An AI-based binary homology sample analysis method

Abstract

The invention relates to the technical field of deep learning, and in particular to an AI-based binary homology sample analysis method; the method comprises reading file content, identifying a shell type, and then performing shell removal processing to obtain an original data file; disassembling the shelled original data file; converting assembly instruction codes into intermediate codes, and a natural language large model converting the intermediate codes into high-level languages ​​for malicious code feature marking to produce a malicious sample data set; preprocessing some malicious samples, and then performing label encoding; constructing an LSTM model capable of enhancing malicious sample feature extraction and detection capabilities, and inputting some processed malicious samples into the LSTM model for training; and inputting the preprocessed new malicious samples into the trained LSTM model to obtain a final result; the advantages of the invention are that feature relations in a language can be extracted more quickly, and the effect of performing family classification on malicious samples can be significantly improved.

Description

Technical Field

[0001] The present invention relates to the field of deep learning technology, and in particular to an AI-based binary homologous sample analysis method. Background Art

[0002] With the rise of deep learning, binary homology sample analysis based on deep learning has also become a hot topic. After a lot of investigation and practice, deep learning methods have achieved remarkable results in sample classification. Binary homology sample analysis refers to analyzing the relationship between codes through the characteristics of malicious codes. Sample analysis is involved in many industries and fields, and can identify and classify malware families, detect code reuse, track the evolution of malware, and identify future threats.

[0003] However, there are still many challenges in using deep learning to classify homologous samples of malicious code. For example, conventional methods directly process the original binary assembly instructions, extract features through assembly instructions, and classify homologous samples in combination with trained models. However, in addition to sequential execution, assembly instructions also involve jumps and calls, which are usually represented by relative addresses. Directly extracting features may not understand the semantics, cannot handle contextual relationships, and cannot be directly used.

[0004] For example, a Chinese patent with application number 202311724479.9 and application date 2023.12.14 is entitled "A method, device, and electronic device for homology analysis of malicious code". Its technical solution is: a method, device, electronic device, and storage medium for homology analysis of malicious code, wherein the method comprises: obtaining an executable file containing malicious code; extracting assembly instructions from the executable file; constructing a code semantic sequence for the assembly instructions to obtain an assembly instruction semantic sequence; extracting deep features from the assembly instruction semantic sequence; training the deep features with a classification algorithm to obtain a detection model; performing homology analysis on the assembly instructions according to the detection model to obtain a homology analysis result.

[0005] Although the above patent can realize the analysis of malicious code, the solution converts binary code into assembly instructions first, and then converts it into an image through gist feature extraction; first, this method will not only lose some accurate information, such as semantic information and the connection between instruction jumps, but also the instructions generated by the compiler for general conventional code often have a high degree of similarity, while malicious code often has only a few lines of code, and the classification features in graphic features are often not clear; secondly, gist features have relatively fixed dimensions. If the attacker understands the gist extraction algorithm, it is possible to evade detection, and gist only focuses on the macro layout in the image, often ignoring the specific meaning of the instructions, which may reduce the ability to perform homology analysis on certain malicious instructions. Summary of the invention

[0006] In order to solve the problems existing in the above-mentioned prior art, the present invention provides an AI-based binary homology sample analysis method that can convert the underlying language into a high-level language, and then combine the LSTM model to achieve more efficient marking of malicious code features and homology classification.

[0007] In order to achieve the above technical effects, the technical solution of the present invention is as follows:

[0008] An AI-based binary homologous sample analysis method, the specific steps include:

[0009] Step 1: Read the file content, identify the specific shell type, and then de-shell to obtain the original data file;

[0010] Step 2: Disassemble the unpacked original data file to obtain the assembly instruction code;

[0011] Step 3: Convert the assembly instruction code into intermediate code, and then convert the intermediate code into high-level language through the natural language model for malicious code feature tagging to create a malicious sample data set;

[0012] Step 4: Preprocess some malicious samples in the data set and then perform label encoding;

[0013] Step 5: Build an LSTM model that can enhance the ability to extract and detect malicious samples, and input some of the processed malicious samples into the LSTM model for training;

[0014] Step 6: Input the preprocessed new malicious sample into the trained LSTM model to obtain the final result.

[0015] Furthermore, the specific method of reading the file content in step one is to open the binary file, read the bytes step by step, and read the file content into the memory; the specific method of identifying the shell type is to use a tool to analyze the binary data in the memory to scan the file header and section table; the specific method of unpacking is to call the unpacking tool to perform unpacking to obtain the original binary data; the specific method of disassembly in step two is to input the unpacked original data file into the disassembly tool, and obtain the assembly instruction code through the automatic parsing and analysis of the disassembly tool.

