Binary homologous sample analysis method based on AI

Abstract

The invention relates to the technical field of deep learning, in particular to an AI-based binary homologous sample analysis method. The method comprises the following steps: reading file content, identifying a packing type, and carrying out unpacking processing to obtain an original data file; disassembling the unshelled original data file; the assembly instruction code is converted into an intermediate code, the natural language large model converts the intermediate code into a high-level language for malicious code feature marking, and a malicious sample data set is made; preprocessing a part of malicious samples, and then carrying out label coding; constructing an LSTM model capable of enhancing malicious sample feature extraction capability and detection capability, and inputting a part of processed malicious samples into the LSTM model for training; and inputting the preprocessed new malicious sample into the trained LSTM model so as to obtain a final result. The method has the advantages that the feature relationship in the language is extracted more quickly, and the effect of performing family classification on malicious samples is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of deep learning technology, and in particular to an AI-based binary homologous sample analysis method. Background Art

[0002] With the rise of deep learning, binary homology sample analysis based on deep learning has also become a hot topic. After extensive investigation and practice, deep learning methods have achieved remarkable results in sample classification. Binary homology sample analysis refers to analyzing the relationship between codes through the characteristics of malicious codes. Sample analysis is involved in many industries and fields, and can identify and classify malware families, detect code reuse, track the evolution of malware, and identify future threats.

[0003] However, using deep learning to classify homologous malicious code samples still faces many challenges. For example, conventional methods directly process raw binary assembly instructions, extract features from these instructions, and combine them with trained models to classify homologous samples. However, in addition to sequential execution, assembly instructions also involve jumps and calls, which are usually represented by relative addresses. Directly extracting features may not understand the semantics, handle contextual relationships, and cannot be directly utilized.

[0004] For example, a Chinese patent with application number 202311724479.9 and application date of December 14, 2023, is entitled "A method, device, and electronic device for homology analysis of malicious code." Its technical solution is: a method, device, electronic device, and storage medium for homology analysis of malicious code, wherein the method includes: obtaining an executable file containing malicious code; extracting assembly instructions from the executable file; constructing a code semantic sequence for the assembly instructions to obtain an assembly instruction semantic sequence; extracting deep features from the assembly instruction semantic sequence; training the deep features with a classification algorithm to obtain a detection model; and performing homology analysis on the assembly instructions according to the detection model to obtain a homology analysis result.

[0005] Although the above-mentioned patent can realize the analysis of malicious code, the solution converts binary code into assembly instructions first, and then converts it into an image through GIST feature extraction. First, this method will not only lose some accurate information, such as semantic information and the connection between instruction jumps, but also the instructions generated by the compiler for general conventional code often have a high degree of similarity, while malicious code often only has a few lines of code, and the classification features in the graphic features are often not clear. Second, GIST features have relatively fixed dimensions. If an attacker understands the GIST extraction algorithm, it is possible to evade detection. In addition, GIST only focuses on the macro layout in the image and often ignores the specific meaning of the instructions, which may reduce the ability to analyze the same source of certain malicious instructions. Summary of the Invention

[0006] In order to solve the problems existing in the above-mentioned prior art, the present invention provides an AI-based binary homology sample analysis method that can convert the underlying language into a high-level language and then combine it with the LSTM model to achieve more efficient marking of malicious code features and homology classification.

[0007] In order to achieve the above technical effects, the technical solutions of the present invention are as follows: An AI-based binary homologous sample analysis method, specifically comprising the following steps: Step 1: Read the file content, identify the specific type of packer, and then de-packetize it to obtain the original data file; Step 2: Disassemble the unpacked original data file to obtain the assembly instruction code; Step 3: Convert the assembly instruction code into intermediate code, and then convert the intermediate code into high-level language through a large natural language model for malicious code feature tagging to create a malicious sample dataset; Step 4: Preprocess some malicious samples in the dataset and then perform label encoding; Step 5: Build an LSTM model that can enhance the ability to extract and detect malicious samples. Input some processed malicious samples into the LSTM model for training. Step 6: Input the preprocessed new malicious sample into the trained LSTM model to obtain the final result.

[0008] Furthermore, the specific method of reading the file content in step 1 is to open the binary file, read the bytes step by step, and read the file content into the memory; the specific method of identifying the type of packing is to use a tool to analyze the binary data in the memory to scan the file header and section table; the specific method of unpacking is to call the unpacking tool to perform unpacking to obtain the original binary data; the specific method of disassembly in step 2 is to input the unpacked original data file into the disassembly tool, and obtain the assembly instruction code through the automatic parsing and analysis of the disassembly tool.

