Black-box adversarial perturbation method for dynamic malware detection model based on large model

Abstract

The present invention relates to artificial intelligence and network security technology, and in particular to a black box adversarial perturbation method for a dynamic malware detection model based on a large model. The present invention gives a dynamic malware detection model, constructs an API sequence sample set; uses a machine learning algorithm to train to obtain a proxy malware detection model; constructs a generator, uses the proxy malware detection model to obtain a trained generator through adversarial training, uses the trained generator to perform feature space adversarial perturbation on the API feature vector of the malicious software sample, and obtains the API feature vector after adversarial perturbation; obtains an API difference vector based on the API feature vector of the malicious software sample and the API feature vector after adversarial perturbation; uses a large model to generate a function code snippet, modifies the source code of the malicious software sample according to the function code snippet, and obtains the final adversarial perturbation code. The present invention avoids the work of manual coding and greatly improves the efficiency of adversarial attacks.

Description

Technical Field

[0001] The present invention relates to artificial intelligence and network security technology, and in particular to a black box countermeasure disturbance method for a dynamic malware detection model based on a large model. Background Art

[0002] Malware is invasive software developed by hackers to steal data or damage computer systems. Common malware includes viruses, worms, Trojans, adware, and ransomware. Malware obtains user information through illegal means without explicit notification to the user or without the user's permission, seriously infringing the user's legitimate rights and interests, and even causing huge economic or other forms of loss of interests to the user and others. At present, most of the malware detection methods are based on the dynamic execution behavior of malware, and the execution behavior of the program can be represented by a series of runtime API calls. At the same time, machine learning technology can learn the general pattern of API calls and their correlation with different types of malware from large data sets. Therefore, API calls combined with machine learning have become the most widely used detection technology. In recent years, deep learning technology has been widely used to build dynamic malware detection models, such as CNN, RNN, GNN, etc. Because deep learning technology can automatically extract semantic features from API call sequences, by embedding API calls into the latent feature space, deep learning technology can greatly improve the generalization ability of unknown malware detection.

[0003] Malware detection models based on deep learning generally have robustness defects and are easily affected by adversarial attacks (i.e., by carefully adding a small amount of perturbation to the feature space of malicious software samples, the target detection model misclassifies the malicious software samples as benign). Existing research has proposed a variety of adversarial attack algorithms for malware detection models based on technologies such as generative adversarial networks and genetic algorithms.

[0004] However, the existing adversarial attack algorithms for malware detection models still have an obvious shortcoming: all adversarial perturbations are performed in the feature domain, and the perturbations in the feature domain are difficult to correspond to the problem domain. The feature domain here refers to the feature vector that represents the malicious software sample (such as the feature vector of the number of API calls), and the problem domain refers to the source code of the malicious software sample. In order to implement the adversarial perturbation version of the malware, it is often necessary to understand the meaning of the adversarial perturbation and then manually modify or write the malware source code, which is extremely inefficient. Summary of the invention

[0005] The purpose of the present invention is to solve the problem of low efficiency in manually modifying or writing malware source code, and to propose a black box adversarial perturbation method for a dynamic malware detection model based on a large model.

[0006] In order to achieve the above object, the technical solution provided by the present invention is:

[0007] A black-box adversarial perturbation method for a dynamic malware detection model based on a large model, comprising:

[0008] Given a dynamic malware detection model, an API sequence sample set is constructed based on the dynamic malware detection model, and the API sequence sample set is converted into a training sample set;

[0009] The agent malware detection model is trained based on the training sample set using a machine learning algorithm;

[0010] Construct a generator, use the proxy malware detection model to obtain a trained generator through adversarial training, use the trained generator to perform adversarial perturbation on the feature space of the API feature vector of the software sample detected as malicious by the proxy malware detection model, and obtain the API feature vector after adversarial perturbation;

[0011] Based on the API feature vector of the malicious software sample and the API feature vector after adversarial perturbation, an API difference vector is obtained, which includes the APIs that need to be called more and the number of times the calls are increased;

[0012] The large model is used to generate function code snippets according to each API that needs to be called and the number of times the call is increased. The source code of the malicious software sample is modified according to the generated function code snippets to obtain the final adversarial perturbation code.

[0013] Furthermore, the API sequence sample set is constructed based on the dynamic malware detection model, including:

[0014] Given a software sample, a sandbox is used to simulate the running of the software sample to obtain the API sequence of the software sample, the API sequence is input into a dynamic malware detection model to obtain a detection result, and an API sequence sample is obtained based on the API sequence and the detection result;

[0015] Operate on multiple software samples to obtain API sequence samples of each software sample to form an API sequence sample set.

