Software detection method and device, electronic equipment, storage medium and program product

Abstract

The invention relates to a software detection method and device, electronic equipment, a storage medium and a program product. The method comprises the steps of obtaining a function calling behavior sequence of to-be-detected software; decomposing the function call behavior sequence into a time sequence feature and a structure sequence feature, and obtaining a time sequence feature representation and a structure feature representation of the function call behavior sequence based on the time sequence feature and the structure sequence feature; and inputting the time sequence feature representation and the structural feature representation into a trained multi-layer perceptron model to obtain a software type detection result of the to-be-detected software. And inputting the time sequence feature representation and the structural feature representation into the trained multi-layer perceptron model to obtain a software type detection result of the to-be-detected software. Due to the fact that the time sequence features and the structure sequence features of the to-be-detected software can be obtained, the context interaction semantics of the functions in the to-be-detected software can be obtained, and the ransomware can be recognized more accurately.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a software detection method, device, electronic device, storage medium, and program product. Background Art

[0002] With the rise of virtual currency, malware attacks and service technologies represented by ransomware have developed rapidly. At the same time, with the maturity of transformation technologies such as variants and code obfuscation, the quantity and quality of ransomware have continued to improve, and the threat level has continued to rise.

[0003] In the related art, the detection methods of ransomware mainly include static analysis and dynamic analysis. The static analysis method mainly analyzes the static features of suspicious files and determines whether the files are ransomware according to predefined rules. The dynamic analysis method requires running the program to be detected in a sandbox environment and determining whether the software is ransomware by analyzing the dynamic execution sequence of the program.

[0004] However, new variants of ransomware generated by code obfuscation or packaging technology can easily tamper with known file signatures, thus easily evading detection by static detection methods. In addition, ransomware often hides malicious behavior, resulting in the inability of dynamic detection methods to effectively detect ransomware. Therefore, both static detection methods and dynamic detection methods in related technologies have the problem of low efficiency in detecting ransomware. Summary of the invention

[0005] The present disclosure provides a software detection method, device, electronic device, storage medium and program product.

[0006] According to a first aspect of the present disclosure, a software detection method is provided, the method comprising:

[0007] Obtain the function call behavior sequence of the software to be detected;

[0008] Decomposing the function call behavior sequence into time series features and structure sequence features, and obtaining a time series feature representation and a structure feature representation of the function call behavior sequence based on the time series features and the structure sequence features;

[0009] The temporal feature representation and the structural feature representation are input into the trained multi-layer perceptron model to obtain a software type detection result for the software to be detected.

[0010] According to a second aspect of the present disclosure, a software detection device is provided, the device comprising:

[0011] A function call behavior sequence acquisition module is used to acquire the function call behavior sequence of the software to be detected;

[0012] A feature decomposition module, used to decompose the function call behavior sequence into time series features and structure sequence features, and obtain a time series feature representation and a structure feature representation of the function call behavior sequence based on the time series features and the structure sequence features;

[0013] The software detection module is used to input the temporal feature representation and the structural feature representation into the trained multi-layer perceptron model to obtain a software type detection result for the software to be detected.

[0014] According to a third aspect of the present disclosure, an electronic device is provided, which includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, the method described above is implemented.

[0015] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the above method of the present disclosure is implemented.

[0016] According to a fifth aspect of the present disclosure, a computer program product is provided, including a computer program, wherein the computer program implements the above method of the present disclosure when executed by a processor.

[0017] The software detection method, device, electronic device, storage medium and program product provided by the embodiments of the present disclosure obtain the function call behavior sequence of the software to be detected, decompose the function call behavior sequence into time series features and structural sequence features, and obtain the time series feature representation and structural feature representation of the function call behavior sequence based on the time series features and structural sequence features. By inputting the time series feature representation and the structural feature representation into the trained multi-layer perceptron model, the software type detection result of the software to be detected can be obtained. Since the embodiments can obtain the time series features and structural sequence features of the software to be detected, the contextual interaction semantics of the functions in the software to be detected can be obtained, which can more accurately identify ransomware. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Further details, features and advantages of the present disclosure are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0019] Figure 1 A schematic diagram of software code provided for an exemplary embodiment of the present disclosure;

[0020] Figure 2 A schematic diagram of a ransomware detection framework provided for an exemplary embodiment of the present disclosure;

[0021] Figure 3 A schematic diagram of a ransomware execution behavior sequence provided for an exemplary embodiment of the present disclosure;

[0022] Figure 4 A schematic diagram of a ransomware function call provided for an exemplary embodiment of the present disclosure;