[0009] Furthermore, in step three, the assembly instruction code is converted into the intermediate code as follows: the assembly instruction code is converted into LLVM IR code by using the LLVM toolkit, and the LLVM IR code is then converted into a high-level language by calling the natural language large model through the prompt word template; the high-level language is C language.

[0010] Furthermore, the specific method of preprocessing in steps 4 and 6 is as follows: assign a family classification label to each malicious sample in some malicious samples, then split the malicious sample code into words, then perform integer encoding, integer serialize the split words, pad or truncate all integer sequences to the same length, build a vocabulary for all integer sequences, and assign a unique integer ID to each word; the specific method of label encoding is to convert the family classification label into a unique integer ID or one-hot encoding.

[0011] Furthermore, the specific steps for splitting the malicious sample into words and then performing integer encoding are as follows: Step a: First, perform word segmentation to split the complete sentence into words or word sequences:

[0012] Where, t1, t2 and t3 all mean split words or word sequences; Step b: After word segmentation is completed, map each split word or word sequence to an ID sequence in the vocabulary:

[0013] Where a1, a2, and a3 are integer IDs corresponding to each word segment or word sequence; Step c: The specific method of padding or truncating all integer sequences to the same length is: if , then fill in special padding symbols at the end of the sentence so that the length after padding is: , where The meaning is the length of the integer sequence, is the upper limit of the sentence length, c is the filling symbol; if , then truncate to length , retain the previous words, and the truncated length is .

[0014] Furthermore, the final result in step 6 is the category probability of each corresponding family, where the family represents the APT attack organization. In step 6, the pre-processed new malicious sample is input into the trained LSTM model. The specific steps to obtain the final result are as follows: Step a1: Map the integer sequence of the input layer to the word vector matrix W through a table lookup operation; Step b1: In the LSTM layer, input the word vector matrix W and calculate the layer output matrix H through the LSTM layer; Step c1: The layer output matrix H is averaged through the mean layer to obtain a dense vector of fixed length; Step d1: The dense vector v passes through the fully connected layer and the activation function to finally obtain the category probability vector.

[0015] Furthermore, the word vector matrix W in step a1 is a V×d matrix, where V is the size of the vocabulary and d is the dimension of the word vector; given an integer sequence , each are all IDs in a vocabulary, through the embedding matrix , mapped to the corresponding word vector, the formula is as follows:

[0016] Finally, the integer sequence will be converted into a word vector matrix , where each word vector , represents the d-dimensional real space; The specific steps of obtaining the layer output matrix through the LSTM layer in step b1 are as follows: Step a2: Calculate the forget gate , the specific formula is as follows:

[0017] Where, and Represent the weight and bias of the forget gate respectively, Indicates that at time step The hidden state vector of represents the word vector input at time step t, express Sigmoid function; Step b2: Calculate the input gate and candidate memory , the specific formula is as follows: ;

[0018] Where, Represents each word vector, where it is the weight of the input gate category i, represents the bias of the input gate, and represents the weight and bias of the candidate memory, represents the hyperbolic tangent function; Step c2: Update the cell state. The specific formula is as follows:

[0019] Where, represents the long-term memory of the LSTM layer at time step t; Represents the long-term memory of the LSTM layer at time step t-1; Step d2: Calculate the output gate , the specific formula is as follows:

[0020] Where, and Represent the weight and bias of the output gate respectively; Step e2: Calculate the hidden state. The specific formula is as follows:

[0021] Finally, the LSTM layer outputs a layer output matrix of sequence hidden states ; In step c1, the layer output matrix H is averaged through the mean layer to obtain a dense vector of fixed length, where the layer output matrix , express dimensional real space, the layer output matrix H is a Matrix, the specific formula of this step is:

[0022] In the formula, the dense vector is the dense vector after mean pooling, h i Represents the i-th column vector of the output matrix H, and n represents the number of layers; In step d1, the activation function is selected as the Softmax function; the dense vector v passes through the fully connected layer and the specific steps of finally obtaining the category probability vector through the activation function are as follows: Step a3: The dense vector v is linearly transformed in the fully connected layer. The specific formula is as follows:

[0023] Where, is the weight matrix of the fully connected layer, is the bias vector, , k represents the number of categories, z means the output of the fully connected layer, which is the result of linear transformation of the dense vector v; Step b3: Use the Softmax function to convert it into a probability vector. The specific formula is as follows:

[0024] Where p i Indicates the probability that the model predicts that the sample belongs to the i-th category, is the output class probability vector, is the number of categories, is the logarithmic probability value of the fully connected layer output category i, is the logarithmic probability value of the fully connected layer output category j, and e represents a natural constant.