[0016] Furthermore, converting the API sequence sample set into a training sample set includes:

[0017] Extracting an API feature vector from the API sequence of each API sequence sample in the API sequence sample set;

[0018] The API sequence of the API sequence sample is replaced with the API feature vector to obtain a training sample set.

[0019] Furthermore, the generator is constructed to obtain a trained generator using a proxy malware detection model through adversarial training, including:

[0020] Constructing a generator, the generator comprising an encoder module and a decoder module;

[0021] Input the API feature vector of the software sample detected as malicious by the proxy malware detection model into the generator to obtain the normalized adversarial perturbation vector;

[0022] Normalize the API feature vector and add it to the normalized adversarial perturbation vector to obtain the normalized adversarially perturbed API feature vector;

[0023] Denormalize the normalized API feature vector after adversarial perturbation to obtain the API feature vector after adversarial perturbation;

[0024] Input the adversarially perturbed API feature vector into the dynamic malware detection model to obtain the predicted label , input the adversarially perturbed API feature vector into the proxy malware detection model to obtain the predicted label ;

[0025] The parameters of the proxy malware detection model are updated based on the loss function of the proxy malware detection model. The loss function of the proxy malware detection model is expressed by the following formula:

[0026]

[0027] in, represents the loss function of the proxy malware detection model, represents the cross entropy function;

[0028] The parameters of the generator are updated based on the loss function of the generator, and the loss function of the generator is expressed by the following formula:

[0029]

[0030] in, represents the loss function of the generator, represents the API feature vector, represents the API feature vector after adversarial perturbation, represents a benign label, represents the output of the encoder module in the generator; express The probability distribution of Indicates a given Input is The probability distribution of represents the distance between the API feature vector and the adversarial perturbation API feature vector, represents KL divergence; , , represents the weight coefficient;

[0031] Repeatedly input the API feature vectors of software samples detected as malicious by the proxy malware detection model into the generator, and update the parameters of the generator until the loss functions of the proxy malware detection model and the generator converge to obtain a trained generator.

[0032] Furthermore, the method uses the trained generator to perform feature space adversarial perturbation on the API feature vector of the software sample detected as malicious by the proxy malware detection model to obtain the API feature vector after adversarial perturbation, including:

[0033] Extract the API feature vector of the malicious software sample, input the API feature vector into the trained generator to obtain the normalized adversarial perturbation vector, add the normalized adversarial perturbation vector to the normalized API feature vector, and perform denormalization to obtain the API feature vector after adversarial perturbation.

[0034] Furthermore, the API feature vector based on the malicious software sample and the API feature vector after the adversarial disturbance is used to obtain an API difference vector, which is expressed as follows:

[0035]

[0036] in, represents the API difference vector, represents the API feature vector after adversarial perturbation, The API feature vector representing the software sample, Representative The number of times an API appears in the API sequence, Representative The number of API calls needs to be increased.

[0037] Furthermore, the large model is used to generate a function code snippet according to each API that needs to be called and the number of times the call is increased, and the source code of the malicious software sample is modified according to the generated function code snippet to obtain the final counter-perturbation code, including:

[0038] Use the big model to generate a code snippet for an API that needs to be called more;

[0039] Encapsulate the generated code snippet into a function according to the number of increasing calls to obtain a function code snippet;

[0040] The large model merges the source code and the function code snippet according to the prompt words generated by the preset prompt word template;

[0041] A code snippet is generated for each API that needs to be called in the API difference vector and merged with the source code to obtain the final adversarial perturbation code.

[0042] Compared with the prior art, the present invention has the following significant advantages: (1) API change prompts for malware escaping dynamic detection are obtained based on feature space countermeasure perturbations; (2) the modification of malware source code is automatically completed based on API change prompts using a large model. This avoids manual coding and greatly improves the efficiency of countermeasure attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a flow chart of the black box anti-disturbance method of the dynamic malware detection model based on a large model of the present invention;

[0044] Figure 2 An adversarial training framework for adversarial sample generation in the present invention;

[0045] Figure 3 This is a flow chart of the code space anti-disturbance method based on a large model of the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0047] like Figure 1 As shown, the present invention provides a black box anti-disturbance method for a dynamic malware detection model based on a large model, comprising the following steps:

[0048] (1) Proxy model construction: Under black-box attack conditions, the target model (i.e., dynamic malware detection model) is unknown. Therefore, a proxy model is trained by querying the target model multiple times to simulate the decision-making behavior of the target model.