[0023] Figure 5 A schematic diagram of a framework of a text temporal vector learning model provided by an exemplary embodiment of the present disclosure;

[0024] Figure 6 A flowchart of a software detection method provided for an exemplary embodiment of the present disclosure;

[0025] Figure 7 A schematic block diagram of functional modules of a software detection device provided for an exemplary embodiment of the present disclosure;

[0026] Figure 8 A structural block diagram of an electronic device provided for an exemplary embodiment of the present disclosure;

[0027] Fig. 9 A structural block diagram of a computer system provided for an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0029] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0030] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc. mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0031] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0032] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0033] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0034] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0035] As an optional but non-limiting implementation, in response to receiving an active request from the user, the method of sending a prompt message to the user may be, for example, a pop-up window, in which the prompt message may be presented in text. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device. It is understandable that the above notification and the process of obtaining user authorization are only illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0036] In recent years, with the rise of virtual currencies, malware attacks and service technologies represented by ransomware have developed rapidly. At the same time, with the maturity of transformation technologies such as variants and code obfuscation, the quantity and quality of malicious ransomware continue to improve, and the threat level continues to rise. According to a recent Sophos report, 66% of organizations will be attacked by ransomware by 2023. The success rate of ransomware encrypted data has increased from 34% in 2020 to 65% today; the proportion of network users attacked by ransomware continues to rise.

[0037] At present, malicious ransomware detection methods are roughly divided into two technical means: static analysis and dynamic analysis. Among them, the static analysis method analyzes the static features of suspicious files, such as binary code segments or function names, and determines whether the file is malicious ransomware according to predefined rules. The static detection method does not need to run the software to be tested, and the detection speed is fast. However, new variants of ransomware generated by code obfuscation or packaging technology can easily tamper with known file signatures, thereby effortlessly evading the static detection method. The dynamic detection method requires running the program to be detected in a sandbox environment and analyzing the dynamic execution sequence of the program to determine whether the software is malware. However, ransomware often hides malicious behaviors in a large number of benign spatiotemporal behavior features to evade dynamic detection, resulting in high false positives in the existing API (Application Programming Interface) call analysis method, and this type of method often loses the contextual interaction semantics of the API. Therefore, the above two methods have their own disadvantages and cannot meet the needs of malicious ransomware detection.

[0038] Specifically, the ransomware detection methods in related technologies mainly have the following problems:

[0039] (1) The execution behavior of malicious ransomware is essentially composed of a series of function call events, such as Figure 1 As shown, Figure 1 The software code diagram is shown in Figure 2. The software execution behavior contains time information and underlying behavior interaction information. Ransomware usually uses obfuscation technology to hide malicious event call behaviors in a large number of benign behaviors. Related technologies cannot organically integrate the function call time evolution pattern with the function call context structure pattern, nor can they accurately identify malicious function call sequences from a large number of benign event call sequences. Figure 1 It can include API name (function name) and API category (function category) etc.

[0040] (2) Ransomware has a huge number of function call sequences and call combinations. Related technologies usually rely on expert knowledge to manually extract possible call sequences and combinations from the historical execution behavior of the ransomware. They are unable to efficiently model historical function call sequences to automatically infer the ransomware's attack intent. As a result, related technologies require high levels of expert knowledge and runtime latency, and are unable to meet the real-time requirements of ransomware detection.

[0041] (3) Most of the related ransomware detection methods analyze the static and dynamic features of the ransomware in isolation, and only consider explicit interactive relationships. They are unable to fully utilize the implicit execution sequences of malicious ransomware to mine the interactive behavior patterns between heterogeneous ransomware variant entities. At the same time, the single-mode relationships are sparse and partially invalid, making it impossible to detect the packed ransomware variants with disguised behaviors.

[0042] Therefore, the disclosed embodiments provide a software detection method based on spatiotemporal behavior feature analysis. By integrating a data-driven ransomware detection framework with temporal feature learning and structural representation learning, a dynamic execution behavior sequence of ransomware is constructed using heterogeneous information networks, and the ransomware function execution behavior is integrated. The original function execution events of malicious ransomware are divided into function time series and underlying function category interactions. At the same time, the fingerprint features of malicious ransomware are identified from multiple dimensions to mine hidden ransomware variant behavior patterns, which can achieve in-depth and efficient detection of packed or hidden malicious ransomware.

[0043] Specifically, in the embodiment, Figure 2 As shown, Figure 2 A schematic diagram of a ransomware detection framework provided by an embodiment of the present disclosure, including the construction of a heterogeneous information network of ransomware function call sequences, multi-dimensional ransomware behavior decomposition, temporal vector learning based on text convolution, structural embedding learning based on dense interaction graph attention network, and ransomware detection.