[0016] Furthermore, in step three, the assembly instruction code is converted into the intermediate code as follows: the assembly instruction code is converted into LLVM IR code by using the LLVM toolkit, and the LLVM IR code is then converted into a high-level language by calling the natural language large model through a prompt word template; the high-level language is C language.

[0017] Furthermore, the specific method of preprocessing in step 4 and step 6 is: assign a family classification label to each malicious sample in some malicious samples, then split the malicious sample code into words, and then perform integer encoding, integer serialize the split words, fill or truncate all integer sequences to the same length, build a vocabulary for all integer sequences, and assign a unique integer ID to each word; the specific method of label encoding is to convert the family classification label into a unique integer ID or one-hot encoding.

[0018] Furthermore, the specific steps of splitting the malicious sample into words and then integer encoding are as follows:

[0019] Step a: First, perform word segmentation to split the complete sentence into words or word sequences:

[0020]

[0021] Wherein, t1, t2 and t3 all mean split words or word sequences;

[0022] Step b: After word segmentation is completed, map each split word or word sequence to an ID sequence in the vocabulary:

[0023]

[0024] In the formula, a1, a2 and a3 are the integer IDs corresponding to each word segment or word sequence;

[0025] Step c: The specific method of padding or truncating all integer sequences to the same length is: if , then fill in special padding symbols at the end of the sentence so that the length after padding is: , where The meaning is the length of the integer sequence, is the upper limit of the sentence length, c is the filling symbol; if , then truncate to length , keep the previous words, the truncated length is .

[0026] Furthermore, the final result in step 6 is the category probability of each corresponding family, where the family represents the APT attack organization; in step 6, the preprocessed new malicious sample is input into the trained LSTM model, and the specific steps to obtain the final result are as follows:

[0027] Step a1: Map the integer sequence of the input layer to the word vector matrix W through a table lookup operation;

[0028] Step b1: In the LSTM layer, input the word vector matrix W, and calculate the layer output matrix H through the LSTM layer;

[0029] Step c1: The layer output matrix H is averaged through the mean layer to obtain a dense vector of fixed length;

[0030] Step d1: The dense vector v passes through the fully connected layer and the activation function to finally obtain the category probability vector.

[0031] Furthermore, the word vector matrix W in step a1 is a V×d matrix, where V is the size of the vocabulary and d is the dimension of the word vector; given an integer sequence , each are all IDs in a vocabulary, through the embedding matrix , mapped to the corresponding word vector, the formula is as follows:

[0032]

[0033] Finally, the integer sequence will be converted into a word vector matrix , where each word vector , represents d-dimensional real number space;

[0034] The specific steps of obtaining the layer output matrix through the LSTM layer in step b1 are as follows:

[0035] Step a2: Calculate the forget gate , the specific formula is as follows:

[0036]

[0037] In the formula, and Respectively represent the weight and bias of the forget gate, Indicates that at time step The hidden state vector of represents the word vector input at time step t, express Sigmoid function;

[0038] Step b2: Calculate the input gate and candidate memory , the specific formula is as follows:

[0039] ;

[0040]

[0041] In the formula, Represents each word vector, where it is the weight of the input gate category i, represents the bias of the input gate, and represents the weight and bias of the candidate memory, represents the hyperbolic tangent function;

[0042] Step c2: Update the cell status. The specific formula is as follows:

[0043]

[0044] In the formula, represents the long-term memory of the LSTM layer at time step t; represents the long-term memory of the LSTM layer at time step t-1;

[0045] Step d2: Calculate the output gate , the specific formula is as follows:

[0046]

[0047] In the formula, and Respectively represent the weight and bias of the output gate;

[0048] Step e2: Calculate the hidden state. The specific formula is as follows:

[0049]

[0050] Finally, the LSTM layer outputs a layer output matrix of sequence hidden states ;

[0051] In step c1, the layer output matrix H is averaged through the mean layer to obtain a dense vector of fixed length, where the layer output matrix , express dimensional real space, the layer output matrix H is a Matrix, the specific formula of this step is:

[0052]

[0053] In the formula, the dense vector is the dense vector after mean pooling, h i represents the i-th column vector of the output matrix H, and n represents the number of layers;

[0054] In step d1, the activation function is selected as the Softmax function; the dense vector v passes through the fully connected layer, and the specific steps of finally obtaining the category probability vector through the activation function are as follows:

[0055] Step a3: The dense vector v is linearly transformed in the fully connected layer. The specific formula is as follows:

[0056]

[0057] In the formula, is the weight matrix of the fully connected layer, is the bias vector, , k represents the number of categories, z means the output of the fully connected layer, which is the result of linear transformation of the dense vector v;

[0058] Step b3: Use the Softmax function to convert to a probability vector. The specific formula is as follows:

[0059]

[0060] In the formula, p i It indicates the probability that the model predicts that the sample belongs to the i-th category, is the output class probability vector, is the number of categories, is the logarithmic probability value of the fully connected layer output category i, is the logarithmic probability value of the fully connected layer output category j, and e represents a natural constant.

