Code detection method, device, electronic device and computer readable storage medium

Abstract

The present application discloses a code detection method, device, electronic device and computer-readable storage medium, which relates to the field of computer technology, including: processing the one-dimensional bit flow data of the target code into two-dimensional bit flow data according to the flow collection time; extracting the first type of features from the two-dimensional bit flow data to form a first feature matrix; performing at least one of the first detection operation and the second detection operation according to the first feature matrix to obtain the code detection result; wherein the first detection operation is used to determine the confidence corresponding to the target code when it belongs to each of multiple known malicious codes according to at least the first feature matrix; the second detection operation is used to detect whether the target code belongs to malicious code according to the first type of features that meet the significance condition in the first feature matrix. The present application can improve the accuracy of detecting whether the code is malicious code.

Description

Technical Field

[0001] The present application relates to the fields of software security technology and computer technology, and more specifically, to a code detection method, device, electronic device, and computer-readable storage medium. Background Art

[0002] Malicious codes can generally be divided into types such as viruses, Trojans, worms, zombie programs, and spyware. Malicious codes usually have characteristics such as spread, concealment, destructiveness, intelligence, controllability, complexity, diversity, and integration. They can damage user files, steal information, damage systems, and destroy networks.

[0003] At present, there are several detection methods for malicious codes, including signature-based detection method, heuristic-based detection method, behavior-based detection method, machine learning-based detection method, sandbox-based detection method, etc. For signature-based detection method, before the malicious code is detected, the signature code of the malicious code needs to be added to the malicious code library. Since the number of malicious codes is large and they change rapidly, the malicious code library needs to be updated regularly.

[0004] However, due to the large size of the malicious code library, the detection efficiency is low and it is easy to be bypassed; the heuristic-based detection method has high detection efficiency but a high false alarm rate; the sandbox-based detection method has high detection efficiency, but the detection result of whether it is malicious code cannot be directly determined and requires expert review, which increases the complexity of detection. Summary of the invention

[0005] Embodiments of the present application provide a code detection method, device, electronic device, and computer-readable storage medium.

[0006] According to one aspect of an embodiment of the present application, a code detection method is provided, comprising: processing one-dimensional bit flow data of a target code into two-dimensional bit flow data according to a flow collection time; extracting a first type of feature from the two-dimensional bit flow data and forming a first feature matrix, wherein the first feature matrix is ​​used to represent the first type of feature, and the first type of feature has a higher significance in distinguishing whether the target code belongs to a malicious code than a second type of feature different from the first type of feature; performing at least one of a first detection operation and a second detection operation according to the first feature matrix to obtain a code detection result; wherein the first detection operation is used to determine the confidence corresponding to the target code when it belongs to each of a plurality of known malicious codes according to at least the first feature matrix; and the second detection operation is used to detect whether the target code belongs to a malicious code according to the first type of feature that meets the significance condition in the first feature matrix.

[0007] In one example, one-dimensional bit flow data of a target code is processed into two-dimensional bit flow data according to a flow collection time, including: collecting a binary bit stream of the target code; preprocessing the binary bit stream to obtain a first bit stream in a two-dimensional form, wherein the preprocessing includes: after filtering abnormal data in the binary bit stream, converting the one-dimensional binary bit stream into a two-dimensional bit stream according to the collection time information corresponding to each one-dimensional data in the binary bit stream.

[0008] In one example, extracting a first type of feature from two-dimensional bit flow data includes: extracting a plurality of first type of features from the two-dimensional bit flow data, wherein the plurality of first type of features include at least two of a mixed Gaussian distribution map, a local average value, and a local adaptive perceptual hash value corresponding to the two-dimensional bit flow data; extracting the mixed Gaussian distribution map corresponding to the two-dimensional bit flow data includes: performing a scale transformation on the two-dimensional bit flow data of the target code to obtain a second bit stream, wherein the scale transformation is used to determine a feature sampling rate for the second bit stream by changing time dimension information of the second bit stream; determining a global average value corresponding to the second bit stream according to each element in the second bit stream; calculating a mixed Gaussian distribution map corresponding to the second bit stream, wherein the mixed Gaussian distribution map is used to obtain a second bit stream; and The invention relates to a method for extracting a local average value corresponding to two-dimensional bit flow data, comprising: filtering noise data in a mixed Gaussian distribution map to obtain a target mixed Gaussian distribution map, wherein the noise data is data in the mixed Gaussian distribution map that is greater than or equal to a noise threshold; calculating the average value of all data in the target mixed Gaussian distribution map to obtain a local average value corresponding to the second bit stream; and extracting a local adaptive perceptual hash value corresponding to two-dimensional bit flow data, comprising: determining a local adaptive perceptual hash value corresponding to the second bit stream according to a global average value and a local average value corresponding to the second bit stream, wherein the local adaptive perceptual hash value is a hash value determined according to a size relationship between the global average value and the local average value.

[0009] In one example, calculating a mixed Gaussian distribution map corresponding to a second bit stream includes: converting the second bit stream into a target matrix, wherein the number of rows and the number of columns of the target matrix are both preset values; calculating a target mean and a target standard deviation corresponding to each position in the target matrix, wherein the target mean corresponding to each position represents the average value of all elements corresponding to the same acquisition moment as the element at the position, and the target standard deviation corresponding to each position represents the standard deviation of all elements corresponding to the same acquisition moment as the element at the position; determining a mean matrix corresponding to the target matrix according to the target mean corresponding to each position; determining a standard deviation matrix corresponding to the target matrix according to the target standard deviation corresponding to each position; determining eigenvalues ​​of the mixed Gaussian distribution of the elements at each position in the target matrix according to the mean matrix and the standard deviation matrix; determining a mixed Gaussian distribution map according to the eigenvalues ​​of the mixed Gaussian distribution of the elements at each position in the target matrix.

[0010] In one example, the process of determining the second type of features includes the following steps: scaling the two-dimensional bit flow data to obtain a second bit stream, wherein the scaling is used to determine the feature sampling rate by changing the time dimension information of the two-dimensional bit flow data; decomposing the second bit stream in the frequency domain, and extracting at least one of the following features of the second bit stream as the second type of features: two-dimensional discrete cosine features, two-dimensional discrete sine features, two-dimensional empirical mode principal component features, and two-dimensional residual signals.

[0011] In one example, at least one of a first detection operation and a second detection operation is performed according to a first feature matrix to obtain a code detection result, including: when performing the first detection operation, detecting whether the corresponding confidence of the target code when it belongs to each known malicious code is greater than a first threshold according to the first feature matrix and the second feature matrix, to obtain a confidence detection result of the target code, wherein the second feature matrix is ​​used to characterize the second type of features in a matrix form; when performing the second detection operation, determining a risk score of the target code according to the number of first type features that meet the significance condition in the first feature matrix, wherein the risk score is used to quantitatively characterize the probability that the target code belongs to malicious code; determining whether the target code is malicious code according to the confidence detection result of the target code and / or the risk score of the target code.

[0012] In one example, a risk score of a target code is determined based on the number of first-category features that meet a significance condition in a first feature matrix, including: for each first-category feature in the first feature matrix, obtaining the number of features of the first-category feature that meet a first significance condition and the number of features of the first-category feature that meet a second significance condition, performing statistical calculations on the number of features of the first-category feature that meet the first significance condition and the number of features of the first-category feature that meet the second significance condition to obtain a target feature value of the first-category feature; and determining the risk score of the target code based on the target feature value of each first-category feature in the first feature matrix and the feature threshold corresponding to each first-category feature.

[0013] In one example, the code detection method also includes: when it is detected that the number of elements in the mixed Gaussian distribution map does not exceed a preset number, calculating the Gaussian distribution matrix corresponding to the mixed Gaussian distribution map; calculating the mean matrix corresponding to the Gaussian distribution matrix; determining the user feature score corresponding to the target code based on the maximum value, minimum value and each element value in the mean matrix corresponding to the Gaussian distribution matrix, wherein the user feature score is negatively correlated with the probability of a change in the code compilation behavior implemented by the user who compiles the target code; when the user feature score is less than or equal to the score threshold, determining that the target code is not malicious code.