[0044] 1) Modeling of heterogeneous information network of ransomware execution sequence. By deploying the software to be detected in a cloud sandbox, its function call behavior sequence is obtained, and an execution sequence heterogeneous information network is constructed. The function call behavior sequence is used to construct a sequence heterogeneous information network, that is, the interactive relationships such as function calls, process wake-ups or network requests between malware are represented by heterogeneous information networks. And the constructed function call sequence heterogeneous information network has different types of nodes and relationships, denoted as G = {ν, ε, T, R, φ, ψ}. Among them, v and ε represent the node set and edge set in the graph respectively, and T and R correspond to the node type and edge type in the graph respectively. φ:ν→T means mapping each node to its corresponding type, and ψ:ε→R means mapping each edge to its type. The behavior sequence heterogeneous information network constructed in the present embodiment includes four entity objects: process (P), file (F), network request (N) and digital signature (R), and the calling relationships between them, such as Figure 3 As shown, Figure 3 A schematic diagram of the ransomware execution behavior sequence provided in the embodiment of the present disclosure. In which, s represents sending, f represents waking up, a and a - Respectively represent access, c and c - Respectively represent copy, o and o - Represents an operation. For example, Figure 3 In the example, M3 represents process P. 1 and P 2 All accessed file F 1 .

[0045] 2) Multi-dimensional ransomware behavior decomposition.

[0046] (1) The software to be tested can be input into the Cuckoo Sandbox to generate its corresponding function call sequence, which is composed of multiple function call events and has an inherent logical relationship of sequence. Figure 4 As shown, Figure 4 A schematic diagram of a ransomware function call provided in an embodiment of the present disclosure, Figure 4 It includes two parts: API operation (function operation) and FunctionalDescription (function description). The functional description is used to indicate which execution functions the function has. Each function operation represents a different function function, and each function performs different operation behaviors. Different from the method of analyzing isolated time dependencies, the embodiment decomposes the function execution behavior sequence into two dimensions, which include a sequence of timing function names and a sequence of underlying function category structures. The spatiotemporal behavior features can simultaneously collect evidence of ransomware attack behaviors from both the timing and structure dimensions.

[0047] (2) For the function category interaction set E, five types of entities (including: process, file, network, system and registration center) and five types of interaction relationships are extracted to describe the interaction behavior relationship between multiple entities in heterogeneous information networks. Represented as two different nodes A l and A l+1 The specific form of the composite path is in To represent composite operations in computing, different malware can be connected through multiple meta-paths (e.g., process-process, process-file, process-network, process-system, process-registration). These malware entities and relationships are modeled using heterogeneous information networks. By establishing call relationships between nodes, the comprehensive contextual semantics of malware can be effectively represented.

[0048] 3) Time series vector learning based on text convolution. For the time series function name sequence, it can be regarded as English text, where each function name (such as WriteFile) can be regarded as an English word, so the malicious ransomware time vector learning problem can be transformed into a text embedding problem. In order to effectively obtain the text embedding information of the function, the embodiment of the present disclosure proposes a time series vector learning method based on text convolution. The specific calculation process is as follows:

[0049] (1) Duplicate subsequence filtering. There will be frequent function calls during the software operation, such as behavior calls related to file operations, network behaviors, and registry operations. Some ransomware will deliberately add a large number of invalid behavior calls to increase the difficulty of detection. The call sequences of some samples are particularly long, which not only increases the execution time of the algorithm but also reduces the detection performance. Therefore, it is crucial to deduplicate the original behavior call name sequence. The function name sequence deduplication can be achieved by removing consecutive repeated calls. For example, taking the call sequence "ABBBCCCNBA" as an example, the "ABCNBA" call sequence can be obtained through the continuous repeated call deduplication method.

[0050] (2) Text convolutional time series vector learning. Figure 5 As shown, Figure 5 A schematic diagram of the framework of the text time series vector learning model provided by the present disclosure. The text convolution time series vector learning model provided by the embodiment of the present disclosure can be divided into three parts: an embedding layer, a convolution layer, and a maximum pooling layer. Among them, the embedding layer can convert a non-repeating function name sequence into a word vector matrix, and the convolution layer sets convolution kernels of different dimensions (such as 3, 4, 5) to perform convolution operations and extract local features. The maximum pooling layer performs a maximum pooling operation on the convolution result to obtain three sequences, and then connects the above sequences in series to generate the final malicious time vector h T .

[0051] 4) Structural embedding learning based on dense interaction graph attention network.

