corresponds to the corresponding behavior execution path. At the same time, for latent malicious code, its tampering and collection often have a certain frequency. Therefore, by judging whether there is the first behavior path information corresponding to the real-time access behavior, it is possible to determine the access behavior with the same behavior path and the same behavior initiating node. Then, in response to the absence of the first behavior path information, the following first processing step is performed: the first step is to generate the access behavior feature corresponding to the above-mentioned real-time access behavior. The behavior characteristics of the real-time access behavior are characterized from the feature perspective in turn. The second step is to generate the behavior type corresponding to the above-mentioned real-time access behavior according to the above-mentioned access behavior feature and the pre-trained first malicious code recognition model, wherein the above-mentioned behavior type includes: the first behavior type and the second behavior type, the above-mentioned first behavior type characterizes that the above-mentioned real-time access behavior does not contain malicious code, and the above-mentioned second behavior type characterizes that the above-mentioned real-time access behavior contains malicious code. When the first behavior path information does not exist, the real-time access behavior can be characterized as the first access behavior or the disguised access behavior. Therefore, the first malicious code recognition model and the access behavior feature can be combined to identify whether the real-time access behavior contains malicious code. Further, in response to the existence of the first processing step, the following second processing step is performed: the first step is to update the path of the first behavior path information according to the above-mentioned real-time access behavior to generate the second behavior path information. When the first behavior path information exists, it indicates that there is a historical access behavior similar to the real-time access behavior. Therefore, the first behavior path information and the real-time access behavior can be combined. In the second step, based on the second behavior path information and the pre-trained second malicious code recognition model, a behavior type corresponding to the real-time access behavior is generated. In this way, the historical access behavior and the current access behavior are combined to analyze whether the real-time access behavior contains malicious code from the perspective of access behavior at different times.Finally, in response to the above behavior type being the above second behavior type, the above real-time access behavior is controlled through the honeypot. In practice, when malicious code is contained, corresponding behavior control is performed to avoid harm to the computer operating system. In this way, effective identification of malicious code is achieved, and effective prevention of unauthorized operations corresponding to malicious code is improved. Further references Figure 2 As an implementation of the methods shown in the above figures, the present application provides some embodiments of a malicious code identification device based on honeypot technology. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the malicious code identification device based on the honeypot technology can be specifically applied to various electronic devices.

[0083] like Figure 2 As shown, some embodiments of the malicious code identification device 200 based on honeypot technology include: a determination unit 201, a first execution unit 202, a second execution unit 203 and a behavior control unit 204. The determination unit 201 is configured to determine whether there is first behavior path information corresponding to the real-time access behavior, wherein the first behavior path information represents the behavior path corresponding to the historical access behavior, and the real-time access behavior corresponds to the same behavior initiation node and behavior path as the historical access behavior; the first execution unit 202 is configured to perform the following first processing step in response to the absence of the first behavior path information: generate an access behavior feature corresponding to the real-time access behavior; generate a behavior type corresponding to the real-time access behavior according to the access behavior feature and a pre-trained first malicious code identification model, wherein the behavior type includes: a first behavior type and a second behavior type. Type, the above-mentioned first behavior type characterizes that the above-mentioned real-time access behavior does not contain malicious code, and the above-mentioned second behavior type characterizes that the above-mentioned real-time access behavior contains malicious code; the second execution unit 203 is configured to, in response to the existence, execute the following second processing steps: according to the above-mentioned real-time access behavior, the path of the above-mentioned first behavior path information is updated to generate second behavior path information; according to the above-mentioned second behavior path information and a pre-trained second malicious code recognition model, a behavior type corresponding to the above-mentioned real-time access behavior is generated; the behavior control unit 204 is configured to, in response to the above-mentioned behavior type being the above-mentioned second behavior type, perform behavior control on the above-mentioned real-time access behavior through a honeypot.

[0084] It can be understood that the units recorded in the malicious code identification device 200 based on the honeypot technology are similar to the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the malicious code identification device 200 based on the honeypot technology and the units contained therein, and will not be described in detail here. Figure 3 This is a schematic block diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may be a terminal.

[0085] like Figure 3 As shown, the electronic device includes a processor, a memory and a network interface connected via a system bus, wherein the memory may include a non-volatile storage medium and an internal memory.

[0086] The non-volatile storage medium can store an operating system and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any malicious code identification method based on the honeypot technology.

[0087] The processor is used to provide computing and control capabilities to support the operation of the entire electronic device.

[0088] The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the processor can execute any malicious code identification method based on the honeypot technology.

[0089] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will understand that Figure 3 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0090] It should be understood that the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0091] In one embodiment, the processor is used to run a computer program stored in a memory to implement the following steps: determine whether there is first behavior path information corresponding to the real-time access behavior, wherein the first behavior path information represents the behavior path corresponding to the historical access behavior, and the real-time access behavior corresponds to the same behavior initiation node and behavior path as the historical access behavior; in response to the absence of the information, perform the following first processing step: generate access behavior features corresponding to the real-time access behavior; generate a behavior type corresponding to the real-time access behavior based on the access behavior features and a pre-trained first malicious code recognition model, wherein the behavior type includes: a first behavior type and a second behavior type, wherein the first behavior type represents that the real-time access behavior does not contain malicious code, and the second behavior type represents that the real-time access behavior contains malicious code; in response to the presence of the information, perform the following second processing step: perform path update on the first behavior path information based on the real-time access behavior to generate second behavior path information; generate a behavior type corresponding to the real-time access behavior based on the second behavior path information and a pre-trained second malicious code recognition model; in response to the behavior type being the second behavior type, perform behavior control on the real-time access behavior through a honeypot.