[0014] In one example, the confidence corresponding to the target code when it belongs to each known malicious code among multiple known malicious codes is determined, including: performing feature fusion calculation on a first feature matrix and a second feature matrix through a neural network model, and determining the confidence corresponding to the target code when it belongs to each known malicious code based on the target feature matrix obtained after the fusion calculation, wherein the second feature matrix represents the second feature in the form of a matrix; wherein the neural network model includes a first model branch, a second model branch and an attention network layer, the first model branch is used to calculate the first feature matrix; the second model branch is used to calculate the second feature matrix, and the attention network layer is used to assign corresponding weights to the first feature matrix and the second feature matrix, wherein the first model branch and the second model branch are two independent neural network branches.

[0015] According to another aspect of an embodiment of the present application, a code detection device is also provided, which includes: a first processing unit, which is used to process the one-dimensional bit flow data of the target code into two-dimensional bit flow data according to the flow collection time; a second processing unit, which is used to extract the first type of features from the two-dimensional bit flow data and form a first feature matrix, wherein the first feature matrix is ​​used to represent the first type of features, and the first type of features are more significant in distinguishing whether the target code belongs to malicious code than the second type of features different from the first type of features; a third processing unit, which is used to perform at least one of the first detection operation and the second detection operation according to the first feature matrix to obtain a code detection result; wherein the first detection operation is used to determine the confidence corresponding to the target code when it belongs to each known malicious code among multiple known malicious codes at least according to the first feature matrix; the second detection operation is used to detect whether the target code belongs to malicious code according to the first type of features that meet the significance condition in the first feature matrix.

[0016] According to another aspect of an embodiment of the present application, a computer-readable storage medium is further provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program runs, the device where the computer-readable storage medium is located executes the above-mentioned code detection method.

[0017] According to another aspect of an embodiment of the present application, an electronic device is also provided, wherein the electronic device includes one or more processors and a memory, the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors execute the above-mentioned code detection method.

[0018] It should be noted that the code detection method, device, storage medium and electronic device provided by the present application, in the malicious code detection task, introduces a time dimension to the one-dimensional bit stream of the target code. In this way, the combination of the two dimensions can comprehensively consider the correlation between different data, which can significantly improve the accuracy of code detection. In addition, according to the extracted significant features (i.e., the first type of features mentioned above), a first detection operation is performed to determine the confidence corresponding to the target code when it belongs to each of multiple known malicious codes, or a second detection operation is performed to detect whether the target code belongs to malicious code by combining the significant features with the significant conditions. Since noise and redundant information can be effectively reduced by extracting significant features, it is possible to effectively identify whether the code is malicious code; and the extracted significant features are combined with the first detection operation and the second detection operation, so that code detection is performed in combination with multiple detection operations, which can greatly improve the accuracy and coverage of code detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 is a flowchart of an optional code detection method according to an embodiment of the present application;

[0021] Figure 2 is a flowchart of an optional conventional feature extraction process according to an embodiment of the present application;

[0022] Figure 3 is a flowchart of an optional significant feature extraction process according to an embodiment of the present application;

[0023] Figure 4 is a schematic diagram of an optional malicious code detection method according to an embodiment of the present application;

[0024] Figure 5 It is a flow chart of detecting whether a code is malicious code according to a mixed Gaussian distribution graph according to an embodiment of the present application;

[0025] Figure 6 is a schematic diagram of the use process of a neural network model according to an embodiment of the present application;

[0026] Figure 7 is an optional training flow chart of a deep learning-based code detection model according to an embodiment of the present application;

[0027] Figure 8 It is a workflow framework diagram of a malicious code detection system according to an embodiment of the present application;

[0028] Fig. 9 It is a schematic diagram of an optional code detection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] It should also be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected by this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or institution through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or institution.

[0032] In an optional embodiment, a malicious code detection system (hereinafter referred to as the detection system) can be used as the execution subject of the malicious code detection method in the embodiment of the present application, wherein the detection system can be a software system or an embedded system that combines software and hardware. Of course, in addition to using the detection system as the execution subject, other forms of devices and equipment can also be used as the execution subject of the technical solution of the embodiment of the present application. The present application does not specifically limit the specific type of the execution subject. For example, the execution subject can also be a physical device or virtual service such as a server / cloud that interacts with the client and has security protection functions for the client.

[0033] For the convenience of description, the detection system is used as the execution entity below to illustrate the technical solutions of the embodiments of the present application.

[0034] According to an embodiment of the present application, an embodiment of a code detection method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0035] Figure 1 is a flowchart of an optional code detection method according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0036] Step S101, processing the one-dimensional bit flow data of the target code into two-dimensional bit flow data according to the flow collection time.

[0037] Optionally, taking the target code as software running on the client as an example, the detection system can collect the binary bit stream generated by the client (including but not limited to at least one of the following: specific sensitive strings, sensitive code obfuscation, sensitive registry and service registration, monitoring, and record macros of user routine operations, regular and irregular traffic, etc.). Then pre-process the collected binary bit stream, including but not limited to data parsing of the binary bit stream, removal of invalid data (i.e., the above-mentioned abnormal data), and adjusting the valid data obtained after parsing to the time of traffic collection. Two-dimensional data , where two-dimensional data It can be understood as a two-dimensional matrix, w is the width of the matrix (number of columns), h is the height of the matrix (number of rows), and the values ​​of w and h can be the same.

[0038] In some examples, two-dimensional data The bit data with the same traffic collection time are located in the same row in the two-dimensional matrix.

[0039] It should be noted that the binary bit stream may contain a series of abnormal data, such as data with abnormal encoding / decoding, data with abnormal transmission, noise data caused by abnormal hardware input and output (for example, due to the client's voltage, current and other inputs, the client's output is changed, making the output unstable and generating noise), data with default values, etc. These abnormal data are not conducive to the accurate detection of malicious code, so they need to be filtered out through preprocessing to retain valid data.

[0040] In addition, the collected binary bit stream is essentially one-dimensional data. In order to quantify the time correlation of one-dimensional data, the present application processes the binary bit stream into a two-dimensional bit stream (i.e., the above-mentioned two-dimensional bit flow data), so that the correlation between different data can be comprehensively considered through two dimensions, and finally the technical effect of taking the time dimension into consideration in the subsequent malicious code detection task is achieved. For example, the initially collected binary bit stream is a one-dimensional sequence composed of 0 and 1, where 1 and 0 belong to the one-dimensional data in the binary bit stream. The collection time corresponding to each value "1" or "0" can be obtained, and then the collection time is used as the time dimension, so as to update the one-dimensional sequence to a two-dimensional sequence (including the collection time and the original one-dimensional data). The updated two-dimensional sequence is the above-mentioned two-dimensional bit flow data.

[0041] Step S102, extracting first-category features from the two-dimensional bit flow data and forming a first feature matrix, wherein the first feature matrix is ​​used to represent the first-category features, and the first-category features are more significant in distinguishing whether the target code is malicious code than the second-category features that are different from the first-category features.

[0042] In step S102, the first type of features may also be referred to as significant features or notable features, and the second type of features may also be referred to as regular features, wherein the probability of a significant feature appearing in the two-dimensional bit flow data of a malicious code is higher than the probability of appearing in the two-dimensional bit flow data of a normal code; regular features are different from significant features, for example, the probability difference value between the probability of a regular feature appearing in the two-dimensional bit flow data of a malicious code and the probability of appearing in the two-dimensional bit flow data of a normal code is less than a preset threshold.