[0049] Given a dynamic malware detection model under attack (targeted malware detectionmodel), the detailed steps of agent model construction are as follows:

[0050] (1-1) API sequence sample set construction: The software source code collected from the open source platform (such as GitHub) is compiled with development tools (such as visual studio) to generate an executable file, i.e., a software sample. , use a sandbox (such as Cuckoo) to Run the simulation and get The API sequence (denoted as ),Will Feed , and get the test result (denoted as , For benign software, is malware) This is a sample API sequence. A large number of software samples are tested to obtain a large number of API sequence samples, and an API sequence sample set (denoted as ).

[0051] (1-2) API feature vector extraction: Each API sequence sample , using the "bag of words model" from Extract the API feature vector from the API and record the API feature vector as (in Representative APIs in The number of occurrences in the API sequence is composed of several different types of APIs. API refers to the interface provided by the operating system for developers. It can be simply understood that an API represents an action, and the API sequence of the software represents a series of actions when the software is running). Then the API sequence sample Convert to training samples In all software samples, the order of APIs in the API feature vector is consistent. All APIs can be arranged in lexicographic order from small to large, or in any order.

[0052] (1-3) Proxy model training: The training sample set obtained by converting all API sequence samples in is recorded as . Using any machine learning algorithm based on Train a proxy malware detection model (i.e., proxy model) and record it as .

[0053] (2) Feature space adversarial perturbation: Through the adversarial training method, a trained generator is obtained. The trained generator can perturb the feature vector of the number of API calls of the malware so that the generated perturbed feature vector is judged as benign by the target model.

[0054] Given a proxy model Software samples detected as malware ,right The detailed steps for performing feature space adversarial perturbations are as follows:

[0055] (2-1) Generator Design: Generator It is a VAE (Variational Autoencoder) consisting of an encoder module and a decoder module. Software Sample API feature vector As input, the output is The normalized adversarial perturbation vector of the same dimension (denoted as ).

[0056] (2-2) Adversarial training: Adversarial training frameworks for adversarial sample generation such as Figure 2 The specific steps are as follows:

[0057] (2-2-1) Malicious software samples API feature vector Input to the generator In the above example, we obtain the normalized adversarial perturbation vector .

[0058] (2-2-2) Use MinMax algorithm to convert API feature vector Normalized and compared with Add together to get the normalized adversarial perturbation API feature vector (denoted as ).

[0059] (2-2-3) Yes After denormalization, the API feature vector after anti-perturbation is obtained (denoted as ). In the malware detection adversarial perturbation scenario, the adversarial perturbation of malicious software samples cannot destroy the functions of the software samples themselves, so the adversarial perturbation process only increases the calls of certain APIs without reducing the calls of existing APIs. Using normalization technology to process the adversarial perturbation vector can ensure that all components of the adversarial perturbation vector are non-negative numbers, thereby ensuring that all components of the API feature vector after adversarial perturbation will not decrease, that is, the calls of existing APIs will not be reduced.

[0060] (2-2-4) The API feature vector after the adversarial disturbance Input the target model to be attacked , get the predicted label (1 means malicious, 0 means benign); Importing Proxy Models , get the predicted label .

[0061] (2-2-5) Loss function based on formula (1) Proxy Model Update the parameters so that A better fit prediction results.

[0062] (1)

[0063] in, represents the loss function of the proxy malware detection model, is the cross entropy function.

[0064] (2-2-6) Loss function based on formula (2) Update the parameters of the generator.

[0065] (2)

[0066] in, represents the loss function of the generator, Represents the API feature vector (i.e. ), Represents the API feature vector after adversarial perturbation (i.e. ), represents a benign label (i.e., 0), Represents the proxy model pair The test results, represents the output of the encoder module in the generator; express The probability distribution of Indicates a given Input is The probability distribution of represents the distance between the API feature vector and the adversarial perturbation API feature vector, represents KL divergence; , , Represents the weight coefficient.

[0067] (2-2-6) Repeat steps (2-2-1) to (2-2-6) until the loss functions of the proxy model and the generator converge and a trained generator is obtained.

[0068] (2-3) Feature space adversarial perturbation sample generation: Given a malicious software sample , first extract its API feature vector ; then Input the trained generator to get the normalized API feature vector ; Finally, With normalized Add and denormalize the result to get the API feature vector after the disturbance .

[0069] (3) Code space adversarial perturbation: Based on the API change prompts obtained by feature space adversarial perturbation, the code generation capability of the large model is used to modify the source code of the malicious software sample to obtain adversarial perturbation code that conforms to the API changes.