[0092] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. The computer program includes program instructions. The method implemented when the program instructions are executed can refer to the various embodiments of the malicious code identification method based on honeypot technology of the present application.

[0093] The computer-readable storage medium may be an internal storage unit of the electronic device described in the above embodiment, such as a hard disk or memory of the electronic device. The computer-readable storage medium may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., provided on the electronic device.

[0094] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0095] The serial numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments. The above description is only a specific implementation mode of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A malicious code identification method based on honeypot technology, comprising: Determine whether there is first behavior path information corresponding to the real-time access behavior, wherein the first behavior path information represents the behavior path corresponding to the historical access behavior, and the real-time access behavior and the historical access behavior correspond to the same behavior initiation node and behavior path; In response to not being present, the following first processing steps are performed: Generating access behavior features corresponding to the real-time access behavior; Generate a behavior type corresponding to the real-time access behavior according to the access behavior feature and a pre-trained first malicious code recognition model, wherein the behavior type includes: a first behavior type and a second behavior type, the first behavior type represents that the real-time access behavior does not contain malicious code, and the second behavior type represents that the real-time access behavior contains malicious code; In response to existence, the following second processing step is performed: According to the real-time access behavior, updating the first behavior path information to generate second behavior path information; generating a behavior type corresponding to the real-time access behavior according to the second behavior path information and a pre-trained second malicious code recognition model; In response to the behavior type being the second behavior type, behavior control is performed on the real-time access behavior through a honeypot.

2. The method according to claim 1, wherein: The determining whether there is first behavior path information corresponding to the real-time access behavior includes: activating a target container, wherein the target container is an isolation container; In response to successful activation, the real-time access behavior is executed in the target container, and the execution content of the real-time access behavior is recorded as candidate behavior path information, wherein the candidate behavior path information includes: a candidate behavior path node queue, wherein the candidate behavior nodes in the candidate behavior path node queue include: a behavior command, a behavior execution environment, a behavior execution state, and a behavior operation content; Based on the candidate behavior node sequence, the following path finding steps are performed: Determine the candidate behavior path node at the head of the candidate behavior path node queue as the target behavior path node; According to the behavior command, behavior execution environment and behavior execution state included in the target behavior path node, traverse the behavior path graph to determine whether the target behavior path node is included in the behavior path graph, wherein the behavior path graph is a directed graph generated according to different access behaviors; In response to the absence of the first behavior path information, generating a determination result indicating that the first behavior path information does not exist; In response to the candidate behavior node sequence existing and excluding the target behavior path node being empty, generating a determination result indicating the existence of the first behavior path information; In response to the candidate behavior node sequence excluding the target behavior path node existing and not empty, the candidate behavior node sequence excluding the target behavior path node is used as the candidate behavior node sequence, and the path search step is performed again.

3. The method according to claim 2, wherein: The generating of the access behavior feature corresponding to the real-time access behavior includes: For each candidate behavior path node in the candidate behavior path node queue, perform the following feature processing steps: Disassembling the behavior commands included in the candidate behavior path node to generate an assembly instruction set; Extracting instruction features from each assembly instruction in the assembly instruction set to generate instruction features and obtain an instruction feature set; Extracting environmental features of the behavior execution environment included in the candidate behavior path node to obtain environmental features; Performing state mapping on the behavior execution state included in the candidate behavior path node to obtain a behavior execution state vector; Extracting operation contents of the behavior operation contents included in the candidate behavior path nodes to generate operation content features; Performing feature mapping on the instruction feature set, the environment feature, the behavior execution state vector, and the operation content feature to obtain mapped features; The mapped features in the obtained mapped feature set are concatenated to obtain a mapped feature graph for the real-time access behavior as the access behavior feature.

4. The method according to claim 3, wherein: The first malicious code identification model includes: an access behavior feature extractor and a malicious code classifier, wherein the access behavior feature extractor is used to generate the access behavior feature according to the real-time access behavior; and The generating, according to the access behavior feature and the pre-trained first malicious code recognition model, a behavior type corresponding to the real-time access behavior comprises: According to the input size of the malicious code classifier, the access behavior feature is segmented into a horizontal feature graph to obtain a candidate sub-access behavior feature set; According to the input size, performing zero-filling on each candidate sub-access behavior feature in the candidate sub-access behavior feature set to generate a sub-access behavior feature, thereby obtaining a sub-access behavior feature set, wherein the feature size of the sub-access behavior features in the sub-access behavior feature set is consistent with the input size; The behavior type is generated according to the sub-access behavior feature set and the malicious code classifier.

5. A malicious code identification device based on honeypot technology, comprising: A determination unit is configured to determine whether there is first behavior path information corresponding to the real-time access behavior, wherein the first behavior path information represents a behavior path corresponding to the historical access behavior, and the real-time access behavior and the historical access behavior correspond to the same behavior initiation node and behavior path; The first execution unit is configured to, in response to the absence, perform the following first processing step: generate an access behavior feature corresponding to the real-time access behavior; generate a behavior type corresponding to the real-time access behavior according to the access behavior feature and a pre-trained first malicious code recognition model, wherein the behavior type includes: a first behavior type and a second behavior type, the first behavior type characterizing that the real-time access behavior does not contain malicious code, and the second behavior type characterizing that the real-time access behavior contains malicious code; The second execution unit is configured to, in response to the existence, perform the following second processing steps: according to the real-time access behavior, update the first behavior path information to generate second behavior path information; according to the second behavior path information and a pre-trained second malicious code recognition model, generate a behavior type corresponding to the real-time access behavior; The behavior control unit is configured to perform behavior control on the real-time access behavior through a honeypot in response to the behavior type being the second behavior type.

6. An electronic device, wherein: The electronic device comprises a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images