[0043] Optionally, the significant features and common features are described as follows:

[0044] Taking the minimum dimension to characterize the data characteristics as the starting point, compared with conventional features, significant features can achieve the function of malicious code detection through lower data dimensions. In malicious code detection, significant features refer to features that are significantly prominent in the two-dimensional bit flow data of malicious code, usually direct indicators of malicious code behavior (such as specific API call behavior, abnormal system call sequence, specific string (such as specific URL or IP address), encrypted or obfuscated code fragments, etc.). Significant features rarely appear in the two-dimensional bit flow data of normal code or have significant differences from the features of normal code.

[0045] In addition, conventional features refer to features that are commonly found in the two-dimensional bit flow data of the code and can be used to describe the code behavior. These features may exist in both malicious code and normal code, but may differ in statistical distribution. Conventional features can be static features related to the code (such as file size, number of functions, code complexity) and dynamic features (such as system call frequency, resource usage).

[0046] In summary, significant features usually have stronger representation capabilities and can more clearly show the characteristics of the client code to be detected under the same data dimension, so as to better distinguish abnormal data in the client, and then identify malicious code and detect changes in user compilation habits.

[0047] In the present application, the pre-trained malicious code detection model can be corrected using significant features in a feature-guided manner, thereby improving the detection performance of the model without losing feasibility.

[0048] Step S103, performing at least one of a first detection operation and a second detection operation according to the first feature matrix to obtain a code detection result; wherein the first detection operation is used to determine the confidence corresponding to the target code when it belongs to each of multiple known malicious codes according to at least the first feature matrix; the second detection operation is used to detect whether the target code belongs to malicious code according to the first type of features that meet the significance condition in the first feature matrix.

[0049] Optionally, the detection system can be based on a pre-trained neural network model, using the prior knowledge learned by the neural network model during the model training phase, and according to the significant features and conventional features, determine the confidence level corresponding to the target code when it belongs to each of M known malicious codes, where M is an integer greater than or equal to 1.

[0050] The confidence level corresponding to the target code belonging to the mth known malicious code among M known malicious codes is positively correlated with the possibility (or probability) that the target code belongs to the mth known malicious code. m is a positive integer less than or equal to M.

[0051] It should be noted that the higher the confidence level corresponding to the target code belonging to a known malicious code, the higher the possibility that the target code belongs to the known malicious code.

[0052] Optionally, there may be multiple significant features, each of which is set with a corresponding significant condition. If a significant feature satisfies the corresponding significant condition, the more features the significant feature has, the higher the feature expression strength of the significant feature. Furthermore, if the feature expression strength of a significant feature of the target code is higher, assuming that only the significant feature is used for evaluation, the probability that the target code is malicious code is also higher.

[0053] In some examples, each significant feature may correspond to two significance conditions. Setting two different significance conditions for each significant feature can avoid state jumps caused by repeated changes in critical states of the significant feature, thereby further improving the accuracy of detecting whether the target code is malicious code.

[0054] It is understandable that different significant features may correspond to different significant conditions.

[0055] In step S103, for each significant feature, the number of features that satisfy the first significant feature condition and the number of features that satisfy the second significant feature condition can be obtained, and the number of features that satisfy the first significant feature condition and the number of features that satisfy the second significant feature condition are statistically calculated to obtain the target feature value of the significant feature. The statistical calculation includes but is not limited to various calculation methods such as calculating ratios and calculating differences. The target feature value of the significant feature can be used to identify whether the target code is malicious code.

[0056] Based on the contents of the above steps S101 to S103, it can be known that the code detection method, device, storage medium and electronic device provided by the present application, in the malicious code detection task, introduces a time dimension to the one-dimensional bit stream of the target code, so that the combination of the two dimensions can comprehensively consider the correlation between different data, and can significantly improve the accuracy of code detection. In addition, according to the extracted significant features (i.e., the above-mentioned first features), a first detection operation is performed to determine the confidence corresponding to the target code when it belongs to each of the multiple known malicious codes, or a second detection operation is performed to detect whether the target code belongs to the malicious code by combining the significant features with the significant conditions. Since the noise and redundant information can be effectively reduced by extracting the significant features, it can effectively identify whether the code is malicious code; and the extracted significant features are combined with the first detection operation and the second detection operation, so that the code detection is combined with multiple detection operations, which can greatly improve the accuracy and coverage of the detection.

[0057] In an optional embodiment, in the process of processing the one-dimensional bit flow data of the target code into two-dimensional bit flow data according to the flow collection time, the detection system can collect the binary bit stream corresponding to the target code, and then preprocess the binary bit stream to obtain a first bit stream in two-dimensional form, wherein the preprocessing includes: after filtering the abnormal data in the binary bit stream, converting the one-dimensional binary bit stream into a two-dimensional bit stream according to the collection time information corresponding to each one-dimensional data in the binary bit stream.

[0058] In an optional embodiment, the process of determining the second type of features (conventional features) includes the following steps:

[0059] The two-dimensional bit stream data is scaled to obtain a second bit stream, wherein the scale transformation is used to determine the feature sampling rate by changing the time dimension information of the two-dimensional bit stream data; the second bit stream is decomposed in the frequency domain, and at least one of the following features of the second bit stream is extracted as a second type of feature: a two-dimensional discrete cosine feature, a two-dimensional discrete sine feature, a two-dimensional empirical mode principal component feature, and a two-dimensional residual signal.

[0060] Optionally, the preprocessed data (i.e., the first bit stream) itself can be regarded as a directly obtained regular feature (the regular feature is the second type of feature mentioned above). This directly obtained regular feature is a collection of multiple frequency signals, and signals in different frequency bands can represent different behaviors. Decomposing the signal in the frequency domain is conducive to counting the different behaviors contained in the signal, which is conducive to the detection of the model.

[0061] In addition, the preprocessed data also contains periodic signals, which represent regular behaviors to a certain extent. After removing the periodic signals, the remaining mutation signals are more likely to be the unique characteristics of malicious code. Therefore, this mutation signal can also be extracted as a basis for detecting malicious code.

[0062] Optionally, the detection system may use the first bit stream after preprocessing Input to the conventional feature extraction module, and then the first bit stream data of the input After scaling, we get Two-dimensional bit stream input data (i.e., the second bit stream mentioned above). Subsequently, the second bit stream is decomposed in the frequency domain to extract at least one of the following second-category features of the second bit stream: a two-dimensional discrete cosine feature, a two-dimensional discrete sine feature, a two-dimensional empirical mode principal component feature, and a two-dimensional residual signal. Finally, a conventional feature matrix is ​​constructed based on these second-category features. (Also called the second characteristic matrix).

[0063] Optionally, 2D Discrete Cosine Transform Feature (DCTF), 2D Discrete Sine Transform Feature (DSTF), 2D Empirical Mode Decomposition Feature (EMDF), and 2D Residual Signal (RES) are four different feature extraction methods. The following is a description of each feature:

[0064] About two-dimensional discrete cosine features (DCTF): Discrete cosine transform (DCT) is a transformation method similar to discrete Fourier transform (DFT), but it only uses the cosine function. By performing two-dimensional DCT on the second bit stream, the second bit stream is decomposed into multiple frequency components, which describe the frequency content of the second bit stream at different scales.

[0065] About two-dimensional discrete sine features (DSTF): Discrete sine transform (DST) is a variant of DCT that uses only sine functions. DSTF can characterize high-frequency information in the second bit stream, which can describe the local characteristics of the second bit stream.

[0066] About 2D Empirical Mode Principal Component Features (EMDF): Empirical Mode Decomposition (EMD) is an adaptive data-driven method for decomposing complex data sets into a series of Intrinsic Mode Functions (IMFs). In 2D EMD, the bitstream data is decomposed into multiple IMFs, each of which represents a local feature in the bitstream.

[0067] About 2D residual signal (RES): Residual signal refers to the part remaining after removing certain components from the original signal in signal processing. In the process of processing the second bit stream, the residual signal can be the remaining features of the second bit stream after removing the main features, or the partial features that cannot be fully described by the existing components during the decomposition process.