[0025] Furthermore, to enhance the LSTM layer's ability to extract malicious samples in step b1, adjustments to the LSTM layer include the following specific steps: Step a4: Introduce a bidirectional LSTM to capture the sequence information from left to right and from right to left, and concatenate the hidden states in the two directions. The specific formula is as follows: ; ; ;

[0026] Where, Indicates that LSTM processes the sequence from left to right at time step The hidden state of Indicates that LSTM processes the sequence from right to left at time step The hidden state of Represents bidirectional LSTM at time step The output state of , including the output of the hidden state from left to right and from right to left; Represents input Calculation in LSTM layer; Indicates that LSTM processes the sequence from right to left at time step The hidden state of Indicates that LSTM processes the sequence from left to right at time step The hidden state of Step b4: Increase the number of LSTM layers to enable the model to capture deeper feature information. The specific formula is as follows:

[0027] Where, Indicates that LSTM Time step of the layer The hidden state of Indicates that LSTM Time step of the layer The hidden state of Indicates that LSTM The time step of the layer The hidden state of .

[0028] Furthermore, the weights and activation functions of the fully connected layer in step d1 are adjusted to enhance the detection performance of malicious samples. The specific adjustment steps are as follows: Step a5: Introduce L2 regularization to prevent overfitting. The loss function after regularization is:

[0029] Where, represents the loss function, where are model parameters, is the cross entropy loss, N represents the number of samples, is the regularization parameter, represents the L2 regularization term, the L2 norm square of the model parameters, represents the predicted probability, Indicates that the sample belongs to the label of category i; Step b5: Add a Dropout layer before the fully connected layer to randomly discard some neurons to reduce overfitting. The specific formula is:

[0030] Where, represents the output of the fully connected layer, is the drop probability.

[0031] Furthermore, after using the Softmax function to convert the probability vector, in order to enhance the ability to distinguish malicious samples, a weighted cross entropy loss function is introduced. Its specific formula is:

[0032] Where, Represents each word vector, where it is the weight of the input gate category i; i Indicates that the sample belongs to the mark of category i; p iIt represents the probability that the model predicts that the sample belongs to the i-th category.

[0033] According to the above technical solution, the present invention has the following beneficial effects: 1. This paper adopts an AI-based binary homology sample analysis method to convert the underlying language into a high-level language, and applies the deep learning model LSTM to sample family classification, achieving faster extraction of feature relationships in the language and significantly improving the effect of family classification of malicious samples.

[0034] 2. The present invention converts assembly instruction code into high-level language code, which solves the cross-platform compatibility problem and facilitates manual and rapid understanding of the meaning of binary code, thereby extracting the feature relationships therein more quickly and accurately.

[0035] 3. The method of the present invention constructs an LSTM model that can enhance the feature extraction and detection capabilities of malicious samples. By utilizing this LSTM model, feature relationships in language can be extracted more quickly, thereby improving the detection effect of malicious samples and the family classification effect and efficiency.

[0036] 4. The method of the present invention introduces a bidirectional LSTM, which solves the shortcoming of traditional LSTM that can only process sequence information from left to right. It enables LSTM to capture sequence information from left to right and from right to left, allowing the LSTM model to better enhance the feature extraction effect of malicious samples.

[0037] 5. The method of the present invention achieves the technical effect of being able to capture deeper feature information in malicious samples by increasing the number of LSTM layers.

[0038] 6. The method of the present invention optimizes the fully connected layer by introducing L2 regularization and adding a Dropout layer before the fully connected layer, adjusts the weight and activation function of the fully connected layer, and enhances the detection ability of malicious samples.

[0039] 7. The method of the present invention introduces a weighted cross entropy loss function, which enables the method to achieve a better distinction effect on malicious samples.

[0040] 8. The method of the present invention adopts word splitting, integer serialization, and padding and truncation of integer sequences to map integer sequences to word vector matrices, thereby ensuring the LSTM model's homology analysis effect on malicious code.