[0061] Furthermore, in order to enhance the feature extraction of malicious samples by the LSTM layer in step b1, the adjustment of the LSTM layer includes the following specific steps:

[0062] Step a4: Introduce bidirectional LSTM to capture sequence information from left to right and from right to left, and concatenate the hidden states in the two directions. The specific formula is as follows:

[0063] ;

[0064] ;

[0065] ;

[0066] In the formula, Indicates that LSTM processes the sequence from left to right at time step The hidden state of Indicates that when processing the sequence from right to left, LSTM is at time step The hidden state of Represents the bidirectional LSTM at time step The output state of , which contains the output of the hidden state concatenated from left to right and from right to left; Represents input Calculation at the LSTM layer; Indicates that when processing the sequence from right to left, LSTM is at time step The hidden state of Indicates that LSTM processes the sequence from left to right at time step The hidden state of

[0067] Step b4: Increase the number of LSTM layers so that the model can capture deeper feature information. The specific formula is as follows:

[0068]

[0069] In the formula, Indicates that LSTM The time step of the layer The hidden state of Indicates that LSTM The time step of the layer The hidden state of Indicates that LSTM The time step of the layer The hidden state of .

[0070] Furthermore, the weights and activation functions of the fully connected layer in step d1 are adjusted to enhance the detection performance of malicious samples. The specific adjustment steps are as follows:

[0071] Step a5: Introduce L2 regularization to prevent overfitting. The loss function after regularization is:

[0072]

[0073] In the formula, represents the loss function, where are model parameters, is the cross entropy loss, N represents the number of samples, is the regularization parameter, represents the L2 regularization term, the L2 norm square of the model parameters, represents the predicted probability, Indicates that the sample belongs to the label of the i-th category;

[0074] Step b5: Add a Dropout layer before the fully connected layer to randomly discard some neurons to reduce overfitting. The specific formula is:

[0075]

[0076] In the formula, represents the output of the fully connected layer, is the discard probability.

[0077] Furthermore, after converting to a probability vector using the Softmax function, a weighted cross entropy loss function is introduced to enhance the ability to distinguish malicious samples. The specific formula is:

[0078]

[0079] In the formula, represents each word vector, where it is the weight of the input gate category i; i Indicates that the sample belongs to the mark of the i-th category; p i It represents the probability that the model predicts that the sample belongs to the i-th category.

[0080] According to the above technical solution, the present invention has the following beneficial effects:

[0081] 1. The present invention adopts an AI-based binary homology sample analysis method to convert the underlying language into a high-level language, and applies the deep learning model LSTM to sample family classification, thereby achieving a faster extraction of feature relationships in the language and significantly improving the effect of family classification of malicious samples.

[0082] 2. The present invention converts assembly instruction code into high-level language code, solves the cross-platform compatibility problem, and facilitates manual rapid understanding of the meaning of binary code, and extracts the feature relationship therein more quickly and accurately.

[0083] 3. The method of the present invention constructs an LSTM model that can enhance the feature extraction and detection capabilities of malicious samples. By utilizing the LSTM model, feature relationships in the language can be extracted more quickly, thereby improving the detection effect of malicious samples and the family classification effect and efficiency.

[0084] 4. The method of the present invention introduces a bidirectional LSTM, which solves the shortcoming that the traditional LSTM can only process sequence information from left to right, so that the LSTM can capture sequence information from left to right and from right to left, allowing the LSTM model to better enhance the feature extraction effect of malicious samples.

[0085] 5. The method of the present invention achieves the technical effect of being able to capture deeper feature information in malicious samples by increasing the number of LSTM layers.

[0086] 6. The method of the present invention optimizes the fully connected layer by introducing L2 regularization and adding a Dropout layer before the fully connected layer, adjusts the weight and activation function of the fully connected layer, and enhances the detection capability of malicious samples.

[0087] 7. The method of the present invention introduces a weighted cross entropy loss function, so that the method can achieve a better distinction effect on malicious samples.

