Historical data deep learning-based attack behavior feature extraction method

Abstract

The invention provides an attack behavior feature extraction method based on historical data deep learning. The method comprises feature extraction based on static analysis, feature extraction based on traceable dynamic analysis, attack feature extraction based on a deep belief network and a clustering algorithm oriented to malicious code homologous judgment. By applying the technical scheme, the accuracy of the attack features can be improved, and finally, the output attack features are subjected to clustering analysis to determine the attack type.

Description

Technical Field

[0001] The present invention relates to the field of attack behavior technology, and in particular to an attack behavior feature extraction method based on deep learning of historical data. Background Art

[0002] A feature is a description of an attack behavior. A feature must be able to accurately describe the characteristics of a certain attack behavior. For each network attack, its corresponding malicious data packet should be analyzed to extract the attack features. A feature should be a unique characteristic of a data packet or a sequence of data packets. Ideally, malicious attack behaviors should always be discovered through features, and normal network traffic should not be affected. The unknown attack file analyzed by the cloud sandbox is used as the input of feature extraction. Static and dynamic features of the file are extracted using static analysis and dynamic analysis respectively. The extracted static features and dynamic attack features are then used as the input of the deep neural network. How to further improve the accuracy of the attack features, cluster the output attack features, and determine the attack type is a technical problem that needs to be solved urgently. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide an attack behavior feature extraction method based on deep learning of historical data, improve the accuracy of attack features, and finally perform cluster analysis on the output attack features to determine the attack type.

[0004] To achieve the above objectives, the present invention adopts the following technical solutions: a method for extracting attack behavior features based on deep learning of historical data, including feature extraction based on static analysis, feature extraction based on traceable dynamic analysis, attack feature extraction based on deep belief networks, and a clustering algorithm for malicious code homology judgment.

[0005] In a preferred embodiment, the feature extraction based on static analysis is based on the attack data flow extraction technology based on the control flow graph; the control flow graph CFG of a function is represented by G=(N, E, entry, exit), where N is a node set representing program statements, and E is a set of directed edges representing the control flow relationship between nodes; the edge set

[0006] In the preprocessing stage, the main processing is the C / C++ files executed by the attack behavior against the power information network environment, including macro replacement compilation, etc. The processed files, i.e., the intermediate files, are the input of the lexical analysis;

[0007] Perform lexical analysis and syntax analysis on the intermediate file, convert it into an abstract syntax tree AST, and then further traverse the obtained AST tree to collect relevant information to form an intermediate representation of the source code to be tested;

[0008] Call data flow analysis and pointer analysis to obtain the calling relationship between methods, control dependency and data dependency between statements, and form a system dependency graph of the source code to be tested.

[0009] In a preferred embodiment, feature extraction based on backtraceable dynamic analysis utilizes dynamic analysis technology to record the complete instruction-level execution process of the vulnerable program, and constructs a backtrace analysis algorithm to extract the code execution sequence directly related to the attack behavior; on this basis, a feature execution context environment is constructed, and branch conditions are judged to generate attack features.

[0010] In a preferred embodiment, the dynamic analysis extraction framework is divided into three modules: traceable dynamic analysis, attack detection and attack signature generation;

[0011] 1) Backtracking analysis algorithm for feature extraction

[0012] Since the taint propagation flow graph TPG records the hierarchical relationship between nodes, the TPG can be traversed in a directed manner starting from any node, and the obtained TPG subgraph corresponds to the operation sequence of the relevant tainted data and the constraints that affect the operation;

[0013] Get the backtracking analysis results starting from the node, and perform recursive backtracking analysis on each parent node in the TPG graph;

[0014] When the backtracking analysis of all the parent nodes of a node is completed or the node has no parent node, it is added to the backtracking analysis record list;

[0015] Finally, when the backtrace analysis of the node returns, the backtrace analysis record linked list obtains a complete record of all relevant vulnerable process execution instructions from the taint source to Na;

[0016] 2) Attack Detection

[0017] According to the taint analysis strategy, when a vulnerable program executes instructions that may trigger vulnerability exploitation, dynamic analysis monitors abnormal use of tainted data, thereby detecting attacks against unknown vulnerabilities. When an attack on a vulnerability is detected, a backtracking analysis algorithm is used to backtrack from the taint propagation flow graph to extract the tainted data operation sequence directly related to the vulnerability attack and the constraints that affect the attack path.