[0068] Figure 2 is a flowchart of an optional conventional feature extraction process according to an embodiment of the present application, such as Figure 2 As shown, the following steps are included:

[0069] First, the first bit stream data of the input After scaling, we get Two-dimensional bit stream input data (That is, the second bit stream mentioned above). Subsequently, the second bit stream is decomposed in the frequency domain to extract the two-dimensional discrete cosine feature, two-dimensional discrete sine feature, two-dimensional empirical mode principal component feature, and two-dimensional residual signal of the second bit stream.

[0070] Optionally, compute the 2D discrete cosine feature The process can be referred to formula (1) and formula (2):

[0071] (1)

[0072] In formula (1), since the two-dimensional DCT transform is to convert two-dimensional data from the spatial domain to the frequency domain, u and v are the two dimensions of the frequency domain coordinates, i and j are the row coordinates and column coordinates of the elements in the matrix, and N represents the number of rows and columns.

[0073] (2)

[0074] In formula (2), For the second bit stream The signal strength range is: , .

[0075] Optionally, compute the two-dimensional discrete sinusoidal feature The process can be referred to formula (3):

[0076] (3)

[0077] Optionally, calculate the two-dimensional empirical mode principal component features The process can be referred to formula (4):

[0078] (4)

[0079] in, , is the bit stream data Features The maximum value in the neighborhood of position 8. , is the bit stream data Features The minimum value of the neighborhood at position 8. m1 and m2 are aliases for the maximum value Max and the minimum value Min respectively.

[0080] Optionally, calculate the two-dimensional residual signal The process can refer to formula (5):

[0081] (5)

[0082] Optionally, construct a regular feature matrix The process can refer to formula (6):

[0083] (6)

[0084] It should be noted that the second bit stream is decomposed in the frequency domain to extract the two-dimensional discrete cosine features, two-dimensional discrete sine features, two-dimensional empirical mode principal component features, and two-dimensional residual signals of the second bit stream; the two-dimensional discrete cosine features, two-dimensional discrete sine features, two-dimensional empirical mode principal component features, and two-dimensional residual signals of the second bit stream are used as conventional features. This method can analyze the code from different angles, improve the comprehensiveness and accuracy of detection, and is particularly suitable for processing complex code structures and variable malicious code types.

[0085] In an optional embodiment, extracting a first type of feature (also called a significant feature or a significant feature) from the two-dimensional bit flow data includes:

[0086] A plurality of first-category features are extracted from the two-dimensional bit flow data, wherein the plurality of first-category features include at least two of a mixed Gaussian distribution graph, a local average value, and a local adaptive perceptual hash value corresponding to the two-dimensional bit flow data.

[0087] Optionally, the process of extracting the mixed Gaussian distribution graph corresponding to the two-dimensional bit flow data includes:

[0088] The two-dimensional bit stream data of the target code is scaled to obtain a second bit stream, wherein the scale transformation is used to determine a characteristic sampling rate for the second bit stream by changing the time dimension information of the second bit stream; a global average value corresponding to the second bit stream is determined according to each element in the second bit stream; and a mixed Gaussian distribution map corresponding to the second bit stream is calculated, wherein the mixed Gaussian distribution map is used to characterize characteristic values ​​of the mixed Gaussian distribution of all elements in the second bit stream.

[0089] The process of extracting the local average value corresponding to the two-dimensional bit stream data includes: filtering the noise data in the mixed Gaussian distribution map to obtain the target mixed Gaussian distribution map, wherein the noise data is the data greater than or equal to the noise threshold in the mixed Gaussian distribution map; calculating the average value of all the data in the target mixed Gaussian distribution map to obtain the local average value corresponding to the second bit stream.

[0090] The process of extracting a local adaptive perceptual hash value corresponding to two-dimensional bit stream data includes: determining a local adaptive perceptual hash value corresponding to a second bit stream according to a global average value and a local average value corresponding to the second bit stream, wherein the local adaptive perceptual hash value is a hash value determined according to a size relationship between the global average value and the local average value.

[0091] Optionally, the preprocessed data is a directly obtained conventional feature, which has a weak characterization capability for malicious code. The purpose of constructing significant features is to extract features that are more capable of characterizing malicious code from the preprocessed conventional features. Since directly collected features are usually not significant, modeling is required to obtain significant features.

[0092] Optionally, the preprocessed two-dimensional bit stream data can be (i.e., the first bit stream) is input into the salient feature extraction module, and then the first bit stream data After scaling, we get Two-dimensional bit stream input data (i.e., the second bit stream mentioned above), a mixed Gaussian distribution map is calculated based on the second bit stream , local mean , Local Adaptive Perceptual Hash Value Equal dominant features, construct and output the significant feature matrix It can be understood that the second bit stream is also bit stream data in a two-dimensional form.

[0093] Optionally, Figure 3 is a flowchart of an optional significant feature extraction process according to an embodiment of the present application, such as Figure 3 As shown, the following steps are included:

[0094] First, the first bit stream After scaling, we get The second bitstream . Then calculate the second bit stream The global tiebreaker value , the calculation formula is as follows:

[0095] (7)

[0096] in, For the second bit stream In the middle The element value of the position, it should be noted that the second bit stream The mathematical expression of The matrix of .

[0097] Then, calculate the second bit stream The corresponding mixed Gaussian distribution map includes: converting the second bit stream into a target matrix, wherein the number of rows and the number of columns of the target matrix are both preset values; calculating the target mean and target standard deviation corresponding to each position in the target matrix, wherein the target mean corresponding to each position represents the average value of all elements corresponding to the same acquisition time as the element at the position, and the target standard deviation corresponding to each position represents the standard deviation of all elements corresponding to the same acquisition time as the element at the position; determining the mean matrix corresponding to the target matrix according to the target mean corresponding to each position; determining the standard deviation matrix corresponding to the target matrix according to the target standard deviation corresponding to each position; determining the eigenvalues ​​of the mixed Gaussian distribution of the elements at each position in the target matrix according to the mean matrix and the standard deviation matrix; determining the mixed Gaussian distribution map according to the eigenvalues ​​of the mixed Gaussian distribution of the elements at each position in the target matrix.

[0098] Optionally, first, is the template size (corresponding to the above template value), get The value of the element in the range (This process corresponds to converting the second bit stream into the target matrix as described above), as shown in formula (8) and formula (9):

[0099] (8)

[0100] (9)

[0101] in, The second bit stream has been converted to the target matrix In the middle The element value at position, and are all positive integers, , .

[0102] Then, calculate the second bitstream that has been converted to the target matrix The target mean and target standard deviation corresponding to each position in the second bit stream are obtained. The mean matrix of and the standard deviation matrix .

[0103] It should be noted that the second bit stream is also a two-dimensional bit stream with a time dimension, so the elements at each position in the target matrix correspond to a collection time. For example, assuming that the rows of the target matrix represent the time dimension and the columns represent the one-dimensional data dimension in the binary bit stream, then in the target matrix, there may be multiple elements corresponding to the same collection time, so the target mean corresponding to each position represents the average value of all elements corresponding to the same collection time as the element at that position, and the target standard deviation corresponding to each position represents the standard deviation of all elements corresponding to the same collection time as the element at that position.

[0104] Finally, the second bitstream converted to the target matrix is ​​calculated The eigenvalue of the mixed Gaussian distribution at each position in the second bit stream is obtained Mixed Gaussian distribution of .

[0105] Furthermore, the mixed Gaussian distribution map can be eliminated Noise points in are used to calculate the local mean , the specific process can refer to formula (10):

[0106] (10)

[0107] in, is the noise threshold. For example, the noise threshold can be set to The 5% quantile value after the element values ​​are sorted in ascending order (it can be calibrated based on experience. For example, since the client's code behavior usually conforms to the normal distribution, it is assumed that the client's code behavior is the expected value. In this case, it is assumed that 95% of the data within the standard deviation range are normal data and 5% are abnormal data. The corresponding value is to obtain the value corresponding to the 5% of samples with lower values ​​as the threshold for distinguishing normal data from abnormal data, that is, the noise threshold).