[0088] 8. The method of the present invention adopts vocabulary splitting, integer serialization, and padding and truncation of integer sequences to map integer sequences to word vector matrices, thereby ensuring the homology analysis effect of the LSTM model on malicious codes.

[0089] 9. The present invention uses LLVM IR as the intermediate code, which can be ported on different operating systems and hardware, and LLVM can optimize and improve program performance, reduce memory usage, and improve code readability and maintainability. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] Figure 1 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0091] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments.

[0092] Example 1

[0093] An AI-based binary homologous sample analysis method, the specific steps include:

[0094] like Figure 1 As shown, step 1: read the file content, identify the specific shell type, and then de-shell to obtain the original data file;

[0095] Step 2: Disassemble the unpacked original data file to obtain the assembly instruction code;

[0096] Step 3: Convert the assembly instruction code into intermediate code, and then convert the intermediate code into high-level language through the natural language model for malicious code feature tagging to create a malicious sample data set;

[0097] Step 4: Preprocess some malicious samples in the data set and then perform label encoding;

[0098] Step 5: Build an LSTM model that can enhance the ability to extract and detect malicious samples, and input some of the processed malicious samples into the LSTM model for training;

[0099] Step 6: Input the preprocessed new malicious sample into the trained LSTM model to obtain the final result.

[0100] The specific method of reading the file content in step 1 is to open the binary file, read the bytes step by step, and read the file content into the memory; the specific method of identifying the shell type is to use the tool to analyze the binary data in the memory to scan the file header and section table; the specific method of unpacking is to call the unpacking tool to perform unpacking to obtain the original binary data, wherein the tool first uses a PE header parsing tool, such as PEID, and then uses a corresponding unpacking tool, such as UPX; if the corresponding unpacking tool is not found, the sample can only be abandoned or manually analyzed; the specific method of disassembly in step 2 is to input the unpacked original data file into the disassembly tool, and obtain the assembly instruction code through the automatic parsing and analysis of the disassembly tool, wherein the disassembly tool uses the general tool objdump.

[0101] In step 3, the assembly instruction code is converted into the intermediate code as follows: the assembly instruction code is converted into LLVM IR code by using the LLVM toolkit, and the LLVM IR code is then converted into a high-level language by calling the natural language large model through a prompt word template; the LLVM toolkit is a prior art toolkit; the prompt word template is, for example: "Convert the following LLVM IR code into C code, using the C99 standard, and only output the code: {LLVM IR}"; the high-level language is C language, and C language can also be converted into high-level languages ​​such as Python language and Java language for analysis.

[0102] The specific method of preprocessing in step 4 and step 6 is: assign a family classification label to each malicious sample in some malicious samples, then split the malicious sample code into words, and then perform integer encoding, integer serialize the split words, fill or truncate all integer sequences to the same length, build a vocabulary for all integer sequences, and assign a unique integer ID to each word; the specific method of label encoding is to convert the family classification label into a unique integer ID or one-hot encoding.

[0103] The specific steps to split the malicious sample into words and then perform integer encoding are:

[0104] Step a: First, perform word segmentation to split the complete sentence into words or word sequences:

[0105]

[0106] Wherein, t1, t2 and t3 all mean split words or word sequences;

[0107] For example, if the sentence is "I love learning", then it should be split into:

[0108]

[0109] Step b: After word segmentation is completed, map each split word or word sequence to an ID sequence in the vocabulary:

[0110]

[0111] Assuming that the words split in step a have IDs 101 for "I", 202 for "love", and 303 for "learning" in the vocabulary, the integer sequence is:

[0112]

[0113] In the formula, a1, a2 and a3 are the integer IDs corresponding to each word segment or word sequence;

[0114] Step c: The specific method of padding or truncating all integer sequences to the same length is: if , then fill in special padding symbols at the end of the sentence so that the length after padding is: , where The meaning is the length of the integer sequence, is the upper limit of the sentence length, c is the filling symbol; if , then truncate to length , keep the previous words, the truncated length is .

[0115] Example 2

[0116] Based on Example 1, the final result in step 6 is the category probability of each corresponding family, where the family represents the APT attack organization; the meaning of APT is advanced persistent threat attack; in step 6, the pre-processed new malicious sample is input into the trained LSTM model, and the specific steps of obtaining the final result are as follows:

[0117] Step a1: Map the integer sequence of the input layer to the word vector matrix W through a table lookup operation;

[0118] Step b1: In the LSTM layer, input the word vector matrix W, and calculate the layer output matrix H through the LSTM layer;

[0119] Step c1: The layer output matrix H is averaged through the mean layer to obtain a dense vector v of fixed length;

[0120] Step d1: The dense vector v passes through the fully connected layer and the activation function to finally obtain the category probability vector.