[0041] 9. The present invention uses LLVM IR as the intermediate code, which can be ported on different operating systems and hardware. LLVM can optimize and improve program performance, reduce memory usage, and improve code readability and maintainability. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments.

[0044] Example 1 An AI-based binary homologous sample analysis method, specifically comprising the following steps: like Figure 1 As shown, step 1: read the file content, identify the specific shell type, and then de-shell to obtain the original data file; Step 2: Disassemble the unpacked original data file to obtain the assembly instruction code; Step 3: Convert the assembly instruction code into intermediate code, and then convert the intermediate code into high-level language through a large natural language model for malicious code feature tagging to create a malicious sample dataset; Step 4: Preprocess some malicious samples in the dataset and then perform label encoding; Step 5: Build an LSTM model that can enhance the ability to extract and detect malicious samples. Input some processed malicious samples into the LSTM model for training. Step 6: Input the preprocessed new malicious sample into the trained LSTM model to obtain the final result.

[0045] The specific method of reading the file content in step 1 is to open the binary file, read the bytes step by step, and read the file content into the memory; the specific method of identifying the type of packing is to use a tool to analyze the binary data in the memory and scan the file header and section table; the specific method of unpacking is to call the unpacking tool to unpack the data to obtain the original binary data, wherein the tool first uses a PE header parsing tool, such as PEID, and then uses a corresponding unpacking tool, such as UPX; if the corresponding unpacking tool is not found, the sample can only be abandoned or manually analyzed; the specific method of disassembly in step 2 is to input the unpacked original data file into the disassembly tool, and obtain the assembly instruction code through the automatic parsing and analysis of the disassembly tool, wherein the disassembly tool uses the general tool objdump.

[0046] In step 3, the assembly instruction code is converted into the intermediate code as follows: the assembly instruction code is converted into LLVM IR code by using the LLVM toolkit, and the LLVM IR code is then converted into a high-level language by calling the natural language large model through the prompt word template; the LLVM toolkit is an existing technology toolkit; the prompt word template is, for example: "Convert the following LLVM IR code into C code, using the C99 standard, and only output the code: {LLVM IR}"; the high-level language is C language, and C language can also be converted into high-level languages ​​such as Python language and Java language for analysis.

[0047] The specific preprocessing method in steps 4 and 6 is as follows: assign a family classification label to each malicious sample in some malicious samples, then split the malicious sample code into words, then perform integer encoding, integer serialize the split words, pad or truncate all integer sequences to the same length, build a vocabulary for all integer sequences, and assign a unique integer ID to each word; the specific method of label encoding is to convert the family classification label into a unique integer ID or one-hot encoding.

[0048] The specific steps to split the malicious sample into words and then perform integer encoding are: Step a: First, perform word segmentation to split the complete sentence into words or word sequences:

[0049] Where, t1, t2 and t3 all mean split words or word sequences; For example, if the sentence is "I love learning", then it should be split into:

[0050] Step b: After word segmentation is completed, map each split word or word sequence to an ID sequence in the vocabulary:

[0051] Assuming that the words split in step a have an ID of 101 for "I", 202 for "love", and 303 for "learning" in the vocabulary, the integer sequence is:

[0052] Where a1, a2, and a3 are integer IDs corresponding to each word segment or word sequence; Step c: The specific method of padding or truncating all integer sequences to the same length is: if , then fill in special padding symbols at the end of the sentence so that the length after padding is: , where The meaning is the length of the integer sequence, is the upper limit of the sentence length, c is the filling symbol; if , then truncate to length , retain the previous words, and the truncated length is .

[0053] Example 2 Based on Example 1, the final result in step 6 is the category probability of each corresponding family, where family represents APT attack organization; APT means advanced persistent threat attack. In step 6, the pre-processed new malicious sample is input into the trained LSTM model to obtain the final result. The specific steps are as follows: Step a1: Map the integer sequence of the input layer to the word vector matrix W through a table lookup operation; Step b1: In the LSTM layer, input the word vector matrix W and calculate the layer output matrix H through the LSTM layer; Step c1: The layer output matrix H is averaged through the mean layer to obtain a dense vector v of fixed length; Step d1: The dense vector v passes through the fully connected layer and the activation function to finally obtain the category probability vector.