[0108] Optionally, calculate the local adaptive aware hash value The process can be referred to formula (11):

[0109] (11)

[0110] From formula (11), we can see that if the local mean is greater than or equal to the global mean , then the local adaptive perceptual hash value is taken as 1, if the local mean is less than the global mean , then the local adaptive perceptual hash value is taken as 0.

[0111] Finally, construct a significant feature matrix for malicious code detection .

[0112] It should be noted that the extraction of significant features can more accurately locate the specific patterns of malicious code, improve the targeted detection, and play an important role in preventing new malicious code.

[0113] In an optional embodiment, at least one of a first detection operation and a second detection operation is performed according to a first feature matrix to obtain a code detection result, including: when performing the first detection operation, detecting whether the corresponding confidence of the target code when it belongs to each known malicious code is greater than a first threshold according to the first feature matrix and the second feature matrix, to obtain a confidence detection result of the target code, wherein the second feature matrix is ​​used to characterize the second type of features in a matrix form; when performing the second detection operation, determining a risk score of the target code according to the number of first type features that meet the significance condition in the first feature matrix, wherein the risk score is used to quantitatively characterize the probability that the target code belongs to a malicious code; determining whether the target code is a malicious code according to the confidence detection result of the target code and / or the risk score of the target code.

[0114] Optionally, in Example 1, if it is detected through the first detection operation that the confidence corresponding to the target code belonging to any one of the known malicious codes is greater than a first threshold, the target code is determined to be a malicious code; if it is detected that the confidence corresponding to the target code belonging to each known malicious code is less than or equal to the first threshold, the output is "it is not identified whether the target code belongs to the malicious code" or "the probability of the target code belonging to the malicious code is low".

[0115] Optionally, in Example 2, if the risk score of the target code detected by the second detection operation is greater than the first preset score, the target code is determined to be malicious code; if the risk score of the target code detected is less than or equal to the first preset score, the output is "it is not identified whether the target code is malicious code" or "the probability of the target code being malicious code is low".

[0116] Optionally, in Example 3, if the confidence level corresponding to the target code being any known malicious code detected by the first detection operation is greater than the first threshold, the target code is determined to be malicious code; if the confidence level corresponding to the target code being each known malicious code detected is less than or equal to the first threshold, the second detection operation is performed to obtain the detection result of the second detection operation, for example, whether the target code is malicious code can be determined based on the risk score of the target code (see Example 2). In this example, when the target code is determined to be malicious code based on the risk score of the target code, it can be determined that the target code is unknown malicious code.

[0117] Optionally, in Example 4, if the risk score of the target code detected by the second detection operation is greater than the first preset score, the target code is determined to be malicious code; if the risk score of the target code detected is less than or equal to the first preset score, then in combination with the detection result of the first detection operation, it is determined whether the target code is malicious code based on the confidence detection result of the target code (see Example 1).

[0118] Optionally, the first threshold mentioned above can be expressed as . After obtaining the salient feature matrix of the target code and the regular feature matrix Afterwards, the detection system can use the salient feature matrix and the regular feature matrix The code is input into the neural network model, and then the neural network model outputs the code detection result, wherein the code detection result at least includes the confidence corresponding to each known malicious code among the M known malicious codes and the significance detection result of the significant features.

[0119] In an optional embodiment, the risk score of the target code is determined according to the number of first-category features that meet the significance condition in the first feature matrix, including: for each first-category feature in the first feature matrix, obtaining the number of features of the first-category feature that meet the first significance condition and the number of features of the first-category feature that meet the second significance condition, performing statistical calculation on the number of features of the first-category feature that meet the first significance condition and the number of features of the first-category feature that meet the second significance condition to obtain a target feature value of the first-category feature; and determining the risk score of the target code according to the target feature value of each first-category feature in the first feature matrix and the feature threshold corresponding to each first-category feature.

[0120] Optionally, Figure 4 is a schematic diagram of an optional malicious code detection method according to an embodiment of the present application, such as Figure 4 As shown, the following steps can be performed for the code detection results output by the model:

[0121] Step 1: Delete the data with confidence lower than the threshold. The remaining prediction results are taken as a set .

[0122] For each known malicious code, the corresponding confidence level when the target code belongs to the known malicious code can be obtained. For example, the confidence level when the target code belongs to each known malicious code can be obtained by using steps S101-S102 in the above embodiment.

[0123] gather Includes at least one prediction result corresponding to a known target malicious code, where the confidence level corresponding to the target code belonging to the known target malicious code is not less than a threshold .

[0124] For example, the known malicious code types N are 100, and the corresponding confidence level when the target code is detected to belong to 10 known malicious codes is less than the threshold value. , then the prediction results that the target code belongs to each of the 10 known malicious codes are deleted, and it is preliminarily determined that the target code does not belong to these 10 known malicious codes. The remaining 90 known malicious codes are taken as target known malicious codes, and the prediction results that the target code belongs to each target known malicious code are taken as a set .

[0125] Step 2, from the collection Extract the prediction result of the target code belonging to each target known malicious code and the corresponding confidence .

[0126] Step 3: Determine the set Does it contain the conditions that meet the Subset of , if there is a subset , then for the subset Continue to detect malicious code and execute step 4, otherwise, execute step 1. The threshold Threshold can be determined according to the user usage habits of the client. The threshold is an empirical value and can be dynamically adjusted after actual deployment.

[0127] Step 4: Determine the subset Does it contain the conditions that meet the Subset of , if there is a subset , then it is determined that the target code belongs to the subset Malicious code in, if no subset exists , then execute step 5. Among them, the threshold The threshold can be determined based on the usage habits of the client users. The threshold is an empirical value and can be adjusted dynamically after actual deployment.

[0128] Step 5, making a significance judgment on the extracted significant features (corresponding to the above-mentioned for each first-category feature in the first feature matrix, obtaining the number of features of the first-category feature that meets the first significant feature condition and the number of features of the first-category feature that meets the second significant condition, performing statistical calculation on the number of features of the first-category feature that meets the first significant feature condition and the number of features of the first-category feature that meets the second significant condition, and obtaining the target feature value of the first-category feature).

[0129] For example, first refer to the significant feature matrix And formula (12) is used for calculation:

[0130] (12)

[0131] in, , It is used to count the number of significant features that meet the significance conditions in the mixed Gaussian distribution map, where: The calculation formula of refers to formula (13), The calculation formula of refers to formula (14). It should be noted that setting two different significance conditions for each significant feature can avoid the state jump caused by the repeated changes of the significant feature in the critical state, thereby further improving the detection accuracy of whether the target code is malicious code.

[0132] (13)

[0133] (14)

[0134] Then, calculate formula (15):

[0135] (15)

[0136] in, , Used to count the number of significant features that meet the significance conditions in the local mean.

[0137] in, The calculation formula of refers to formula (16); The calculation formula of refers to formula (17).

[0138] (16)

[0139] (17)

[0140] Then, calculate formula (18):

[0141] (18)

[0142] in, , Used to count the number of significant features that meet the significance conditions in the adaptive perceptual hash value.

[0143] in, The calculation formula of refers to formula (19); The calculation formula of refers to formula (20).

[0144] (19)

[0145] (20)

[0146] Finally, the risk score of the target code is calculated according to formula (21): :

[0147] (twenty one)

[0148] in, , , is the feature threshold corresponding to the three significant features of mixed Gaussian distribution map, local average value and local adaptive perceptual hash value. For example, , , The value can be preset to 0.5. This is the risk score of the target code mentioned above. Assuming the first preset score is 0, if , determine that the target code is malicious code, otherwise, output "whether the unknown target code is malicious code" or "the probability that the target code is malicious code is low".

[0149] It is understandable that, according to actual application needs, any one or two of the mixed Gaussian distribution map, the local average value and the local adaptive perceptual hash value can be used as significant features for significance judgment.