[0121] In step a1, the word vector matrix W is a V×d matrix, where V is the size of the vocabulary and d is the dimension of the word vector; given an integer sequence , each are all IDs in a vocabulary, through the embedding matrix , mapped to the corresponding word vector, the formula is as follows:

[0122]

[0123] Finally, the integer sequence will be converted into a word vector matrix , where each word vector , represents d-dimensional real number space;

[0124] The specific steps of obtaining the layer output matrix through the LSTM layer in step b1 are as follows:

[0125] Step a2: Calculate the forget gate , the specific formula is as follows:

[0126]

[0127] In the formula, and Respectively represent the weight and bias of the forget gate, Indicates that at time step The hidden state vector of represents the word vector input at time step t, express Sigmoid function;

[0128] Step b2: Calculate the input gate and candidate memory , the specific formula is as follows:

[0129] ;

[0130]

[0131] In the formula, and Represents the weight and bias of the input gate, and represents the weight and bias of the candidate memory, represents the hyperbolic tangent function;

[0132] Step c2: Update the cell state. The cell state is one of the core concepts of LSTM. It is used to store long-term information from the current time step to the future. It is similar to the "memory" mechanism of the network. It can be regarded as an "information channel" flowing in the LSTM network, allowing information to propagate throughout the sequence. At the same time, different gating mechanisms are used to selectively save, update or delete information. The specific formula is as follows:

[0133]

[0134] In the formula, represents the long-term memory of the LSTM layer at time step t; represents the long-term memory of the LSTM layer at time step t-1;

[0135] Step d2: Calculate the output gate , the specific formula is as follows:

[0136]

[0137] In the formula, and Respectively represent the weight and bias of the output gate;

[0138] Step e2: Calculate the hidden state. The specific formula is as follows:

[0139]

[0140] Finally, the LSTM layer outputs a layer output matrix of sequence hidden states ;

[0141] In step c1, the mean layer usually refers to a pooling operation, which is to average the input matrix in the direction of time step (or sequence length), and average the layer output matrix H through the mean layer to obtain a dense vector of fixed length, where the layer output matrix , express dimensional real space, the layer output matrix H is a Matrix, the specific formula of this step is:

[0142]

[0143] In the formula, the dense vector is the dense vector after mean pooling, h i represents the i-th column vector of the output matrix H, and n represents the number of layers;

[0144] In step d1, the activation function is selected as the Softmax function; the dense vector v passes through the fully connected layer and the specific steps of finally obtaining the category probability vector through the activation function are as follows:

[0145] Step a3: The dense vector v is linearly transformed in the fully connected layer. The specific formula is as follows:

[0146]

[0147] In the formula, is the weight matrix of the fully connected layer, is the bias vector, , k represents the number of categories, z means the output of the fully connected layer, which is the result of linear transformation of the dense vector v;

[0148] Step b3: Use the Softmax function to convert to a probability vector. The specific formula is as follows:

[0149]

[0150] In the formula, p i It indicates the probability that the model predicts that the sample belongs to the i-th category, is the output class probability vector, is the number of categories, is the logarithmic probability value of the fully connected layer output category i, is the logarithmic probability value of the fully connected layer output category j, and e represents a natural constant.

[0151] Example 3

[0152] Based on Example 1, the final result in step 6 is the category probability of each corresponding family, where the family represents the APT attack organization; the meaning of APT is advanced persistent threat attack; in step 6, the pre-processed new malicious sample is input into the trained LSTM model, and the specific steps of obtaining the final result are as follows:

[0153] Step a1: Map the integer sequence of the input layer to the word vector matrix W through a table lookup operation;

[0154] Step b1: In the LSTM layer, input the word vector matrix W, and calculate the layer output matrix H through the LSTM layer;

[0155] Step c1: The layer output matrix H is averaged through the mean layer to obtain a dense vector v of fixed length;

[0156] Step d1: The dense vector v passes through the fully connected layer and the activation function to finally obtain the category probability vector.