[0018] 3) Attack signature generation

[0019] Dynamic taint analysis detects unknown attacks and obtains the tainted data operation instruction sequence directly related to the attack by backtracing the taint propagation flow graph. This operation instruction sequence is the attack feature; then, the tainted data related operation instructions are processed according to the following rules.

[0020] In a preferred embodiment, attack feature extraction based on deep belief network first extracts unknown (suspicious) attack behavior vectors under set feature conditions, and then takes the features extracted by static analysis and dynamic analysis, as well as the malicious code binary code and the disassembled assembly code as the total input, and submits them to the deep learning algorithm to obtain features for malicious code judgment; then, by comparing the output of the RBM neural network with the historical attack behavior, a verification report is obtained and fed back to the data element analysis for feature re-extraction; through repeated verification and feedback, until the output judgment is consistent with the historical label, the extracted features are summarized into the feature database.

[0021] In a preferred embodiment, the attack objective function optimization problem proposed in the previous summary is transformed into an iterative nonlinear programming problem using the Lagrange multiplier method based on the sequential quadratic programming algorithm, which can greatly reduce the complexity of solving the attack vector solution problem; according to the attack objective function and constraint conditions in the previous summary, it can be expressed as the Lagrange multiplier expression as follows:

[0022] L(a,λ1,λ2,λ3)=U(a)+λ1Th1(a)+λ2Th2(a)+λ3Tg(a)

[0023] Among them, h1(a), h2(a), and g(a) correspond to the three constraints of the objective function in the previous section, which can be specifically expressed as h2(a)=N(a+L), g(a)=aTMa; then, through the partial derivative functions of each parameter, the original objective function minimum problem is transformed into a derivative problem, that is, The specific values ​​of the relevant parameters when the function takes the minimum value; at this time, the objective function satisfies:

[0024]

[0025] Among them, λ k They are the specific values ​​of the three parameters λ1, λ2, and λ3 in the Lagrangian objective function obtained in the kth iteration of the iterative algorithm.

[0026] In a preferred embodiment, the clustering algorithm for malicious code homology judgment specifically includes:

[0027] 1) Sample collection

[0028] Using the same source code, we disassemble the binary files compiled for different platforms to get different assemblers, extract the instruction set, registers, addressing mode, and control flow graph within the function, as the sample data set:

[0029] X={xi|i=1,2,...,n},Cj(j=1,2,...,k)

[0030] Among them, X represents a data vector under a program. The features of the function call graph are extracted. The number of times the function is called by other functions, the number of times the function calls other functions, and the number of times call2, as well as the number of times call* and call2* after deduplication are extracted as data set parameters to obtain the sample matrix:

[0031] x = [call call2 call*call2*]

[0032] For different platforms Get each feature

[0033] Quantities, such as the number of times this function is called by other functions:

[0034] call={call(1),call(2),…,call(n)}

[0035] 2) Selection of initial clustering centers of samples

[0036] From each feature vector, randomly select a value as the cluster center. For example, for the function call graph, randomly select a sample of 4 vectors as the initial cluster center: (c1, c2, c3, c4);

[0037] At the same time, each sample in the sample data set {xi} is assigned to k cluster centers ci according to the principle of the closest distance;

[0038] 3) Cluster center update:

[0039] Calculate the new cluster center ci', that is, update the cluster center using the following formula:

[0040]

[0041] 4) Feature judgment (algorithm collection

[0042] Convergence) judges if the following conditions are met:

[0043] ci≠ci(i=1,2,…,k)

[0044] Then go back to step 3) and continue to update the cluster center; otherwise, the algorithm converges, proving that the eigenvalues ​​have similar rows for samples on different platforms, and jump to step 5);

[0045] 5) Termination algorithm

[0046] In order to prevent an infinite loop due to excessive discreteness of the sample points in the previous step, a maximum number of iterations d is set; when the number of iterations of step 4) exceeds d, it is considered that the feature vector has little similarity on different platforms and the platform has too much influence on the feature, and the extraction of the vector is abandoned.