[0054] In step a1, the word vector matrix W is a V×d matrix, where V is the size of the vocabulary and d is the dimension of the word vector. , each are all IDs in a vocabulary, through the embedding matrix , mapped to the corresponding word vector, the formula is as follows:

[0055] Finally, the integer sequence will be converted into a word vector matrix , where each word vector , represents the d-dimensional real space; The specific steps for obtaining the layer output matrix through the LSTM layer in step b1 are as follows: Step a2: Calculate the forget gate , the specific formula is as follows:

[0056] Where, and Represent the weight and bias of the forget gate respectively, Indicates that at time step The hidden state vector of represents the word vector input at time step t, express Sigmoid function; Step b2: Calculate the input gate and candidate memory , the specific formula is as follows: ;

[0057] Where, and Represents the weight and bias of the input gate, and represents the weight and bias of the candidate memory, represents the hyperbolic tangent function; Step c2: Update the cell state. The cell state is one of the core concepts of LSTM. It is used to store long-term information from the current time step to the future. It is similar to the "memory" mechanism of the network. It can be regarded as an "information channel" flowing in the LSTM network, allowing information to propagate throughout the sequence. At the same time, different gating mechanisms are used to selectively save, update, or delete information. The specific formula is as follows:

[0058] Where, represents the long-term memory of the LSTM layer at time step t; Represents the long-term memory of the LSTM layer at time step t-1; Step d2: Calculate the output gate , the specific formula is as follows:

[0059] Where, and Represent the weight and bias of the output gate respectively; Step e2: Calculate the hidden state. The specific formula is as follows:

[0060] Finally, the LSTM layer outputs a layer output matrix of sequence hidden states ; In step c1, the mean layer usually refers to a pooling operation, which is to average the input matrix in the direction of time step (or sequence length), and average the layer output matrix H through the mean layer to obtain a dense vector of fixed length, where the layer output matrix , express dimensional real space, the layer output matrix H is a Matrix, the specific formula of this step is:

[0061] In the formula, the dense vector is the dense vector after mean pooling, h i Represents the i-th column vector of the output matrix H, and n represents the number of layers; In step d1, the activation function is selected as the Softmax function; the dense vector v passes through the fully connected layer and the activation function to finally obtain the category probability vector. The specific steps are as follows: Step a3: The dense vector v is linearly transformed in the fully connected layer. The specific formula is as follows:

[0062] Where, is the weight matrix of the fully connected layer, is the bias vector, , k represents the number of categories, z means the output of the fully connected layer, which is the result of linear transformation of the dense vector v; Step b3: Use the Softmax function to convert it into a probability vector. The specific formula is as follows:

[0063] Where p i Indicates the probability that the model predicts that the sample belongs to the i-th category, is the output class probability vector, is the number of categories, is the logarithmic probability value of the fully connected layer output category i, is the logarithmic probability value of the fully connected layer output category j, and e represents a natural constant.

[0064] Example 3 Based on Example 1, the final result in step 6 is the category probability of each corresponding family, where family represents APT attack organization; APT means advanced persistent threat attack. In step 6, the pre-processed new malicious sample is input into the trained LSTM model to obtain the final result. The specific steps are as follows: Step a1: Map the integer sequence of the input layer to the word vector matrix W through a table lookup operation; Step b1: In the LSTM layer, input the word vector matrix W and calculate the layer output matrix H through the LSTM layer; Step c1: The layer output matrix H is averaged through the mean layer to obtain a dense vector v of fixed length; Step d1: The dense vector v passes through the fully connected layer and the activation function to finally obtain the category probability vector.

[0065] In step a1, the word vector matrix W is a V×d matrix, where V is the size of the vocabulary and d is the dimension of the word vector. , each are all IDs in a vocabulary, through the embedding matrix , mapped to the corresponding word vector, the formula is as follows:

[0066] Finally, the integer sequence will be converted into a word vector matrix , where each word vector , represents the d-dimensional real space; The specific steps for obtaining the layer output matrix through the LSTM layer in step b1 are as follows: Step a2: Calculate the forget gate , the specific formula is as follows:

[0067] Where, and Represent the weight and bias of the forget gate respectively, Indicates that at time step The hidden state vector of represents the word vector input at time step t, express Sigmoid function; Step b2: Calculate the input gate and candidate memory , the specific formula is as follows: ;