[0157] In step a1, the word vector matrix W is a V×d matrix, where V is the size of the vocabulary and d is the dimension of the word vector; given an integer sequence , each are all IDs in a vocabulary, through the embedding matrix , mapped to the corresponding word vector, the formula is as follows:

[0158]

[0159] Finally, the integer sequence will be converted into a word vector matrix , where each word vector , represents d-dimensional real number space;

[0160] The specific steps of obtaining the layer output matrix through the LSTM layer in step b1 are as follows:

[0161] Step a2: Calculate the forget gate , the specific formula is as follows:

[0162]

[0163] In the formula, and Respectively represent the weight and bias of the forget gate, Indicates that at time step The hidden state vector of represents the word vector input at time step t, express Sigmoid function;

[0164] Step b2: Calculate the input gate and candidate memory , the specific formula is as follows:

[0165] ;

[0166]

[0167] In the formula, Represents each word vector, where it is the weight of the input gate category i, represents the bias of the input gate, and represents the weight and bias of the candidate memory, represents the hyperbolic tangent function;

[0168] Step c2: Update the cell state. The cell state is one of the core concepts of LSTM. It is used to store long-term information from the current time step to the future. It is similar to the "memory" mechanism of the network. It can be regarded as an "information channel" flowing in the LSTM network, allowing information to propagate throughout the sequence. At the same time, different gating mechanisms are used to selectively save, update or delete information. The specific formula is as follows:

[0169]

[0170] In the formula, represents the long-term memory of the LSTM layer at time step t; represents the long-term memory of the LSTM layer at time step t-1;

[0171] Step d2: Calculate the output gate , the specific formula is as follows:

[0172]

[0173] In the formula, and Respectively represent the weight and bias of the output gate;

[0174] Step e2: Calculate the hidden state. The specific formula is as follows:

[0175]

[0176] Finally, the LSTM layer outputs a layer output matrix of sequence hidden states ;

[0177] In step c1, the mean layer usually refers to a pooling operation, which is to average the input matrix in the direction of time step (or sequence length), and average the layer output matrix H through the mean layer to obtain a dense vector of fixed length, where the layer output matrix , express dimensional real space, the layer output matrix H is a Matrix, the specific formula of this step is:

[0178]

[0179] In the formula, the dense vector is the dense vector after mean pooling, h i represents the i-th column vector of the output matrix H, and n represents the number of layers;

[0180] In step d1, the activation function is selected as the Softmax function; the dense vector v passes through the fully connected layer and the specific steps of finally obtaining the category probability vector through the activation function are as follows:

[0181] Step a3: The dense vector v is linearly transformed in the fully connected layer. The specific formula is as follows:

[0182]

[0183] In the formula, is the weight matrix of the fully connected layer, is the bias vector, , k represents the number of categories, z means the output of the fully connected layer, which is the result of linear transformation of the dense vector v;

[0184] Step b3: Use the Softmax function to convert to a probability vector. The specific formula is as follows:

[0185]

[0186] In the formula, p i It indicates the probability that the model predicts that the sample belongs to the i-th category, is the output class probability vector, is the number of categories, is the logarithmic probability value of the fully connected layer output category i, is the logarithmic probability value of the fully connected layer output category j, and e represents a natural constant.

[0187] In order to enhance the feature extraction of malicious samples by the LSTM layer in step b1, the adjustment of the LSTM layer includes the following specific steps:

[0188] Step a4: Introduce bidirectional LSTM to capture sequence information from left to right and from right to left, and concatenate the hidden states in the two directions. The specific formula is as follows:

[0189] ;

[0190] ;

[0191] ;

[0192] In the formula, Indicates that LSTM processes the sequence from left to right at time step The hidden state of Indicates that when processing the sequence from right to left, LSTM is at time step The hidden state of Represents the bidirectional LSTM at time step The output state of , which contains the output of the hidden state concatenated from left to right and from right to left; Represents input Calculation at the LSTM layer; Indicates that when processing the sequence from right to left, LSTM is at time step The hidden state of Indicates that LSTM processes the sequence from left to right at time step The hidden state of

[0193] Step b4: Increase the number of LSTM layers so that the model can capture deeper feature information. Multiple layers of LSTM can be stacked, and the input of each layer is the output of the previous layer. The specific formula is as follows:

[0194]

[0195] In the formula, Indicates that LSTM The time step of the layer The hidden state of Indicates that LSTM The time step of the layer The hidden state of Indicates that LSTM The time step of the layer The hidden state of .