[0047] Compared with the prior art, the present invention has the following beneficial effects: improving the accuracy of attack features, and finally performing cluster analysis on the output attack features to determine the attack type. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of a feature extraction technology route for a preferred embodiment of the present invention;

[0049] Figure 2 A schematic diagram of the execution process of a data flow analysis technology based on a control flow graph according to a preferred embodiment of the present invention;

[0050] Figure 3 A dynamic analysis extraction framework diagram for a preferred embodiment of the present invention;

[0051] Figure 4 A feature extraction model diagram of a preferred embodiment of the present invention;

[0052] Figure 5 This is an attack vector analysis diagram of a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0053] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0054] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0055] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0056] A method for extracting attack behavior features based on deep learning of historical data, reference Figure 1-5 , including improving the accuracy of attack features, and finally clustering the output attack features to determine the attack type.

[0057] The technology used in the static attack feature extraction part is the attack data flow extraction technology based on the control flow graph. The control flow graph CFG is a graphical representation of the execution flow of each function in the program. It is a directed graph. It represents the control structure information of the function and the possible execution path of the program statement. The control flow graph of a function

[0058] CFG is represented by G = (N, E, entry, exit), where N is a set of nodes, representing program statements, and E is a set of directed edges, representing the control flow relationship between nodes.

[0059] The program dependency graph (PDG) is a graphical representation of the dependencies between each operation in the program. It is an optimized intermediate representation of the program. PDG can be represented as a tuple (N, E). N is a set of nodes, and the statements in the program correspond to the nodes in the graph; the edge set E represents the dependencies between nodes, and each edge in E represents the control dependency or data dependency between nodes.

[0060] Down Figure 2 The execution process of feature extraction technology for data flow based on control flow graph is the static analysis part of the overall feature extraction framework.

[0061] In the preprocessing stage, the main processing is the C / C++ files executed by the attack behavior against the power information network environment, including macro replacement compilation, etc. The processed files, namely the intermediate files, are the input of lexical analysis.

[0062] Perform lexical analysis and syntax analysis on the intermediate file, convert it into an abstract syntax tree AST, and then further traverse the obtained AST tree to collect relevant information to form an intermediate representation of the source code to be tested.

[0063] Call data flow analysis and pointer analysis to obtain the calling relationship between methods, control dependency and data dependency between statements, and form a system dependency graph of the source code to be tested.

[0064] Among them, in order to obtain the definition information of variables in data flow analysis, it is necessary to calculate the arrival definition set of each statement, and the arrival definition set is the definition statement set that flows into each statement. Then check whether the data length matches the size of the matched memory space. If no match occurs or the match is unsuccessful, extract the characteristic function. For example: the length of the input string str is greater than the size of buf (24 bytes). At this time, executing the strcpy function and writing str to the memory buf will cause a buffer overflow and a match failure. This situation is more common in API functions, and its characteristic functions include: strcpy(), strcat(), gets(), sprintf(), scanf(), memcpy(), etc.

[0065] Pointer analysis is implemented through union-find. Union-find is a tree-like data structure that is often used to handle the merging and querying of sets that do not want to intersect. It mainly involves two basic operations:

[0066] Merge two disjoint sets (Union(x,y)): Define Father(n) to return the parent element of element n. If Father(n) is empty, it means that element n is a top-level element.

[0067] Determine whether two elements belong to the same set (Find_Set(x)): This can be converted to finding whether the oldest ancestors of two elements are the same.

[0068] Then traverse each statement and extract the address pointer information features. The specific operations are as follows:

[0069] If a function call statement is encountered, the process switches to the called method and extracts the function name features.

[0070] For example, when a method in a program calls or references a function, the return value is NULL, which causes the program to crash or exit. This attack behavior includes two categories: calling a null pointer and a null pointer reference caused by unchecked function return values. For unchecked functions, the characteristic function name of the function is extracted: free().

[0071] If the formal parameter of the method is a pointer type, the parameter characteristics are obtained by updating the formal parameter with the pointer information of the actual parameter. If the return value of the method is a pointer type, the return value characteristics are obtained by recording the pointer returned by the method. For example: when a program calls a pointer, if the calling pointer is a null pointer, then since there is no pointer in the program before calling

[0072] It is judged to be non-empty, causing the system to exit, for example: public void test() throwsThrowable{int[]data; data = null; IO.writeLine("" + data.length);}

[0073] At this time, when IO.writeLine calls data, since data has not been assigned a value (still NULL), a null pointer exception will be reported. In this case, the null pointer call method is used as an attack feature.