[0052] In order to accurately identify polymorphic malware, it is crucial to associate the studied time evolution patterns with specific underlying contextual semantic information. To this end, the disclosed embodiment adopts dense neighborhood and hierarchical graph attention network to aggregate the contextual information between explicit and implicit interactions in the malware heterogeneous graph, which can effectively capture the important attack semantic information in the underlying function category interaction of ransomware. Given the constructed execution behavior heterogeneous information network of the software to be detected, the fine-grained structure representation can be captured by the following steps.

[0053] (1) Searching for the neighborhood N based on the meta-path (m) In order to capture semantically unique malware attack patterns, the disclosed embodiments may utilize Figure 3 Specifically, given a set of meta-paths M m , the neighborhood node set N (m) It can be obtained by formula (1).

[0054] N (m) ={u|(u,p)∈M m (p,u)∈M m} (1)

[0055] Among them, N (m) Indicates that process p is on meta-path M m All neighbor nodes that node u can visit during random walk.

[0056] (2) Exploring Dense Neighborhoods Based on Metagraphs In the neighborhood Based on , the embodiment starts to expand the 0-1 order neighbors as their hidden neighbors. Formally, the element path M m Guided Dense Neighborhood It can be expressed as:

[0057]

[0058] in, represents the dense neighborhood of each node p, D (0) (p) and represents the 0th-order neighbors and the 1st-order neighbors of node p, Indicates the i-th order neighbor node. In the embodiment, the neighbor nodes of a certain node with different hop counts can be found through formula (2), and the neighbor nodes found by formula (2) can be aggregated into a set through formula (3). Represents the neighbor nodes that are aggregated in the set.

[0059] (3) Aggregation Node-Level Representation The embodiment first starts from a dense neighborhood based on the meta-path Get node-level representation Node Attention Weight And the k-th node-level aggregation operation can be formalized as:

[0060]

[0061] Among them, k represents the number of layer indexes, and They are the node-level aggregation representations of the target process node p and its corresponding task node u at the k-1th layer. represents the meta-path-based neighborhood of all p, a u is the neighbor node u in The node weights in , b is the bias parameter. The complete node-level representation can be formalized as:

[0062]

[0063] (4) Generate graph-level structure representation h G Finally, a readout function is implemented to obtain a graph-level representation that integrates all node features.

[0064] h G=READOUT(h v |v∈G) (7)

[0065] 5) Ransomware detection. The embodiment detects the multi-dimensional attack mode of ransomware by training a multi-layer perceptron (MLP) based detector. The multi-layer perceptron detector receives the learned time series feature representation h T And the structural features represent h G , and output the detection results after neural network training.

[0066]

[0067] Wherein, || represents a connection operation, σ is a nonlinear activation function, such as a Sigmoid activation function, b is a bias parameter, and w represents a weight. The embodiment may use a cross loss function as the final goal to optimize the ransomware detection model.

[0068]

[0069] Among them, Y and They represent the real labeled ransomware and the ransomware predicted by the model respectively. Based on formula (9) and the back propagation algorithm, an automated ransomware detection model can be trained to achieve accurate and efficient ransomware detection.

[0070] Based on the above embodiments, it can be seen that the embodiments of the present disclosure can mine the malicious attack patterns of ransomware from the two dimensions of time and space, and realize the real-time detection of new unknown ransomware variants. In addition, the embodiments use heterogeneous information networks to model the execution behavior sequence of malicious ransomware, integrate multimodal information such as processes, functions, networks, files, and registrations, and interactive relationships, and learn the time characteristics and structural characteristics of ransomware attack behaviors at the same time through time feature learning and structural feature learning, and learn the ransomware call behavior patterns from the time-space dimension, so as to detect highly concealed ransomware.

[0071] In addition, the embodiment transforms the behavior call name sequence learning problem into a text embedding representation task, and proposes a time series vector learning method based on text convolution to process the time series call event name sequence. In order to reduce the training time cost, a repeated subsequence filtering algorithm is designed to achieve duplicate removal of call event repeated sequences and enhancement of key attack information, thereby achieving real-time ransomware detection. In addition, the embodiment explores the interactive behavior patterns between different ransomware entities by designing a variety of meta-paths with real physical meanings. The designed meta-paths follow specific domain expert knowledge, which can effectively improve the interpretability of the model and facilitate the deployment and application of the model.

[0072] Based on the above embodiments, the present disclosure also provides a software detection method, such as Figure 6As shown, the method may include the following steps:

[0073] In step S610, a function calling behavior sequence of the software to be detected is obtained.