[0068] Where, Represents each word vector, where it is the weight of the input gate category i, represents the bias of the input gate, and represents the weight and bias of the candidate memory, represents the hyperbolic tangent function; Step c2: Update the cell state. The cell state is one of the core concepts of LSTM. It is used to store long-term information from the current time step to the future. It is similar to the "memory" mechanism of the network. It can be regarded as an "information channel" flowing in the LSTM network, allowing information to propagate throughout the sequence. At the same time, different gating mechanisms are used to selectively save, update, or delete information. The specific formula is as follows:

[0069] Where, represents the long-term memory of the LSTM layer at time step t; Represents the long-term memory of the LSTM layer at time step t-1; Step d2: Calculate the output gate , the specific formula is as follows:

[0070] Where, and Represent the weight and bias of the output gate respectively; Step e2: Calculate the hidden state. The specific formula is as follows:

[0071] Finally, the LSTM layer outputs a layer output matrix of sequence hidden states ; In step c1, the mean layer usually refers to a pooling operation, which is to average the input matrix in the direction of time step (or sequence length), and average the layer output matrix H through the mean layer to obtain a dense vector of fixed length, where the layer output matrix , express dimensional real space, the layer output matrix H is a Matrix, the specific formula of this step is:

[0072] In the formula, the dense vector is the dense vector after mean pooling, h i Represents the i-th column vector of the output matrix H, and n represents the number of layers; In step d1, the activation function is selected as the Softmax function; the dense vector v passes through the fully connected layer and the activation function to finally obtain the category probability vector. The specific steps are as follows: Step a3: The dense vector v is linearly transformed in the fully connected layer. The specific formula is as follows:

[0073] Where, is the weight matrix of the fully connected layer, is the bias vector, , k represents the number of categories, z means the output of the fully connected layer, which is the result of linear transformation of the dense vector v; Step b3: Use the Softmax function to convert it into a probability vector. The specific formula is as follows:

[0074] Where p i Indicates the probability that the model predicts that the sample belongs to the i-th category, is the output class probability vector, is the number of categories, is the logarithmic probability value of the fully connected layer output category i, is the logarithmic probability value of the fully connected layer output category j, and e represents a natural constant.

[0075] To enhance the LSTM layer's feature extraction of malicious samples in step b1, adjustments to the LSTM layer include the following specific steps: Step a4: Introduce a bidirectional LSTM to capture the sequence information from left to right and from right to left, and concatenate the hidden states in the two directions. The specific formula is as follows: ; ; ;

[0076] Where, Indicates that LSTM processes the sequence from left to right at time step The hidden state of Indicates that LSTM processes the sequence from right to left at time step The hidden state of Represents bidirectional LSTM at time step The output state of , including the output of the hidden state from left to right and from right to left; Represents input Calculation in LSTM layer; Indicates that LSTM processes the sequence from right to left at time step The hidden state of Indicates that LSTM processes the sequence from left to right at time step The hidden state of Step b4: Increase the number of LSTM layers to enable the model to capture deeper feature information. Multiple layers of LSTM can be stacked, with the input of each layer being the output of the previous layer. The specific formula is as follows:

[0077] Where, Indicates that LSTM The time step of the layer The hidden state of Indicates that LSTM The time step of the layer The hidden state of Indicates that LSTM The time step of the layer The hidden state of .

[0078] Adjust the weights and activation functions of the fully connected layer in step d1 to enhance the detection performance of malicious samples. The specific adjustment steps are as follows: Step a5: Introduce L2 regularization to prevent overfitting, especially when dealing with malicious samples, which can increase the generalization ability of the model. The loss function after regularization is:

[0079] Where, represents the loss function, where are model parameters, is the cross entropy loss, N represents the number of samples, is the regularization parameter, represents the L2 regularization term, the L2 norm square of the model parameters, represents the predicted probability, Indicates that the sample belongs to the label of category i; Step b5: Add a Dropout layer before the fully connected layer to randomly discard some neurons to reduce overfitting. The specific formula is:

[0080] Where, represents the output of the fully connected layer, is the drop probability.

[0081] After using the Softmax function to convert to a probability vector, in order to enhance the ability to distinguish malicious samples, a weighted cross entropy loss function is introduced. Its specific formula is:

[0082] Where, Represents each word vector, where it is the weight of the input gate category i; i is the true label, indicating that the sample belongs to the mark of the i-th category; p i is the predicted probability, which indicates the probability that the model predicts that the sample belongs to the i-th category.