[0074] If an assignment statement is encountered, the pointing information of the right expression of the assignment statement is used to update the pointing information of the left expression of the assignment statement. The right expression of the assignment statement may be a function call expression, a pointer variable, an arithmetic expression of a pointer variable, an address expression, a structure member access expression, etc. The left expression of the assignment statement may be a pointer variable, a structure member access expression, etc. The possible function call features and structure member features on the right side of the expression are obtained through the assignment statement. Based on the second step, the analysis process will make comprehensive use of the various information collected by the static analysis in the third step, and send the analysis results to the reporter to obtain a series of attack features.

[0075] In the feature extraction based on backtraceable dynamic analysis, an attack feature generation method based on backtraceable dynamic analysis is used. Dynamic analysis technology is used to record the complete instruction-level execution process of the vulnerable program, and a backtrace analysis algorithm is constructed to extract the code execution sequence directly related to the attack behavior. On this basis, a feature execution context environment is constructed, and branch conditions are judged to generate attack features.

[0076] like Figure 3 As shown in the figure, the dynamic analysis and extraction framework is mainly divided into three modules: traceable dynamic analysis, attack detection and attack feature generation. The specific operations are as follows:

[0077] All input data of vulnerable programs are marked as tainted, and a traceable dynamic taint analysis framework is used to construct a taint propagation graph (TPG) of the instruction set for tainted data related operation behaviors, and the abnormal use of tainted data is monitored to detect unknown attack behaviors.

[0078] When an attack occurs, the backtracking analysis algorithm is used to extract the taint analysis data operation sequence and various constraints directly related to the vulnerability exploitation, restore the execution context, add judgments to the conditional branch statements, and finally generate attack features.

[0079] 1) Backtracking analysis algorithm for feature extraction

[0080] ① Since the taint propagation graph (TPG) records the hierarchical relationships between nodes, the TPG can be traversed in a directed manner starting from any node. The obtained TPG subgraph corresponds to the operation sequence of the relevant tainted data and the constraints affecting the operation.

[0081] ② Obtain the backtracking analysis results starting from the node, and perform recursive backtracking analysis on each parent node in the TPG graph.

[0082] ③ When the backtracking analysis of all parent nodes of a node is completed or the node has no parent node, add it to the backtracking analysis record list.

[0083] ④Finally, when the backtrace analysis of the node returns, the backtrace analysis record linked list obtains a complete record of all relevant vulnerable process execution instructions from the taint source to Na.

[0084] 2) Attack Detection

[0085] According to the taint analysis strategy, when the vulnerable program executes instructions that may trigger vulnerability exploits, such as JMP, CALL, and RET, dynamic analysis monitors the abnormal use of tainted data, so that attacks against unknown vulnerabilities can be detected. (The taint analysis strategy sets two commonly used abnormal use judgment rules: tainted data used as jump addresses and tainted data as execution code. Using these two abnormal use judgment rules, most vulnerability attack behaviors can be covered, and the false alarm rate is very low.) When an attack on a vulnerability is detected, a backtracking analysis algorithm is used to backtrack from the taint propagation flow graph to extract the tainted data operation sequence directly related to the vulnerability attack and the constraints that affect the attack path.

[0086] 3) Attack signature generation

[0087] Dynamic taint analysis detects unknown attacks and obtains the tainted data operation instruction sequence directly related to the attack by tracing back the taint propagation flow graph. This operation instruction sequence is the attack feature. Then, the tainted data related operation instructions are processed according to the following rules.

[0088] ① For operands that are tainted data and are of register type, no special processing is required because the value of the tainted data will be automatically obtained as the input data is processed.

[0089] ② For operands that are not tainted data and will not be contaminated by tainted data, its actual value needs to be used as an immediate value to replace its type in the data operation instruction sequence. Regardless of whether the operand is a register or a memory address, the dynamic taint analysis system can obtain its actual value when the attack occurs and record it in the corresponding node of TPG.

[0090] ③ For operands that are not tainted data but are contaminated by tainted operands through instruction execution, if the type is a register, no processing is required; if it is a memory address, it is replaced with a free address. If the original value of the operand will affect the operation result, its actual value needs to be extracted and substituted into the calculation of the contaminated instruction.

[0091] The tainted data operation instruction sequence obtained through the above operation is the extracted attack feature.