[0074] In an embodiment, code detection can be performed on the software to be detected to obtain the functions (API) contained in the software to be detected and the calling behaviors of these functions during the execution of the software to be detected, so as to obtain the function calling behavior sequence of the software to be detected, that is, the calling behavior of each function of the software to be detected during the execution process.

[0075] In step S620, the function call behavior sequence is decomposed into time series features and structure sequence features, and based on the time series features and the structure sequence features, a time series feature representation and a structure feature representation of the function call behavior sequence are obtained.

[0076] In the embodiment, since the software to be tested may include multiple functions, these functions will have a time calling sequence during the software execution process, and there will be interactive behaviors between functions. Therefore, the function calling behavior sequence can be decomposed into time series features and structure sequence features. The time series features can represent the calling sequence of each function on the time axis, and the structure sequence features can represent the interactive relationship between functions. Figure 3 As shown, the structural sequence characteristics can be specifically reflected in four types of nodes, namely, process, file, network request and digital signature. For example, a function calls a file, a file sends a network request, etc. The embodiment is not limited to this.

[0077] In step S630, the temporal feature representation and the structural feature representation are input into the trained multi-layer perceptron model to obtain a software type detection result for the software to be detected.

[0078] In an embodiment, the time series feature representation of the time series feature can be obtained through text convolution time series vector learning, and by constructing the relationship between the four types of nodes of the software to be detected, the numerical representation of the nodes and edges can be constructed using the graph attention network (GAT) learning, which can be embedded in a low-dimensional numerical vector space to obtain a structural feature representation of the structural sequence feature. In this way, the time series feature representation and the structural feature representation are input into the trained multi-layer perceptron model to determine whether the software to be detected is ransomware, or what type of ransomware it is, etc.

[0079] In the embodiment, when training the multi-layer perceptron model, the training samples can be obtained, and the cross loss function can be used as the target condition to train the multi-layer perceptron model through the training samples to obtain the trained multi-layer perceptron model. The training samples include the temporal feature representation and structural feature representation of the preset software, and carry the label of the corresponding software category. The multi-layer perceptron model can be specifically the multi-layer perceptron detector in the above embodiment, and the temporal feature representation and structural feature representation of the training samples can be specifically obtained by the method of the above embodiment.

[0080] In the embodiment, a multi-dimensional attack mode of ransomware is detected by training a multi-layer perceptron model. The multi-layer perceptron model can receive the learned time series feature representation h T And the structural features represent h G , and output the detection result of the software. The embodiment can use the cross loss function as the final goal to optimize the model and achieve accurate and efficient detection of ransomware.

[0081] The software detection method provided by the embodiment of the present disclosure obtains the function call behavior sequence of the software to be detected, decomposes the function call behavior sequence into time series features and structural sequence features, and obtains the time series feature representation and structural feature representation of the function call behavior sequence based on the time series features and structural sequence features. By inputting the time series feature representation and the structural feature representation into the trained multi-layer perceptron model, the software type detection result of the software to be detected can be obtained. Since the embodiment can obtain the time series features and structural sequence features of the software to be detected, the contextual interaction semantics of the functions in the software to be detected can be obtained, which can more accurately identify ransomware.

[0082] Based on the above embodiment, in another embodiment provided by the present disclosure, the above step S620 may further include the following steps:

[0083] In step S621, a function call sequence of the software to be detected is obtained, wherein the function call sequence includes a plurality of function call events.

[0084] In an embodiment, the software to be detected may be input into the cuckoo sandbox to generate its corresponding function call sequence, and the function call sequence may be composed of multiple function call events, including an internal sequential logical relationship.

[0085] In step S622, the function call sequence is decomposed into a sequential function name sequence and an underlying function category interaction sequence.

[0086] In the embodiment, the time-series function name sequence can be regarded as English text, where each function name can be regarded as an English word, so the ransomware time vector learning problem can be transformed into a text embedding problem. The embodiment can also use dense neighborhood and hierarchical graph attention network to aggregate context information between explicit and implicit interactions in the malware heterogeneous graph, which can effectively capture important attack semantic information in the interaction of underlying function categories of ransomware.

[0087] In step S623, time series features are generated based on the time series function name sequence, and structure sequence features are generated based on the underlying function category interaction sequence.

[0088] In the embodiment, there will be frequent function calls during the software operation, such as behavior calls related to file operations, network behaviors, or registry operations. Some ransomware will deliberately add a large number of invalid behavior calls to increase the difficulty of detection. Since the call sequence of some samples is particularly long, this not only increases the execution time of the algorithm, but also reduces the detection performance. Therefore, it is necessary to deduplicate the original behavior call name sequence, which can be achieved by removing consecutive repeated calls, so that repeated subsequences can be filtered.