[0196] The weights and activation functions of the fully connected layer in step d1 are adjusted to enhance the detection performance of malicious samples. The specific adjustment steps are as follows:

[0197] Step a5: Introduce L2 regularization to prevent overfitting, especially when dealing with malicious samples, which can increase the generalization ability of the model. The loss function after regularization is:

[0198]

[0199] In the formula, represents the loss function, where are model parameters, is the cross entropy loss, N represents the number of samples, is the regularization parameter, represents the L2 regularization term, the L2 norm square of the model parameters, represents the predicted probability, Indicates that the sample belongs to the label of the i-th category;

[0200] Step b5: Add a Dropout layer before the fully connected layer to randomly discard some neurons to reduce overfitting. The specific formula is:

[0201]

[0202] In the formula, represents the output of the fully connected layer, is the discard probability.

[0203] After being converted into a probability vector using the Softmax function, a weighted cross entropy loss function is introduced to enhance the ability to distinguish malicious samples. The specific formula is:

[0204]

[0205] In the formula, represents each word vector, where it is the weight of the input gate category i; i is the true label, indicating that the sample belongs to the mark of the i-th category; p i is the predicted probability, which indicates the probability that the model predicts that the sample belongs to the i-th category.

[0206] The above description is a detailed description of the preferred feasible embodiment of the present application, but the embodiment is not intended to limit the patent application scope of the present application. All equivalent changes or modified changes made under the technical spirit suggested by the present application should fall within the patent scope covered by the present application.

Claims

1. A binary homologous sample analysis method based on AI, characterized in that: The specific steps include: Step 1: Read the file content, identify the specific shell type, and then de-shell to obtain the original data file; Step 2: Disassemble the unpacked original data file to obtain the assembly instruction code; Step 3: Convert the assembly instruction code into intermediate code, and then convert the intermediate code into high-level language through the natural language model for malicious code feature tagging to create a malicious sample data set; Step 4: Preprocess some malicious samples in the data set and then perform label encoding; Step 5: Build an LSTM model that can enhance the ability to extract and detect malicious samples, and input some of the processed malicious samples into the LSTM model for training; Step 6: Input the preprocessed new malicious sample into the trained LSTM model to obtain the final result; The specific method of preprocessing in step 4 and step 6 is: assign a family classification label to each malicious sample in some malicious samples, then split the malicious sample code into words, then perform integer encoding, integer serialize the split words, fill or truncate all integer sequences to the same length, build a vocabulary for all integer sequences, and assign a unique integer ID to each word; the specific method of label encoding is to convert the family classification label into a unique integer ID or one-hot encoding; The final result in step 6 is the category probability of each corresponding family, where the family represents the APT attack organization. In step 6, the preprocessed new malicious sample is input into the trained LSTM model. The specific steps to obtain the final result are as follows: Step a1: Map the integer sequence of the input layer to the word vector matrix W through a table lookup operation; Step b1: In the LSTM layer, input the word vector matrix W, and calculate the layer output matrix H through the LSTM layer; Step c1: The layer output matrix H is averaged through the mean layer to obtain a dense vector v of fixed length; Step d1: The dense vector v passes through the fully connected layer and the activation function to finally obtain the category probability vector; In step a1, the word vector matrix W is a V×d matrix, where V is the size of the vocabulary and d is the dimension of the word vector. , each are all IDs in a vocabulary, through the embedding matrix , mapped to the corresponding word vector, the formula is as follows: ; Finally, the integer sequence will be converted into a word vector matrix , where each word vector , represents d-dimensional real number space; The specific steps of obtaining the layer output matrix through the LSTM layer in step b1 are as follows: Step a2: Calculate the forget gate , the specific formula is as follows: ； In the formula, and Respectively represent the weight and bias of the forget gate, Indicates that at time step The hidden state vector of represents the word vector input at time step t, express Sigmoid function; Step b2: Calculate the input gate and candidate memory , the specific formula is as follows: ； ； In the formula, Represents each word vector, where it is the weight of the input gate category i, represents the bias of the input gate, and represents the weight and bias of the candidate memory, represents the hyperbolic tangent function; Step c2: Update the cell status. The specific formula is as follows: ； In the formula, represents the long-term memory of the LSTM layer at time step t; represents the long-term memory of the LSTM layer at time step t-1; Step d2: Calculate the output gate , the specific formula is as follows: ； In the formula, and Respectively represent the weight and bias of the output gate; Step e2: Calculate the hidden state. The specific formula is as follows: ； Finally, the LSTM layer outputs a layer output matrix of sequence hidden states ； In step c1, the layer output matrix H is averaged through the mean layer to obtain a dense vector of fixed length, where the layer output matrix , express dimensional real space, the layer output matrix H is a Matrix, the specific formula of this step is: ； In the formula, the dense vector is the dense vector after mean pooling, h i represents the i-th column vector of the output matrix H, and n represents the number of layers; In step d1, the activation function is selected as the Softmax function; the dense vector v passes through the fully connected layer, and the specific steps of finally obtaining the category probability vector through the activation function are as follows: Step a3: The dense vector v is linearly transformed in the fully connected layer. The specific formula is as follows: ； In the formula, is the weight matrix of the fully connected layer, is the bias vector, , k represents the number of categories, z means the output of the fully connected layer, which is the result of linear transformation of the dense vector v; Step b3: Use the Softmax function to convert to a probability vector. The specific formula is as follows: ； In the formula, p i It indicates the probability that the model predicts that the sample belongs to the i-th category, is the output class probability vector, is the number of categories, is the logarithmic probability value of the fully connected layer output category i, is the logarithmic probability value of the fully connected layer output category j, and e represents a natural constant; In order to enhance the feature extraction of malicious samples by the LSTM layer in step b1, the adjustment of the LSTM layer includes the following specific steps: Step a4: Introduce bidirectional LSTM to capture sequence information from left to right and from right to left, and concatenate the hidden states in the two directions. The specific formula is as follows: ； ； ； In the formula, Indicates that LSTM processes the sequence from left to right at time step The hidden state of Indicates that when the LSTM processes the sequence from right to left, it is at time step The hidden state of Represents the bidirectional LSTM at time step The output state of , including the output of the hidden state concatenated from left to right and from right to left; Represents input Calculation at the LSTM layer; Indicates that when the LSTM processes the sequence from right to left, it is at time step The hidden state of Indicates that LSTM processes the sequence from left to right at time step The hidden state of Step b4: Increase the number of LSTM layers so that the model can capture deeper feature information. The specific formula is as follows: ； In the formula, Indicates that LSTM The time step of the layer The hidden state of Indicates that LSTM The time step of the layer The hidden state of Indicates that LSTM The time step of the layer The hidden state of The weights and activation functions of the fully connected layer in step d1 are adjusted to enhance the detection performance of malicious samples. The specific adjustment steps are as follows: Step a5: Introduce L2 regularization to prevent overfitting. The loss function after regularization is: ； In the formula, represents the loss function, where are model parameters, is the cross entropy loss, N represents the number of samples, is the regularization parameter, represents the L2 regularization term, the L2 norm square of the model parameters, represents the predicted probability, Indicates that the sample belongs to the label of the i-th category; Step b5: Add a Dropout layer before the fully connected layer to randomly discard some neurons to reduce overfitting. The specific formula is: ； In the formula, represents the output of the fully connected layer, is the discard probability.