[0092] In the attack feature extraction based on the deep belief network, first, the unknown (suspicious) attack behavior vector under the set feature conditions is extracted, and then the features extracted by static analysis and dynamic analysis, as well as the malicious code binary code and the disassembled assembly code are submitted to the deep learning algorithm as the total input to obtain the features for malicious code judgment. Then, by comparing the output of the RBM neural network with the historical attack behavior, a verification report is obtained and fed back to the data element analysis for feature re-extraction. Through repeated verification and feedback, until the output judgment is consistent with the historical label, the extracted features are summarized in the feature database, such as Figure 4 .

[0093] In order to solve the minimum optimization problem of the attack objective function under constraints, this report solves the attack vector through the Lagrange multiplier method and nonlinear programming iterative algorithm, and then analyzes each attack element in the attack vector to extract the attack features that have necessary correlation with the attack behavior itself.

[0094] First, we use the Lagrange multiplier method based on the sequential quadratic programming algorithm to transform the attack objective function optimization problem proposed in the previous summary into an iterative nonlinear programming problem, which can greatly reduce the complexity of solving the attack vector problem. According to the attack objective function and constraints in the previous summary, it can be expressed as the Lagrange multiplier as follows: L(a,λ1,λ2,λ3)=U(a)+λ1Th1(a)+λ2Th2(a)+λ3Tg(a)

[0095] Among them, h1(a), h2(a), and g(a) correspond to the three constraints of the objective function in the previous section, which can be specifically expressed as h2(a)=N(a+L), g(a)=aTMa. Then, through the partial derivative functions of each parameter, the original objective function minimum problem is transformed into a derivative problem, that is, The specific values ​​of the relevant parameters when the function takes the minimum value. At this time, the objective function satisfies:

[0096]

[0097] Among them, λk is the specific value of the three parameters λ1, λ2, λ3 in the Lagrangian objective function obtained in the kth iteration of the iterative algorithm.

[0098] Iterative detection algorithm for nonlinear attacks:

[0099] 1) First, determine the initial parameter values ​​a0, λ0, and the initial state value of the matrix H0, and select the parameters n∈(0,0.5), τ∈(0,1) within the given range;

[0100] 2) Determine whether the constraint conditions are met. If so, proceed to the next step; otherwise, stop the algorithm calculation;

[0101] 3) Solve the dk value through the transformed planning sub-problem;

[0102] 4) Substitute the initial value of parameter αk = 1 into the formula ⑦(ak+αk dk)≤(1

[0103] +ηαkDdk)⑦(ak), determine whether it is satisfied, where ak is the adjustment function used to adjust the step size, which can be expressed as (ak) = U(ak) + r1h1(ak) + r2h2(ak) + max(0, r3h3(ak)), r is the weight of the proportion of each parameter in the adjustment function, and its value can be the set ) If it is satisfied, the parameter value is considered to be usable and the next step is executed. Otherwise, the parameter αk is updated. It should be noted that the αk update satisfies the formula αk=τkαk where τk∈(0,τ); 5) When the parameter αk satisfies the constraint condition, the iterative value ak+1=ak+αkdk of the attack vector ak is calculated. After calculating the attack vector, each element in the attack vector is analyzed to extract the correlation characteristics of each element with the attack behavior itself.

[0104] like Figure 5 As shown in the figure, by analyzing the attack data elements in the calculated attack vector, in the attack feature comparison stage, static and dynamic analysis are first used to extract a part of the currently known features, and then combined with the analysis based on the deep learning model, the captured data grouping time, message type and other data features are further analyzed according to the existing database.

[0105] In order to analyze the attack features more deeply, it is usually necessary to not only analyze a single feature, but also find out the feature correlation between them, so as to mine more features and provide more references for later extraction.

[0106] Clustering algorithms for malicious code homology judgment include:

[0107] 1) Sample collection

[0108] Using the same source code, we disassemble the binary files compiled for different platforms to get different assemblers, extract the instruction set, registers, addressing mode, and control flow graph within the function, as the sample data set:

[0109] X={xi|i=1,2,...,n},Cj(j=1,2,...,k)

[0110] Among them, X represents a data vector under a program. The features of the function call graph are extracted. The number of times the function is called by other functions, the number of times the function calls other functions, and the number of times call2, as well as the number of times call* and call2* after deduplication are extracted as data set parameters to obtain the sample matrix:

[0111] x = [call call2 call*call2*]

[0112] For different platforms You can get each special

[0113] Eigenvectors, such as the number of times this function is called by other functions:

[0114] call={call(1),call(2),…,call(n)}

[0115] 2) Selection of initial clustering centers of samples

[0116] From each feature vector, a value is randomly selected as the cluster center. For example, for the function call graph, a sample of 4 vectors is randomly selected as the initial cluster center: (c1, c2, c3, c4); at the same time, each sample in the sample data set {xi} is assigned to k cluster centers ci according to the principle of the nearest distance.