[0150] It should be noted that the purpose of significance detection is to determine whether the extracted significant features really have a good indication effect on malicious code. In the case of known malicious code, strong significance indicates that the malicious code and the features that the model can identify are similar, and the malicious code is a known malicious code; otherwise, the malicious code is an unknown new malicious code. This application determines the strength of significance by counting the number of data that meet the two-dimensional normal distribution near the expected value, calculating the proportion in all data, and then calculating the threshold for judgment.

[0151] In an optional embodiment, the present application also provides another method for detecting whether a code is malicious code based on a mixed Gaussian distribution graph, including: when it is detected that the number of elements in the mixed Gaussian distribution graph does not exceed a preset number, calculating the Gaussian distribution matrix corresponding to the mixed Gaussian distribution graph, and then calculating the mean matrix corresponding to the Gaussian distribution matrix. According to the maximum value, minimum value and each element value in the mean matrix corresponding to the Gaussian distribution matrix, determine the user feature score corresponding to the target code, wherein the user feature score is negatively correlated with the probability of a change in the code compilation behavior implemented by the user who compiles the target code. Finally, when the user feature score is less than or equal to the score threshold, it is determined that the target code is not malicious code.

[0152] In actual use, malicious code attacks and changes in user habits may lead to anomalies in the collected data. Moreover, the initial period of time when the client is attacked and the user habits change has the characteristics of data mutation and certain regularity. In this case, it is difficult to accurately distinguish malicious code and changes in user habits. At the same time, malicious code may also be malicious code with known features or new malicious code with unknown features, which further increases the difficulty of malicious code detection. The confidence of the malicious code detection model is a good indicator for judging the effectiveness of the detection results. The confidence can be used to distinguish the known malicious code. If the confidence is very low and the significance of the signal feature is very weak, this situation is more likely to be a change in user habits. In other cases, unknown malicious code appears. Therefore, statistical analysis and processing can be performed to further judge the results of the malicious code detection model.

[0153] in, Figure 5 is a flow chart of detecting whether a code is malicious code according to a mixed Gaussian distribution graph according to an embodiment of the present application, such as Figure 5 As shown, first, collect continuous client two-dimensional bit stream data , and based on Constructing a Gaussian mixture distribution map This process has been introduced in the related content of the aforementioned embodiment and will not be repeated here.

[0154] Then, determine the mixed Gaussian distribution map Whether the number of elements in exceeds the preset number , if it exceeds, then calculate the mixed Gaussian distribution map The Gaussian distribution matrix , and then calculate the Gaussian distribution matrix The corresponding mean matrix .

[0155] Based on the mean matrix To determine whether it is a significant feature caused by a change in user habits, refer to formula (22):

[0156] (twenty two)

[0157] in, for middle The element value at position, This is the user feature score corresponding to the target code. , then the output is "whether the unknown target code is malicious code" or "the probability that the target code is malicious code is low", otherwise it is determined that the significant features appear due to the change in user habits, and the target code is determined not to be malicious code. Among them, Characterize the scoring threshold.

[0158] It should be noted that the calculation of user feature scores can identify changes in user behavior, which is of great significance for preventing internal attacks and misoperations, and is suitable for internal code auditing and security monitoring within the enterprise.

[0159] In an optional embodiment, determining the confidence level corresponding to the target code when it belongs to each of the multiple known malicious codes includes: performing feature fusion calculation on the first feature matrix and the second feature matrix through a neural network model, and determining the confidence level corresponding to the target code when it belongs to each of the known malicious codes based on the target feature matrix obtained after the fusion calculation. The second feature matrix represents the second feature in the form of a matrix.

[0160] Among them, the neural network model includes a first model branch, a second model branch and an attention network layer, the first model branch is used to calculate the first feature matrix; the second model branch is used to calculate the second feature matrix, and the attention network layer is used to assign corresponding weights to the first feature matrix and the second feature matrix, wherein the first model branch and the second model branch are two independent neural network branches.

[0161] Optionally, Figure 6 is a schematic diagram of the use process of a neural network model according to an embodiment of the present application, such as Figure 6 As shown, the neural network model includes a first model branch and a second model branch, for example Figure 6 In the two RBM models, the significant features (i.e., the first feature matrix) and the conventional features (i.e., the second feature matrix) are input into different model branches for processing.

[0162] In addition, the neural network model also includes a self-attention network layer, which is used to assign corresponding weights to significant features and common features. The neural network model can perform feature fusion according to the weights corresponding to the significant features and common features, and input the feature fusion results into the CNN decoder. The CNN decoder can predict the corresponding confidence level of the target code when it belongs to each known malicious code based on the feature fusion results.

[0163] Optionally, compared with the traditional malicious code detection model based on artificial rules, the malicious code detection model based on deep learning (i.e., the above-mentioned neural network model) can avoid the subjectivity of the artificially set rules, and the code detection model based on deep learning also has a strong learning ability. Therefore, this application adopts a method based on deep learning to train the malicious code detection model. Among them, the method based on deep learning mainly includes the steps of data set construction, deep learning model construction, loss function construction used for training, model training, model weight optimization, model deployment, etc.

[0164] Optionally, Figure 7 is an optional training flow chart of a deep learning-based code detection model according to an embodiment of the present application, such as Figure 7 As shown, first, after the known malicious code attacks the client, the corresponding data is obtained from the server, and then the significant features and conventional features corresponding to the known malicious code are extracted based on the obtained data, and the labels are set according to the specific types of malicious code to construct a data set. Then, a deep learning model is built; a loss function is constructed. Subsequently, the constructed deep learning model is trained using the constructed loss function to determine whether the model has reached the optimal state. If the model has reached the optimal state, the training of the model is stopped to obtain a trained neural network model.

[0165] In an optional embodiment, Figure 8 is a workflow framework diagram of a malicious code detection system according to an embodiment of the present application, such as Figure 8 As shown, software interaction is performed between a server and multiple clients, wherein the target code can be run on each client, and the significant features and conventional features of the target code can be obtained through the data retained on the server during the running of the target code. The significant features and conventional features of the target code can be screened by using a pre-trained deep learning model, and then it is determined whether the target code is malicious code. If the target code is determined to be malicious code, the determination result is output; if the target code is determined not to be malicious code, data such as the significant features and conventional features of the target code are continuously collected, and malicious code determination is continuously performed, so that after the target code is attacked and becomes malicious code, timely detection and warning can be performed.

[0166] According to another aspect of the present application, a code detection device is also provided, wherein: Fig. 9 is a schematic diagram of an optional code detection device according to an embodiment of the present application, such as Fig. 9 As shown, the code detection device includes: a first processing unit 901, a second processing unit 902 and a third processing unit 903.

[0167] Optionally, the first processing unit 901 is used to process the one-dimensional bit flow data of the target code into two-dimensional bit flow data according to the flow collection time; the second processing unit 902 is used to extract the first type of features from the two-dimensional bit flow data and form a first feature matrix, wherein the first feature matrix is ​​used to represent the first type of features, and the first type of features are more significant in distinguishing whether the target code is a malicious code than the second type of features different from the first type of features; the third processing unit 903 is used to perform at least one of the first detection operation and the second detection operation according to the first feature matrix to obtain a code detection result; wherein the first detection operation is used to determine the confidence corresponding to the target code when it belongs to each known malicious code among multiple known malicious codes at least according to the first feature matrix; the second detection operation is used to detect whether the target code is a malicious code according to the first type of features that meet the significance condition in the first feature matrix.

[0168] Optionally, the first processing unit 901 includes: an acquisition subunit and a preprocessing subunit, wherein the acquisition subunit is used to acquire a binary bit stream of the target code; the preprocessing subunit is used to preprocess the binary bit stream to obtain a first bit stream in a two-dimensional form, wherein the preprocessing includes: after filtering abnormal data in the binary bit stream, converting the one-dimensional binary bit stream into a two-dimensional bit stream according to the acquisition time information corresponding to each one-dimensional data in the binary bit stream.