[0070] like Figure 3 As shown, given a malicious software sample and its feature space adversarial perturbation version ,right The detailed steps for code space adversarial perturbation are as follows:

[0071] (3-1) API call difference acquisition: First, extract the malicious software sample Corresponding API feature vector And the API feature vector after adversarial perturbation . Then, due to and represents the number of calls to each API, and the anti-disturbance is to ensure The malicious functions of the is the API difference vector, where Representative The number of API calls needs to be increased. Figure 3 NtClose, NtCreateFile, NtWriteFile, NtOpenKey, and NtReadFile are all APIs provided by the operating system. The purpose of the code snippets generated by the large model is to enable each code snippet to call the corresponding API separately.

[0072] (3-2) API code snippet generation based on the large model: For each API that needs to be called (denoted as ) and the number of increases (denoted as ), use the large model to generate the corresponding code snippet, the specific steps are as follows:

[0073] (3-2-1) Require the large model to generate a call based on the first prompt word The generated code snippet is recorded as The first prompt word template is as follows:

[0074] Respond to the human as helpfully and accurately as possible.

[0075] Write a C++ function that calls only the { API j} function in theWindows API.Implement this function and ensure that it can call { API j}correctly.

[0076] (3-2-2) Code snippet Encapsulated into a function. The parameter num is The formal parameter needs to be called the number of times. The function code snippet is recorded as .

[0077] The function format is as follows:

[0078] void call_APIj(int num) {

[0079] for(int i=0; i <num;

[0080] i++) {

[0081] { code_api j}

[0082] }

[0083] }.

[0084] (3-3) Adversarial perturbation code generation based on large models: Given an API difference vector , use the large model to generate the final adversarial perturbation code. The specific steps are as follows:

[0085] (3-3-1) Generate a second prompt word based on the second prompt word template, requiring the large model to source code With function code snippet Merge. The second prompt word is not unique and can be set by yourself, as long as it can complete the code merging task. The second prompt word contains 3 parts:

[0086] The first part: Task description, which is used to describe the tasks that the large model needs to perform. The template is as follows: You are a system administrator tasked with integrating two pieces of code, Code A and Code B, for a programming project. Code B is a function, and your goal is to incorporate Code B into Code A. Specifically, modify Code A to call Code B and pass the variable 'num' as an argument. Please provide the combined code.

[0087] Part 2: Contextual learning examples, given one or several real code merging cases, for large models to learn small samples. The real code merging cases can be set by yourself, and can be any code segment. Just fill in the code before and after the merge according to the template format. The template is as follows:

[0088] Give you an example:

[0089] Code A:

[0090] int main()

[0091] {

[0092] {--Sample code of the original program--}

[0093] }

[0094] Code B:

[0095] void call_APIj(int num)

[0096] {

[0097] {--Sample code for target API call--}

[0098] }

[0099] num: {--number of calls sample--}

[0100] You should only return:

[0101] int main()

[0102] {

[0103] {--Sample code of the merged program--}

[0104] }

[0105] The third part: Task objectives, which is used to give the input that the user needs to perform the task. The template is as follows:

[0106] Code A:

[0107] { code k}

[0108] Code B:

[0109] { code_func_api j}

[0110] num: num j

[0111] (3-3-2) Each element in represents the number of certain APIs to be added, and 0 means no need to add. For each non-zero component in (i.e., the API that needs to be called), the first prompt word and the second prompt word are generated using the method of steps (3-2) and (3-3-1), and then input into the large model source code and Merge and Updated with merged code.

[0112] (3-3-3) Repeat step (3-3-2) until All non-zero components of are processed. Then the final The code is the perturbation-resistant code.

[0113] (3-3-4) The adversarial perturbation code that has undergone code space perturbation is recompiled using a development tool to generate an executable file. The executable file is analyzed using a sandbox to obtain an API sequence. The API sequence is input into the target model (i.e., dynamic malware detection model) and the proxy model for detection. If both the target model and the proxy model are detected as benign, the perturbation is successful.