[0089] In the embodiment, when obtaining the temporal feature representation of the function call behavior sequence, the time series feature can be input into the text convolutional temporal vector learning model (text CNN model) to obtain the temporal feature representation h of the function call behavior sequence. T Among them, the text convolutional time series vector learning model includes an embedding layer, a convolution layer, and a maximum pooling layer; the embedding layer is used to convert a non-repeating function name sequence into a word vector matrix, the convolution layer is used to perform convolution operations on word vector matrices of different dimensions, and the maximum pooling layer is used to perform maximum pooling operations on the convolution results.

[0090] In an embodiment, when obtaining the structural feature representation of the function call behavior sequence, the structural sequence features can be input into a structural embedding learning model to obtain the structural feature representation of the function call behavior sequence. The structural sequence features are obtained by the structural embedding learning model based on the neighborhood of the meta-path, a dense neighborhood based on the meta-graph is obtained based on the dense hidden neighbors in the neighborhood, and the structural feature representation is obtained based on the dense neighborhood. Specifically, the node-level representation and node attention weight of each layer of the function call behavior sequence can be obtained based on the dense neighborhood, and the node-level representation of each layer can be aggregated based on the node attention weight to obtain the structural feature representation h G For details, please refer to the description of the above embodiments, which will not be repeated here.

[0091] In summary, the disclosed embodiments propose a ransomware detection method based on spatiotemporal behavior feature analysis to address the challenges of fast ransomware mutation, multiple types, low detection efficiency, high false alarm rate, and difficulty in mining implicit ransomware attack clues. The ransomware execution behavior call sequence is constructed using heterogeneous information networks, and information such as functions, processes, files, networks, and registrations are integrated to mine explicit and implicit ransomware interaction patterns; the text convolution-based temporal feature learning method and the dense interaction graph attention network structure embedding method designed in the disclosed embodiments can simultaneously mine the ransomware attack behavior patterns in both time and space dimensions; at the same time, the embodiments introduce spatiotemporal multimodal feature learning technology into the field of ransomware detection, which can solve the spatiotemporal multimodal feature fusion and joint representation problems, and can achieve efficient and real-time detection of new unknown ransomware.

[0092] The disclosed embodiments can effectively capture the attack evolution pattern of ransomware. In addition, in order to reduce the training cost, the method designs a repeated subsequence filtering algorithm to achieve non-repetition of function name sequences, which not only retains key attack information but also improves real-time detection efficiency, thereby meeting the real-time ransomware detection requirements. In addition, the disclosed embodiments use heterogeneous information networks to model malware function category interactions, propose a dense interaction model and use the structural embedding method of the graph attention network to generate a fine-grained structural representation, which has the ability to fuse the comprehensive contextual semantic knowledge between explicit and implicit neighbors, thereby improving the effectiveness of malware detection.

[0093] In the case of dividing each functional module according to each function, an embodiment of the present disclosure provides a software detection device, which may be a server, a terminal, or a chip applied to a server. Figure 7 The following is a schematic block diagram of the functional modules of a software detection device provided by an exemplary embodiment of the present disclosure. Figure 7 As shown, the software detection device includes:

[0094] A function call behavior sequence acquisition module 10 is used to acquire the function call behavior sequence of the software to be detected;

[0095] A feature decomposition module 20, used to decompose the function call behavior sequence into time series features and structure sequence features, and obtain a time series feature representation and a structure feature representation of the function call behavior sequence based on the time series features and the structure sequence features;

[0096] The software detection module 30 is used to input the temporal feature representation and the structural feature representation into the trained multi-layer perceptron model to obtain a software type detection result for the software to be detected.

[0097] Based on the above embodiment, in another embodiment provided by the present disclosure, the feature decomposition module is specifically used for:

[0098] Acquire a function call sequence of the software to be detected, wherein the function call sequence includes a plurality of function call events;

[0099] Decomposing the function call sequence into a temporal function name sequence and an underlying function class interaction sequence;

[0100] A time series feature is generated based on the time series function name sequence, and a structure sequence feature is generated based on the underlying function category interaction sequence.

[0101] Based on the above embodiment, in another embodiment provided by the present disclosure, the feature decomposition module is further used to:

[0102] The time series features are input into the text convolutional time series vector learning model to obtain the time series feature representation of the function call behavior sequence; wherein the text convolutional time series vector learning model includes an embedding layer, a convolution layer and a maximum pooling layer; the embedding layer is used to convert a non-repeating function name sequence into a word vector matrix, the convolution layer is used to perform convolution operations on word vector matrices of different dimensions, and the maximum pooling layer is used to perform maximum pooling operations on the convolution results.