[0117] 3) Cluster center update:

[0118] Calculate the new cluster center ci', that is, update the cluster center using the following formula:

[0119]

[0120] 4) Feature judgment (algorithm collection

[0121] Convergence) judges if the following conditions are met:

[0122] ci≠ci(i=1,2,…,k)

[0123] Then go back to step 3) and continue to update the cluster center; otherwise, the algorithm converges, proving that the eigenvalues ​​have similar rows for samples on different platforms, and jump to step 5).

[0124] 5) Termination algorithm

[0125] In order to prevent the previous step from causing an infinite loop due to excessive sample point discreteness, a maximum number of iterations d is set. When the number of iterations in step 4) exceeds d, it is considered that the feature vector has little similarity on different platforms and the platform has too much influence on the feature, so the vector is abandoned.

[0126] Experimental test results:

[0127] According to the characteristics of current malicious attacks that are organized and customized to attack targets, the concept of malicious code homology is used to perform code homology analysis based on the attack behavior characteristics output by the deep trust neural network. By comprehensively considering the various characteristics of the malicious code, the homology relationship between the malicious codes can be effectively judged, the malicious code can be traced, and the attack behavior can be forensically collected and analyzed. The specific judgment data is shown in Table 1.

[0128] Table 1:

[0129]

Claims

1. A method for extracting attack behavior features based on deep learning of historical data, characterized in that: It includes feature extraction based on static analysis, feature extraction based on traceable dynamic analysis, attack feature extraction based on deep belief network, and clustering algorithm for malicious code homology judgment.

2. According to claim 1, a method for extracting attack behavior features based on deep learning of historical data is characterized in that: Feature extraction based on static analysis Attack data flow extraction technology based on control flow graph; The control flow graph CFG of a function is represented by G = (N, E, entry, exit), where N is a set of nodes, representing program statements, and E is a set of directed edges, representing the control flow relationship between nodes; the edge set In the preprocessing stage, the main processing is the C / C++ files executed by the attack behavior against the power information network environment, including macro replacement compilation, etc. The processed files, i.e., the intermediate files, are the input of the lexical analysis; Perform lexical analysis and syntax analysis on the intermediate file, convert it into an abstract syntax tree AST, and then further traverse the obtained AST tree to collect relevant information to form an intermediate representation of the source code to be tested; Call data flow analysis and pointer analysis to obtain the calling relationship between methods, control dependency and data dependency between statements, and form a system dependency graph of the source code to be tested.

3. According to claim 1, the method for extracting attack behavior features based on deep learning of historical data is characterized in that: Feature extraction based on backtraceable dynamic analysis uses dynamic analysis technology to record the complete instruction-level execution process of the vulnerable program, and builds a backtrace analysis algorithm to extract the code execution sequence directly related to the attack behavior; on this basis, it constructs a feature execution context environment and makes judgments on branch conditions to generate attack features.

4. The attack behavior feature extraction method based on historical data deep learning according to claim 3 is characterized in that: The dynamic analysis extraction framework is divided into three modules: traceable dynamic analysis, attack detection, and attack signature generation; 1) Backtracking analysis algorithm for feature extraction Since the taint propagation flow graph TPG records the hierarchical relationship between nodes, the TPG can be traversed in a directed manner starting from any node, and the obtained TPG subgraph corresponds to the operation sequence of the relevant tainted data and the constraints that affect the operation; Get the backtracking analysis results starting from the node, and perform recursive backtracking analysis on each parent node in the TPG graph; When the backtracking analysis of all the parent nodes of a node is completed or the node has no parent node, it is added to the backtracking analysis record list; Finally, when the backtrace analysis of the node returns, the backtrace analysis record linked list obtains a complete record of all relevant vulnerable process execution instructions from the taint source to Na; 2) Attack Detection According to the taint analysis strategy, when a vulnerable program executes instructions that may trigger vulnerability exploitation, dynamic analysis monitors abnormal use of tainted data, thereby detecting attacks against unknown vulnerabilities. When an attack on a vulnerability is detected, a backtracking analysis algorithm is used to backtrack from the taint propagation flow graph to extract the tainted data operation sequence directly related to the vulnerability attack and the constraints that affect the attack path. 3) Attack signature generation Dynamic taint analysis detects unknown attacks and obtains the tainted data operation instruction sequence directly related to the attack by backtracing the taint propagation flow graph. This operation instruction sequence is the attack feature; then, the tainted data related operation instructions are processed according to the following rules.