[0083] The above description is a detailed description of the preferred feasible embodiment of the present application, but the embodiment is not intended to limit the scope of the patent application of the present application. Any equivalent changes or modifications completed under the technical spirit suggested by the present application should fall within the scope of the patent covered by the present application.

Claims

1. A binary homologous sample analysis method based on AI, characterized in that: The specific steps include: Step 1: Read the file content, identify the specific shell type, and then de-shell to obtain the original data file; Step 2: Disassemble the unpacked original data file to obtain the assembly instruction code; Step 3: Convert the assembly instruction code into intermediate code, and then convert the intermediate code into high-level language through the natural language model for malicious code feature tagging to create a malicious sample data set; Step 4: Preprocess some malicious samples in the data set and then perform label encoding; Step 5: Build an LSTM model that can enhance the ability to extract and detect malicious samples, and input some of the processed malicious samples into the LSTM model for training; Step 6: Input the preprocessed new malicious sample into the trained LSTM model to obtain the final result.

2. The AI-based binary homologous sample analysis method according to claim 1, characterized in that: The specific method of reading the file content in step one is to open the binary file, read the bytes step by step, and read the file content into the memory; the specific method of identifying the shell type is to use the tool to analyze the binary data in the memory to scan the file header and section table; the specific method of unpacking is to call the unpacking tool to perform unpacking to obtain the original binary data; the specific method of disassembly in step two is to input the unpacked original data file into the disassembly tool, and obtain the assembly instruction code through the automatic parsing and analysis of the disassembly tool.

3. The AI-based binary homologous sample analysis method according to claim 1, characterized in that: The specific steps of converting the assembly instruction code into the intermediate code in step 3 are as follows: the assembly instruction code is converted into LLVM IR code by using the LLVM toolkit, and the LLVM IR code is then converted into a high-level language by calling the natural language large model through the prompt word template.

4. The AI-based binary homologous sample analysis method according to claim 1, characterized in that: The specific method of preprocessing in step 4 and step 6 is: assign a family classification label to each malicious sample in some malicious samples, then split the malicious sample code into words, and then perform integer encoding, integer serialize the split words, fill or truncate all integer sequences to the same length, build a vocabulary for all integer sequences, and assign a unique integer ID to each word; the specific method of label encoding is to convert the family classification label into a unique integer ID or one-hot encoding.

5. The AI-based binary homologous sample analysis method according to claim 4, characterized in that: The specific steps to split the malicious sample into words and then perform integer encoding are: Step a: First, perform word segmentation to split the complete sentence into words or word sequences: ； Wherein, t1, t2 and t3 all mean split words or word sequences; Step b: After word segmentation is completed, map each split word or word sequence to an ID sequence in the vocabulary: ； In the formula, a1, a2 and a3 are the integer IDs corresponding to each word segment or word sequence; Step c: The specific method of padding or truncating all integer sequences to the same length is: if , then fill in the padding symbol at the end of the sentence so that the length after padding is: , where The meaning is the length of the integer sequence, is the upper limit of the sentence length, c is the filling symbol; if , then truncate to length , keep the previous words, the truncated length is .

6. The AI-based binary homologous sample analysis method according to claim 1, characterized in that: The final result in step 6 is the category probability of each corresponding family, where the family represents the APT attack organization. In step 6, the preprocessed new malicious sample is input into the trained LSTM model. The specific steps to obtain the final result are as follows: Step a1: Map the integer sequence of the input layer to the word vector matrix W through a table lookup operation; Step b1: In the LSTM layer, input the word vector matrix W, and calculate the layer output matrix H through the LSTM layer; Step c1: The layer output matrix H is averaged through the mean layer to obtain a dense vector v of fixed length; Step d1: The dense vector v passes through the fully connected layer and the activation function to finally obtain the category probability vector.