[0103] Based on the above embodiment, in another embodiment provided by the present disclosure, the feature decomposition module is further used to:

[0104] The structural sequence features are input into a structural embedding learning model to obtain a structural feature representation of the function call behavior sequence; wherein, the structural sequence features are obtained through the structural embedding learning model based on a neighborhood of a meta-path, a dense neighborhood based on a meta-graph is obtained based on dense hidden neighbors in the neighborhood, and the structural feature representation is obtained based on the dense neighborhood.

[0105] Based on the above embodiment, in another embodiment provided by the present disclosure, the feature decomposition module is further used to:

[0106] Acquire node-level representations and node attention weights of each layer of the function call behavior sequence based on the dense neighborhood;

[0107] The node-level representations of each layer are aggregated based on the node attention weights to obtain a structural feature representation.

[0108] Based on the above embodiment, in another embodiment provided by the present disclosure, the device further includes a training module, and the training module is specifically used to:

[0109] Obtaining training samples; wherein the training samples include temporal feature representation and structural feature representation of preset software, and carry labels corresponding to software categories;

[0110] The cross loss function is used as the target condition, and the multilayer perceptron model is trained through the training samples to obtain the trained multilayer perceptron model.

[0111] The software detection device provided by the embodiment of the present disclosure obtains the function call behavior sequence of the software to be detected, decomposes the function call behavior sequence into time series features and structural sequence features, and obtains the time series feature representation and structural feature representation of the function call behavior sequence based on the time series features and structural sequence features. By inputting the time series feature representation and the structural feature representation into the trained multi-layer perceptron model, the software type detection result of the software to be detected can be obtained. Since the embodiment can obtain the time series features and structural sequence features of the software to be detected, the contextual interaction semantics of the functions in the software to be detected can be obtained, which can more accurately identify ransomware.

[0112] An embodiment of the present disclosure also provides an electronic device, comprising: at least one processor; and a memory for storing instructions executable by the at least one processor; wherein the at least one processor is configured to execute the instructions to implement the above method disclosed in the embodiment of the present disclosure.

[0113] Figure 8 The structure diagram of an electronic device provided by an exemplary embodiment of the present disclosure is shown in FIG. Figure 8 As shown, the electronic device 1800 includes at least one processor 1801 and a memory 1802 coupled to the processor 1801 , and the processor 1801 can execute corresponding steps in the above method disclosed in the embodiment of the present disclosure.

[0114] The processor 1801 may also be referred to as a central processing unit (CPU), which may be an integrated circuit chip having signal processing capabilities. Each step in the method disclosed in the embodiment of the present disclosure may be completed by an integrated logic circuit of hardware in the processor 1801 or by instructions in the form of software. The processor 1801 may be a general-purpose processor, a digital signal processor (DSP), an ASIC (Application Specific Integrated Circuit), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present disclosure may be directly embodied as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in a decoding processor. The software module may be located in a memory 1802, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, or other mature storage media in the art. The processor 1801 reads the information in the memory 1802 and completes the steps of the method in combination with its hardware.

[0115] In addition, when various operations / processes according to the present disclosure are implemented by software and / or firmware, they can be transmitted from a storage medium or a network to a computer system having a dedicated hardware structure, such as Fig. 9 The computer system 1900 shown is installed with the programs constituting the software. When the various programs are installed, the computer system can perform various functions, including the functions described above. Fig. 9 A structural block diagram of a computer system provided for an exemplary embodiment of the present disclosure.

[0116] Computer system 1900 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0117] like Fig. 9As shown, the computer system 1900 includes a computing unit 1901, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1902 or a computer program loaded from a storage unit 1908 to a random access memory (RAM) 1903. In the RAM 1903, various programs and data required for the operation of the computer system 1900 can also be stored. The computing unit 1901, the ROM 1902, and the RAM 1903 are connected to each other via a bus 1904. An input / output (I / O) interface 1905 is also connected to the bus 1904.

[0118] A plurality of components in the computer system 1900 are connected to the I / O interface 1905, including: an input unit 1906, an output unit 1907, a storage unit 1908, and a communication unit 1909. The input unit 1906 may be any type of device capable of inputting information to the computer system 1900, and the input unit 1906 may receive input digital or character information, and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 1907 may be any type of device capable of presenting information, and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 1908 may include, but is not limited to, a disk, an optical disk. The communication unit 1909 allows the computer system 1900 to exchange information / data with other devices over a network such as the Internet, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0119] The computing unit 1901 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 1901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 1901 performs the various methods and processes described above. For example, in some embodiments, the above methods disclosed in the embodiments of the present disclosure may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 1908. In some embodiments, part or all of the computer program may be loaded and / or installed on an electronic device via ROM 1902 and / or communication unit 1909. In some embodiments, the computing unit 1901 may be configured to perform the above methods disclosed in the embodiments of the present disclosure in any other appropriate manner (e.g., by means of firmware).