[0114] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A black-box adversarial perturbation method for a dynamic malware detection model based on a large model, characterized in that: The black box adversarial perturbation method for a dynamic malware detection model based on a large model includes: Given a dynamic malware detection model, an API sequence sample set is constructed based on the dynamic malware detection model, and the API sequence sample set is converted into a training sample set; The agent malware detection model is trained based on the training sample set using a machine learning algorithm; Construct a generator, use the proxy malware detection model to obtain a trained generator through adversarial training, use the trained generator to perform adversarial perturbation on the feature space of the API feature vector of the software sample detected as malicious by the proxy malware detection model, and obtain the API feature vector after adversarial perturbation; Based on the API feature vector of the malicious software sample and the API feature vector after adversarial perturbation, an API difference vector is obtained, which includes the APIs that need to be called more and the number of times the calls are increased; The large model is used to generate function code snippets according to each API that needs to be called and the number of times the call is increased. The source code of the malicious software sample is modified according to the generated function code snippets to obtain the final adversarial perturbation code. in: The method of using the large model to generate a function code snippet according to each API that needs to be called and the number of times the call is increased, and modifying the source code of the malicious software sample according to the generated function code snippet to obtain the final counter-disturbance code includes: Using the large model, according to a preset prompt word template, a first prompt word and a second prompt word are generated for an API that needs to be added to the API difference vector; Generate a code snippet for calling the API that needs to be called according to the first prompt word using the large model; Encapsulating the code snippet into a function according to the number of times the call is increased to obtain a function code snippet; Using the large model to merge the source code and the function code snippet according to the second prompt word, and updating the source code to the merged code; Generate, merge and update the code for each API that needs to be called to obtain the final adversarial perturbation code.

2. The black box anti-disturbance method for dynamic malware detection model based on a large model according to claim 1 is characterized in that: The API sequence sample set is constructed based on the dynamic malware detection model, including: Given a software sample, a sandbox is used to simulate the running of the software sample to obtain the API sequence of the software sample, the API sequence is input into a dynamic malware detection model to obtain a detection result, and an API sequence sample is obtained based on the API sequence and the detection result; Operate on multiple software samples to obtain API sequence samples of each software sample to form an API sequence sample set.

3. The black box anti-disturbance method for dynamic malware detection model based on a large model according to claim 2 is characterized in that: The step of converting the API sequence sample set into a training sample set includes: Extracting an API feature vector from the API sequence of each API sequence sample in the API sequence sample set; The API sequence of the API sequence sample is replaced with the API feature vector to obtain a training sample set.

4. The black box anti-disturbance method for dynamic malware detection model based on a large model according to claim 1 is characterized in that: The generator is constructed to obtain a trained generator using a proxy malware detection model through adversarial training, including: Constructing a generator, the generator comprising an encoder module and a decoder module; Input the API feature vector of the software sample detected as malicious by the proxy malware detection model into the generator to obtain the normalized adversarial perturbation vector; Normalize the API feature vector and add it to the normalized adversarial perturbation vector to obtain the normalized adversarially perturbed API feature vector; Denormalize the normalized API feature vector after adversarial perturbation to obtain the API feature vector after adversarial perturbation; Input the adversarially perturbed API feature vector into the dynamic malware detection model to obtain the predicted label , input the adversarially perturbed API feature vector into the proxy malware detection model to obtain the predicted label ; The parameters of the proxy malware detection model are updated based on the loss function of the proxy malware detection model. The loss function of the proxy malware detection model is expressed by the following formula: ； in, represents the loss function of the proxy malware detection model, represents the cross entropy function; The parameters of the generator are updated based on the loss function of the generator, and the loss function of the generator is expressed by the following formula: ； in, represents the loss function of the generator, represents the API feature vector, represents the API feature vector after adversarial perturbation, represents a benign label, represents the output of the encoder module in the generator; express The probability distribution of Indicates a given Input is The probability distribution of represents the distance between the API feature vector and the adversarial perturbation API feature vector, represents KL divergence; , , represents the weight coefficient; Repeatedly input the API feature vectors of software samples detected as malicious by the proxy malware detection model into the generator, and update the parameters of the generator until the loss function of the proxy malware detection model and the generator converges to obtain a trained generator.

5. The black box anti-disturbance method for dynamic malware detection model based on a large model according to claim 1 is characterized in that: The method uses the trained generator to perform feature space adversarial perturbation on the API feature vector of the software sample detected as malicious by the proxy malware detection model to obtain the API feature vector after adversarial perturbation, including: Extract the API feature vector of the malicious software sample, input the API feature vector into the trained generator to obtain the normalized adversarial perturbation vector, add the normalized adversarial perturbation vector to the normalized API feature vector, and perform denormalization to obtain the API feature vector after adversarial perturbation.

6. The black box anti-disturbance method for dynamic malware detection model based on a large model according to claim 1, characterized in that: The API difference vector is obtained by combining the API feature vector of the malicious software sample and the API feature vector after the adversarial disturbance, which is expressed as follows: ； in, represents the API difference vector, represents the API feature vector after adversarial perturbation, The API feature vector representing the software sample, Representative The number of times an API appears in the API sequence, Representative The API needs to increase the number of calls.

Images