[0169] Optionally, the second processing unit 902 includes: a first processing subunit, configured to extract a plurality of first-category features from the two-dimensional bit flow data, wherein the plurality of first-category features include at least two of a mixed Gaussian distribution map, a local average value, and a local adaptive perceptual hash value corresponding to the two-dimensional bit flow data;

[0170] Among them, the first processing sub-unit includes: a mixed Gaussian distribution map determination module, which is used to scale the two-dimensional bit flow data of the target code to obtain a second bit stream, wherein the scale transformation is used to determine the characteristic sampling rate for the second bit stream by changing the time dimension information of the second bit stream; determine the global average value corresponding to the second bit stream according to each element in the second bit stream; calculate the mixed Gaussian distribution map corresponding to the second bit stream, wherein the mixed Gaussian distribution map is used to characterize the characteristic values ​​of the mixed Gaussian distribution of all elements in the second bit stream.

[0171] The first processing sub-unit also includes: a local average value determination module, which is used to filter the noise data in the mixed Gaussian distribution map to obtain a target mixed Gaussian distribution map, wherein the noise data is data greater than or equal to the noise threshold in the mixed Gaussian distribution map; calculate the average value of all data in the target mixed Gaussian distribution map to obtain a local average value corresponding to the second bit stream.

[0172] The first processing sub-unit also includes: a local adaptive perceptual hash value determination module, which is used to determine the local adaptive perceptual hash value corresponding to the second bit stream according to the global average value and the local average value corresponding to the second bit stream, wherein the local adaptive perceptual hash value is a hash value determined according to the size relationship between the global average value and the local average value.

[0173] Optionally, a mixed Gaussian distribution map determination module includes: a first processing submodule, used to convert the second bit stream into a target matrix, wherein the number of rows and the number of columns of the target matrix are both preset values; a second processing submodule, used to calculate the target mean and target standard deviation corresponding to each position in the target matrix, wherein the target mean corresponding to each position represents the average value of all elements corresponding to the same acquisition time as the element at the position, and the target standard deviation corresponding to each position represents the standard deviation of all elements corresponding to the same acquisition time as the element at the position; a third processing submodule, used to determine the mean matrix corresponding to the target matrix according to the target mean corresponding to each position; determine the standard deviation matrix corresponding to the target matrix according to the target standard deviation corresponding to each position; a fourth processing submodule, used to determine the eigenvalues ​​of the mixed Gaussian distribution of the elements at each position in the target matrix according to the mean matrix and the standard deviation matrix; a fifth processing submodule, used to determine the mixed Gaussian distribution map according to the eigenvalues ​​of the mixed Gaussian distribution of the elements at each position in the target matrix.

[0174] Optionally, the code detection device also includes a second-type feature determination unit, which is used to scale the two-dimensional bit flow data to obtain a second bit stream, wherein the scale transformation is used to determine the feature sampling rate by changing the time dimension information of the two-dimensional bit flow data; decompose the second bit stream in the frequency domain, and extract at least one of the following features of the second bit stream as the second-type feature: two-dimensional discrete cosine feature, two-dimensional discrete sine feature, two-dimensional empirical mode principal component feature, two-dimensional residual signal.

[0175] Optionally, the third processing unit 903 includes: a second processing sub-unit, which is used to detect whether the corresponding confidence of the target code when it belongs to each known malicious code is greater than a first threshold when performing the first detection operation according to the first feature matrix and the second feature matrix, so as to obtain a confidence detection result of the target code, wherein the second feature matrix is ​​used to represent the second type of features in matrix form; a third processing sub-unit, which is used to determine the risk score of the target code according to the number of first type features that meet the significance condition in the first feature matrix when performing the second detection operation, and a fourth processing sub-unit, wherein the risk score is used to quantitatively represent the probability that the target code belongs to the malicious code; and a fifth processing sub-unit, which is used to determine whether the target code is malicious code according to the confidence detection result of the target code and / or the risk score of the target code.

[0176] Optionally, the fourth processing sub-unit includes: a first processing module, used to obtain, for each first-category feature in the first feature matrix, the number of features of the first-category feature that meets the first significant feature condition and the number of features of the first-category feature that meets the second significant condition, and perform statistical calculations on the number of features of the first-category feature that meets the first significant feature condition and the number of features of the first-category feature that meets the second significant condition to obtain a target feature value of the first-category feature; and a second processing module, used to determine the risk score of the target code based on the target feature value of each first-category feature in the first feature matrix and the feature threshold corresponding to each first-category feature.

[0177] Optionally, the code detection device also includes: a first calculation unit, used to calculate the Gaussian distribution matrix corresponding to the mixed Gaussian distribution map when it is detected that the number of elements in the mixed Gaussian distribution map does not exceed a preset number; a second calculation unit, used to calculate the mean matrix corresponding to the Gaussian distribution matrix; a first determination unit, used to determine the user feature score corresponding to the target code based on the maximum value, minimum value and each element value in the mean matrix corresponding to the Gaussian distribution matrix, wherein the user feature score is negatively correlated with the probability of a change in the code compilation behavior implemented by the user who compiles the target code; and a second determination unit, used to determine that the target code is not malicious code when the user feature score is less than or equal to a score threshold.

[0178] Optionally, the third processing unit 903 includes: a first computing subunit and a second computing subunit. The first computing subunit is used to perform feature fusion calculation on the first feature matrix and the second feature matrix through a neural network model, and determine the confidence corresponding to the target code when it belongs to each known malicious code based on the target feature matrix obtained after the fusion calculation, wherein the second feature matrix represents the second feature in the form of a matrix; the second computing subunit is used to wherein the neural network model includes a first model branch, a second model branch and an attention network layer, the first model branch is used to calculate the first feature matrix; the second model branch is used to calculate the second feature matrix, and the attention network layer is used to assign corresponding weights to the first feature matrix and the second feature matrix, wherein the first model branch and the second model branch are two independent neural network branches.

[0179] Another aspect of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program runs, the device where the computer-readable storage medium is located executes the above-mentioned code detection method.

[0180] Another aspect of the present application provides an electronic device, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors execute the above-mentioned code detection method.

[0181] It should be noted that the code detection method, device, storage medium and electronic device provided by the present application, in the malicious code detection task, introduces a time dimension to the one-dimensional bit stream of the target code. In this way, the combination of the two dimensions can comprehensively consider the correlation between different data, which can significantly improve the accuracy of code detection. In addition, according to the extracted significant features (i.e., the first feature mentioned above), a first detection operation is performed to determine the confidence corresponding to the target code when it belongs to each known malicious code among multiple known malicious codes, or a second detection operation is performed to detect whether the target code belongs to malicious code by combining the significant features with the significant conditions. Since noise and redundant information can be effectively reduced by extracting significant features, it is possible to effectively identify whether the code is malicious code; and the extracted significant features are combined with the first detection operation and the second detection operation, so that code detection is performed in combination with multiple detection operations, which can greatly improve the accuracy and coverage of detection.

[0182] The above-mentioned embodiments or examples disclosed in the present application are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection disclosed in the present application. In the absence of contradiction, each step in a certain embodiment or example in the present application can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0183] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0184] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0185] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0186] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0187] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0188] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc., which can store program code.

[0189] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A code detection method, characterized in that: include: Processing the one-dimensional bit flow data of the target code into two-dimensional bit flow data according to the flow collection time; Extracting first-category features from the two-dimensional bit flow data and forming a first feature matrix, wherein the first-category feature matrix is ​​used to represent the first-category features, and the first-category features are more significant in distinguishing whether the target code is malicious code than the second-category features that are different from the first-category features; At least one of a first detection operation and a second detection operation is performed according to the first feature matrix to obtain a code detection result; wherein the first detection operation is used to determine the confidence corresponding to the target code when it belongs to each of multiple known malicious codes according to at least the first feature matrix; the second detection operation is used to detect whether the target code belongs to malicious code according to the first type of features that meet the significance condition in the first feature matrix; Among them, the one-dimensional bit flow data of the target code is processed into two-dimensional bit flow data according to the flow collection time, including: collecting the binary bit stream of the target code; preprocessing the binary bit stream to obtain a first bit stream in a two-dimensional form, wherein the preprocessing includes: after filtering the abnormal data in the binary bit stream, according to the collection time information corresponding to each one-dimensional data in the binary bit stream, converting the one-dimensional binary bit stream into a two-dimensional bit stream.