[0120] The embodiment of the present disclosure further provides a computer-readable storage medium, wherein when instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the above method disclosed in the embodiment of the present disclosure.

[0121] The computer-readable storage medium in the disclosed embodiments may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. The computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. More specifically, the computer-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0122] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0123] The embodiments of the present disclosure further provide a computer program product, including a computer program, wherein when the computer program is executed by a processor, the above method disclosed in the embodiments of the present disclosure is implemented.

[0124] In embodiments of the present disclosure, computer program codes for performing the operations of the present disclosure may be written in one or more programming languages ​​or combinations thereof, including but not limited to object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer.

[0125] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0126] The modules, components or units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the names of the modules, components or units do not, in some cases, limit the modules, components or units themselves.

[0127] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0128] The above descriptions are only some embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, a technical solution formed by replacing the above features with the technical features with similar functions disclosed in the present disclosure (but not limited to).

[0129] Although some specific embodiments of the present disclosure have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present disclosure. It should be understood by those skilled in the art that the above embodiments may be modified without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims

1. A software detection method, characterized in that: The method comprises: Obtain the function call behavior sequence of the software to be detected; Decomposing the function call behavior sequence into time series features and structure sequence features, and obtaining a time series feature representation and a structure feature representation of the function call behavior sequence based on the time series features and the structure sequence features; The temporal feature representation and the structural feature representation are input into the trained multi-layer perceptron model to obtain a software type detection result for the software to be detected.

2. The method according to claim 1, characterized in that: Decomposing the function call behavior sequence into time series features and structure sequence features includes: Acquire a function call sequence of the software to be detected, wherein the function call sequence includes a plurality of function call events; Decomposing the function call sequence into a temporal function name sequence and an underlying function class interaction sequence; A time series feature is generated based on the time series function name sequence, and a structure sequence feature is generated based on the underlying function category interaction sequence.

3. The method according to claim 2, characterized in that The obtaining of the temporal feature representation of the function call behavior sequence includes: The time series features are input into the text convolutional time series vector learning model to obtain the time series feature representation of the function call behavior sequence; wherein the text convolutional time series vector learning model includes an embedding layer, a convolution layer and a maximum pooling layer; the embedding layer is used to convert a non-repeating function name sequence into a word vector matrix, the convolution layer is used to perform convolution operations on word vector matrices of different dimensions, and the maximum pooling layer is used to perform maximum pooling operations on the convolution results.

4. The method according to claim 2, characterized in that: The step of obtaining the structural feature representation of the function call behavior sequence includes: The structural sequence features are input into a structural embedding learning model to obtain a structural feature representation of the function call behavior sequence; wherein, the structural sequence features are obtained through the structural embedding learning model based on a neighborhood of a meta-path, a dense neighborhood based on a meta-graph is obtained based on dense hidden neighbors in the neighborhood, and the structural feature representation is obtained based on the dense neighborhood.

5. The method according to claim 4, characterized in that The obtaining the structural feature representation based on the dense neighborhood includes: Acquire node-level representations and node attention weights of each layer of the function call behavior sequence based on the dense neighborhood; The node-level representations of each layer are aggregated based on the node attention weights to obtain a structural feature representation.

6. The method according to claim 1, characterized in that The method further comprises: Obtaining training samples; wherein the training samples include temporal feature representation and structural feature representation of preset software, and carry labels corresponding to software categories; The cross loss function is used as the target condition, and the multilayer perceptron model is trained through the training samples to obtain the trained multilayer perceptron model.

7. A software detection device, characterized in that: The device comprises: A function call behavior sequence acquisition module is used to acquire the function call behavior sequence of the software to be detected; A feature decomposition module, used to decompose the function call behavior sequence into time series features and structure sequence features, and obtain a time series feature representation and a structure feature representation of the function call behavior sequence based on the time series features and the structure sequence features; The software detection module is used to input the temporal feature representation and the structural feature representation into the trained multi-layer perceptron model to obtain a software type detection result for the software to be detected.

8. An electronic device, characterized in that: include: at least one processor; a memory for storing the at least one processor-executable instruction; The at least one processor is configured to execute the instructions to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the method as claimed in any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images