7. The AI-based binary homologous sample analysis method according to claim 6, characterized in that: In step a1, the word vector matrix W is a V×d matrix, where V is the size of the vocabulary and d is the dimension of the word vector. , each are all IDs in a vocabulary, through the embedding matrix , mapped to the corresponding word vector, the formula is as follows: ； Finally, the integer sequence will be converted into a word vector matrix , where each word vector , represents d-dimensional real number space; The specific steps of obtaining the layer output matrix through the LSTM layer in step b1 are as follows: Step a2: Calculate the forget gate , the specific formula is as follows: ； In the formula, and Respectively represent the weight and bias of the forget gate, Indicates that at time step The hidden state vector of represents the word vector input at time step t, express Sigmoid function; Step b2: Calculate the input gate and candidate memory , the specific formula is as follows: ； ； In the formula, Represents each word vector, where it is the weight of the input gate category i, represents the bias of the input gate, and represents the weight and bias of the candidate memory, represents the hyperbolic tangent function; Step c2: Update the cell status. The specific formula is as follows: ； In the formula, represents the long-term memory of the LSTM layer at time step t; represents the long-term memory of the LSTM layer at time step t-1; Step d2: Calculate the output gate , the specific formula is as follows: ； In the formula, and Respectively represent the weight and bias of the output gate; Step e2: Calculate the hidden state. The specific formula is as follows: ； Finally, the LSTM layer outputs a layer output matrix of sequence hidden states ; In step c1, the layer output matrix H is averaged through the mean layer to obtain a dense vector of fixed length, where the layer output matrix , express dimensional real space, the layer output matrix H is a Matrix, the specific formula of this step is: ； In the formula, the dense vector is the dense vector after mean pooling, h i represents the i-th column vector of the output matrix H, and n represents the number of layers; In step d1, the activation function is selected as the Softmax function; the dense vector v passes through the fully connected layer, and the specific steps of finally obtaining the category probability vector through the activation function are as follows: Step a3: The dense vector v is linearly transformed in the fully connected layer. The specific formula is as follows: ； In the formula, is the weight matrix of the fully connected layer, is the bias vector, , k represents the number of categories, z means the output of the fully connected layer, which is the result of linear transformation of the dense vector v; Step b3: Use the Softmax function to convert to a probability vector. The specific formula is as follows: ； In the formula, p i It indicates the probability that the model predicts that the sample belongs to the i-th category, is the output class probability vector, is the number of categories, is the logarithmic probability value of the fully connected layer output category i, is the logarithmic probability value of the fully connected layer output category j, and e represents a natural constant.

8. The AI-based binary homologous sample analysis method according to claim 6, characterized in that: In order to enhance the feature extraction of malicious samples by the LSTM layer in step b1, the adjustment of the LSTM layer includes the following specific steps: Step a4: Introduce bidirectional LSTM to capture sequence information from left to right and from right to left, and concatenate the hidden states in the two directions. The specific formula is as follows: ； ； ； In the formula, Indicates that LSTM processes the sequence from left to right at time step The hidden state of Indicates that when the LSTM processes the sequence from right to left, it is at time step The hidden state of Represents bidirectional LSTM at time step The output state of , including the output of the hidden state concatenated from left to right and from right to left; Represents input Calculation at the LSTM layer; Indicates that when the LSTM processes the sequence from right to left, it is at time step The hidden state of Indicates that LSTM processes the sequence from left to right at time step The hidden state of Step b4: Increase the number of LSTM layers so that the model can capture deeper feature information. The specific formula is as follows: ； In the formula, Indicates that LSTM The time step of the layer The hidden state of Indicates that LSTM The time step of the layer The hidden state of Indicates that LSTM The time step of the layer The hidden state of .

9. The AI-based binary homologous sample analysis method according to claim 6, characterized in that: The weights and activation functions of the fully connected layer in step d1 are adjusted to enhance the detection performance of malicious samples. The specific adjustment steps are as follows: Step a5: Introduce L2 regularization to prevent overfitting. The loss function after regularization is: ； In the formula, represents the loss function, where are model parameters, is the cross entropy loss, N represents the number of samples, is the regularization parameter, represents the L2 regularization term, the L2 norm square of the model parameters, represents the predicted probability, Indicates that the sample belongs to the label of the i-th category; Step b5: Add a Dropout layer before the fully connected layer to randomly discard some neurons to reduce overfitting. The specific formula is: ； In the formula, represents the output of the fully connected layer, is the discard probability.

10. The AI-based binary homologous sample analysis method according to claim 7, characterized in that: After being converted into a probability vector using the Softmax function, a weighted cross entropy loss function is introduced to enhance the ability to distinguish malicious samples. The specific formula is: ； In the formula, represents each word vector, where it is the weight of the input gate category i; i Indicates that the sample belongs to the mark of the i-th category; p i It represents the probability that the model predicts that the sample belongs to the i-th category.

Images