2. The code detection method according to claim 1, characterized in that: Extracting a first type of feature from the two-dimensional bit flow data includes: Extracting a plurality of first-category features from the two-dimensional bit flow data, wherein the plurality of first-category features include at least two of a mixed Gaussian distribution graph, a local average value, and a local adaptive perceptual hash value corresponding to the two-dimensional bit flow data; The process of extracting the mixed Gaussian distribution map corresponding to the two-dimensional bit flow data includes: Performing a scale transformation on the two-dimensional bit stream data of the target code to obtain a second bit stream, wherein the scale transformation is used to determine a characteristic sampling rate for the second bit stream by changing time dimension information of the second bit stream; Determine a global average value corresponding to the second bit stream according to each element in the second bit stream; Calculating a mixed Gaussian distribution map corresponding to the second bit stream, wherein the mixed Gaussian distribution map is used to characterize characteristic values ​​of the mixed Gaussian distribution of all elements in the second bit stream; The process of extracting the local average value corresponding to the two-dimensional bit flow data includes: Filtering the noise data in the mixed Gaussian distribution map to obtain a target mixed Gaussian distribution map, wherein the noise data is data in the mixed Gaussian distribution map that is greater than or equal to a noise threshold; Calculate the average value of all data in the target mixed Gaussian distribution map to obtain a local average value corresponding to the second bit stream; The process of extracting the local adaptive perceptual hash value corresponding to the two-dimensional bit flow data includes: A local adaptive perceptual hash value corresponding to the second bit stream is determined according to a global average value and the local average value corresponding to the second bit stream, wherein the local adaptive perceptual hash value is a hash value determined according to a magnitude relationship between the global average value and the local average value.

3. The code detection method according to claim 2, characterized in that: Calculating a mixed Gaussian distribution graph corresponding to the second bit stream includes: Converting the second bit stream into a target matrix, wherein the number of rows and the number of columns of the target matrix are both preset values; Calculate the target mean and target standard deviation corresponding to each position in the target matrix, wherein the target mean corresponding to each position represents the average value of all elements corresponding to the same acquisition time as the element at the position, and the target standard deviation corresponding to each position represents the standard deviation of all elements corresponding to the same acquisition time as the element at the position; Determine the mean matrix corresponding to the target matrix according to the target mean corresponding to each position; determine the standard deviation matrix corresponding to the target matrix according to the target standard deviation corresponding to each position; Determine, according to the mean matrix and the standard deviation matrix, the eigenvalue of the mixed Gaussian distribution of the element at each position in the target matrix; The mixed Gaussian distribution map is determined according to the eigenvalues ​​of the mixed Gaussian distribution of the elements at each position in the target matrix.

4. The code detection method according to claim 1, characterized in that: The process of determining the second type of features includes the following steps: Performing a scale transformation on the two-dimensional bit flow data to obtain a second bit stream, wherein the scale transformation is used to determine a characteristic sampling rate by changing time dimension information of the two-dimensional bit flow data; Decomposing the second bit stream in the frequency domain, and extracting at least one of the following features of the second bit stream as the second type of features: Two-dimensional discrete cosine features, two-dimensional discrete sine features, two-dimensional empirical mode principal component features, and two-dimensional residual signals.

5. The code detection method according to any one of claims 1 to 4, characterized in that: Performing at least one of a first detection operation and a second detection operation according to the first feature matrix to obtain a code detection result includes: When performing the first detection operation, detecting whether the confidence corresponding to the target code when it belongs to each known malicious code is greater than a first threshold according to the first feature matrix and the second feature matrix, and obtaining a confidence detection result of the target code, wherein the second feature matrix is ​​used to characterize the second type of features in a matrix form; When performing the second detection operation, determining a risk score of the target code according to the number of first-category features that meet the significance condition in the first feature matrix, wherein the risk score is used to quantitatively characterize the probability that the target code is malicious code; Determine whether the target code is malicious code based on the confidence detection result of the target code and / or the risk score of the target code.

6. The code detection method according to claim 5, characterized in that: Determining the risk score of the target code according to the number of first-category features that meet the significance condition in the first feature matrix includes: For each first-category feature in the first feature matrix, obtaining the number of features of the first-category feature that meets the first significant feature condition and the number of features of the first-category feature that meets the second significant feature condition, performing statistical calculation on the number of features of the first-category feature that meets the first significant feature condition and the number of features of the first-category feature that meets the second significant condition, and obtaining a target feature value of the first-category feature; The risk score of the target code is determined according to the target feature value of each first-category feature in the first feature matrix and the feature threshold corresponding to each first-category feature.

7. The code detection method according to claim 2, characterized in that: The code detection method further includes: When it is detected that the number of elements in the mixed Gaussian distribution map does not exceed a preset number, calculating a Gaussian distribution matrix corresponding to the mixed Gaussian distribution map; Calculate the mean matrix corresponding to the Gaussian distribution matrix; Determine a user feature score corresponding to the target code according to the maximum value, the minimum value, and each element value in the mean matrix corresponding to the Gaussian distribution matrix, wherein the user feature score is negatively correlated with the probability of a change in the code compilation behavior implemented by the user who compiles the target code; When the user feature score is less than or equal to the score threshold, it is determined that the target code does not belong to the malicious code.

8. The code detection method according to claim 1, characterized in that: Determining the confidence level corresponding to the target code when it belongs to each of the multiple known malicious codes includes: Performing feature fusion calculation on the first feature matrix and the second feature matrix through a neural network model, and determining the confidence corresponding to the target code when it belongs to each known malicious code based on the target feature matrix obtained after the fusion calculation, wherein the second feature matrix represents the second feature in the form of a matrix; The neural network model includes a first model branch, a second model branch and an attention network layer, the first model branch is used to calculate the first feature matrix; the second model branch is used to calculate the second feature matrix, and the attention network layer is used to assign corresponding weights to the first feature matrix and the second feature matrix, wherein the first model branch and the second model branch are two independent neural network branches.

9. A code detection device, characterized in that: include: A first processing unit, configured to process the one-dimensional bit flow data of the target code into two-dimensional bit flow data according to the flow collection time; a second processing unit, configured to extract first-category features from the two-dimensional bit flow data and form a first feature matrix, wherein the first-category feature matrix is ​​used to represent the first-category features, and the first-category features are more significant in distinguishing whether the target code is malicious code than the second-category features that are different from the first-category features; a third processing unit, configured to perform at least one of a first detection operation and a second detection operation according to the first feature matrix to obtain a code detection result; wherein the first detection operation is configured to determine, at least according to the first feature matrix, a confidence level corresponding to when the target code belongs to each of multiple known malicious codes; and the second detection operation is configured to detect whether the target code belongs to malicious code according to a first type of feature that meets a significance condition in the first feature matrix; The first processing unit includes: an acquisition subunit, which is used to acquire the binary bit stream of the target code; a preprocessing subunit, which is used to preprocess the binary bit stream to obtain a first bit stream in a two-dimensional form, wherein the preprocessing includes: after filtering abnormal data in the binary bit stream, according to the acquisition time information corresponding to each one-dimensional data in the binary bit stream, converting the one-dimensional binary bit stream into a two-dimensional bit stream.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes the code detection method according to any one of claims 1 to 8.

11. An electronic device, characterized in that: It comprises one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the code detection method described in any one of claims 1 to 8.

Images