5. According to claim 1, the attack behavior feature extraction method based on historical data deep learning is characterized in that: Attack feature extraction based on deep belief network First, the unknown (suspicious) attack behavior vector under the set feature conditions is extracted, and then the features extracted by static analysis and dynamic analysis, as well as the malicious code binary code and the disassembled assembly code are submitted as the total input to the deep learning algorithm to obtain the features for malicious code judgment; then, by comparing the output of the RBM neural network with the historical attack behavior, a verification report is obtained and fed back to the data element analysis for feature re-extraction; through repeated verification and feedback, until the output judgment is consistent with the historical label, the extracted features are summarized into the feature database.

6. The attack behavior feature extraction method based on historical data deep learning according to claim 5 is characterized in that: Based on the sequential quadratic programming algorithm, the Lagrange multiplier method is used to transform the attack objective function optimization problem proposed in the previous summary into an iterative nonlinear programming problem, which can greatly reduce the complexity of solving the attack vector problem; according to the attack objective function and constraints in the previous summary, it can be expressed as the Lagrange multiplier expression as follows: L(a,λ1,λ2,λ3)=U(a)+λ1 T h1(a)+λ2 T h2(a)+λ3 T g(a) Among them, h1(a), h2(a), and g(a) correspond to the three constraints of the objective function in the previous section, which can be specifically expressed as h2(a)=N(a+L), g(a)=a T Ma; then, through the partial derivative functions of each parameter, the original objective function minimum problem is transformed into a derivative problem, that is, The specific values ​​of the relevant parameters when the function takes the minimum value; at this time, the objective function satisfies: Among them, λ k They are the specific values ​​of the three parameters λ1, λ2, and λ3 in the Lagrangian objective function obtained in the kth iteration of the iterative algorithm.

7. The attack behavior feature extraction method based on historical data deep learning according to claim 1 is characterized in that: The clustering algorithms for malicious code homology judgment specifically include: 1) Sample collection Using the same source code, we disassemble the binary files compiled for different platforms to get different assemblers, extract the instruction set, registers, addressing mode, and control flow graph within the function, as the sample data set: X={xi|i=1,2,...,n},Cj(j=1,2,...,k) Among them, X represents a data vector under a program. The features of the function call graph are extracted. The number of times the function is called by other functions, the number of times the function calls other functions, and the number of times call2, as well as the number of times call* and call2* after deduplication are extracted as data set parameters to obtain the sample matrix: x = [call call2 call*call2*] For different platforms Get each feature vector, such as the number of times this function is called by other functions: call={call(1),call(2),…,call(n)} 2) Selection of initial clustering centers of samples From each feature vector, randomly select a value as the cluster center. For example, for the function call graph, randomly select a sample of 4 vectors as the initial cluster center: (c1, c2, c3, c4); At the same time, each sample in the sample data set {xi} is assigned to k cluster centers ci according to the principle of the closest distance; 3) Cluster center update: Calculate the new cluster center ci', that is, update the cluster center using the following formula: 4) Feature judgment (algorithm collection Convergence) judges if the following conditions are met: ci≠ci(i=1,2,…,k) Then go back to step 3) and continue to update the cluster center; otherwise, the algorithm converges, proving that the eigenvalues ​​have similar rows for samples on different platforms, and jump to step 5); 5) Termination algorithm In order to prevent an infinite loop due to excessive discreteness of the sample points in the previous step, a maximum number of iterations d is set; when the number of iterations of step 4) exceeds d, it is considered that the feature vector has little similarity on different platforms and the platform has too much influence on the feature, and the extraction of the vector is abandoned.

Images