2. The AI-based binary homologous sample analysis method according to claim 1, characterized in that: The specific method of reading the file content in step one is to open the binary file, read the bytes step by step, and read the file content into the memory; the specific method of identifying the shell type is to use the tool to analyze the binary data in the memory to scan the file header and section table; the specific method of unpacking is to call the unpacking tool to perform unpacking to obtain the original binary data; the specific method of disassembly in step two is to input the unpacked original data file into the disassembly tool, and obtain the assembly instruction code through the automatic parsing and analysis of the disassembly tool.

3. The AI-based binary homologous sample analysis method according to claim 1, characterized in that: The specific steps of converting the assembly instruction code into the intermediate code in step 3 are as follows: the assembly instruction code is converted into LLVM IR code by using the LLVM toolkit, and the LLVM IR code is then converted into a high-level language by calling the natural language large model through the prompt word template.

4. The AI-based binary homologous sample analysis method according to claim 1, characterized in that: The specific steps to split the malicious sample into words and then perform integer encoding are: Step a: First, perform word segmentation to split the complete sentence into words or word sequences: ； Wherein, t1, t2 and t3 all mean split words or word sequences; Step b: After word segmentation is completed, map each split word or word sequence to an ID sequence in the vocabulary: ； In the formula, a1, a2 and a3 are the integer IDs corresponding to each word segment or word sequence; Step c: The specific method of padding or truncating all integer sequences to the same length is: if , then fill in the padding symbol at the end of the sentence so that the length after padding is: , where The meaning is the length of the integer sequence, is the upper limit of the sentence length, c is the filling symbol; if , then truncate to length , keep the previous words, the truncated length is .

5. The AI-based binary homologous sample analysis method according to claim 1, characterized in that: After being converted into a probability vector using the Softmax function, a weighted cross entropy loss function is introduced to enhance the ability to distinguish malicious samples. The specific formula is: ； In the formula, represents each word vector, where it is the weight of the input gate category i; i Indicates that the sample belongs to the mark of the i-th category; p i It represents the probability that the model predicts that the sample belongs to the i-th category.

Images