VPN feature recognition and software detection method based on function call

Abstract

The invention discloses a VPN (Virtual Private Network) feature recognition and software detection method based on function call, which comprises the following steps of: processing a file containing a function call graph, extracting function call related to network operation from the file, and constructing the function call graph of network related API (Application Program Interface) call; converting the function call graph into a document, a call sequence and a feature vector, and performing graph embedding by using Node2Vec to generate an embedded vector of each graph; in the feature extraction stage, data of VPN software and data of common software are fused in combination with various features, a random forest classifier is used for training, and test data are predicted through a voting classifier; and the performance of the model is evaluated through indexes such as accuracy, recall rate and false positive rate of the model. According to the method, high accuracy and recall rate are shown in the distinguishing task of the VPN software and the common software, the identification capability of the software containing the VPN mechanism is effectively improved, and the method is suitable for being applied to the field of network security.

Description

Technical Field

[0001] The present invention relates to a technology in the field of information security, in particular to a method for identifying virtual private network (VPN) characteristics and detecting software based on function calls. Background Art

[0002] With the increasing number of network security threats, VPN technology is widely used to protect user privacy and data security. When applications transmit data anonymously, they often use VPN technology to establish a confidential channel and then transmit data in the channel. Identifying whether VPN technology is used to establish a channel in an application helps security analysts to automatically and batch-master the VPN usage of applications without obtaining source code, so as to further analyze and characterize the behavior of the application. Existing VPN detection methods usually rely on network traffic analysis or specific protocol identification. These methods require real-time monitoring of the network environment and may be affected by encrypted traffic, resulting in limited detection accuracy and real-time performance. Summary of the invention

[0003] In view of the above-mentioned deficiencies in the prior art, the present invention proposes a VPN feature recognition and software detection method based on function call, which reflects the software behavior through the function call graph, introduces multiple features (including document features, sequence features, One-Hot features and graph embedding features) to comprehensively describe the software characteristics, thereby forming a comprehensive feature vector, achieving higher detection accuracy in distinguishing VPN software from ordinary software, taking into account the combined advantages of feature extraction and classifier, and significantly improving the accuracy and robustness of classification.

[0004] The present invention is achieved through the following technical solutions:

[0005] The present invention relates to a VPN feature recognition and software detection method based on function call, comprising:

[0006] S1. Extract the network-related API of the program to be tested, that is, the function name that performs network operations to preliminarily screen out the program part related to network behavior.

[0007] The network operations include: establishing a network connection, sending and receiving data, etc.

[0008] The network-related API includes functions such as socket, connect, send, recv, bind, etc.

[0009] The step S1 specifically includes:

[0010] S11. API list definition: define a list of common network operation APIs, including socket, htons, ntohs, connect, bind, listen, accept, send, recv, close, etc. Each API represents a network operation;

[0011] S12, function name filtering: by comparing each function name extracted from the program to be tested with the API list in step S11, filter out the functions containing network APIs, and mark these functions as network-related functions, which serve as key nodes for extracting network-related function call subgraphs in subsequent steps to effectively exclude functions that are not related to network operations, thereby reducing unnecessary data processing and analysis overhead.

[0012] S2. Build a function call graph of the entire binary program to describe the calling relationship between the functions within the program. Then, filter out nodes that are not related to network operations based on the extracted function names to obtain a subgraph for network behavior, including:

[0013] S21. Function call graph construction: Through a customized static analysis tool script, all functions and their calling relationships are parsed from the binary program under test to build an initial function call graph.

[0014] The nodes in the function call graph refer to each independent function in the program, including metadata such as function name, parameter type, return type, etc., and are divided into two categories: local functions and external functions. Local functions are functions defined in the current program. The scope of these functions is limited to the local area and is used to implement specific functional logic; external functions refer to functions from other modules or libraries, such as system calls or functions in dynamic link libraries; the edges between nodes refer to the direct and indirect calling relationships between functions.

[0015] The indirect calling relationship includes calling realized by pointer or jump instruction.

[0016] S22, subgraph extraction: according to the function names extracted in step S1, extract the subgraphs related to these functions from the initial function call graph, specifically: filter out all nodes containing network-related functions from the original graph, retain these nodes and their directly connected edges, and form a subgraph specifically for network behavior, i.e., a simplified call graph, which contains all paths and call relationships that may involve network operations.

[0017] S3. Extract multiple features that can describe the behavior and characteristics of the program under test from the simplified call graph for subsequent classification model training, including document features, sequence features, and graph embedding features. Specifically,

[0018] S31, document feature extraction: connecting the function node names in the simplified call graph in order into a text sequence to obtain document features that reflect the order and logical relationship of function calls;

[0019] S32, sequence feature extraction: analyze the function call edges in the simplified call graph, arrange all edges in order of appearance, convert these edge sequences into feature vectors, and obtain sequence features that reflect the dynamic process of function calls in the program under test;

[0020] S33, graph embedding feature extraction: embed the simplified call graph into a high-dimensional vector space to represent the overall structure of the graph, so that nodes and edges are converted into feature vectors of fixed dimensions, and obtain graph embedding features that retain the global structural information of the function call graph;

[0021] The embedding is implemented using technologies such as Node2Vec and GraphSAGE.

[0022] S4. Using multiple machine learning models to learn the multiple features obtained in step S3, the program to be tested is classified, thereby detecting VPN software, specifically including:

[0023] S41, construction of feature vector: the document features, sequence features and graph embedding features extracted in step S3 are combined and fused to form a multi-dimensional feature vector.

[0024] The fusion preferably assigns different weights to different types of features to reflect their importance in the classification task.

[0025] S42. Classification model training: Use the fused feature vector as a sample to train the classification model.

[0026] The classification model preferably adopts a random forest classifier in combination with ensemble learning technology, and effectively improves the generalization ability of the model by adaptively adjusting hyperparameters, namely the number of trees in the random forest, and using a cross-validation method.

[0027] S43. Combine multiple individually trained classification models to build an integrated classifier: Train the classification models based on document features, sequence features, and graph embedding features separately, and then vote or weighted average their prediction results to form an integrated classification model.

[0028] S5. Analyze the newly input binary program in the online stage: extract the feature vector of the new program, input it into the classification model, determine whether the program belongs to the VPN software category, output the corresponding classification result, and detect potential similarity attacks or software cloning phenomena based on similarity, including:

[0029] S51, feature vector generation: Repeat the process in step S3, extract document features, sequence features and graph embedding features from the program, and combine these features to form a feature vector. This feature vector will be used in the subsequent classification prediction step. Represents the behavioral patterns and structural features of the new program;

[0030] S52, classification prediction: The generated feature vector is input into the pre-trained integrated classification model. The model will determine whether the program is VPN software based on the dimensional information of the input feature vector and output the classification result. The classification result may include the probability distribution of multiple labels or a direct binary classification result (such as "is VPN software" or "is not VPN software") to help users understand the nature of the program;

[0031] S53. By calculating the feature vector distance or similarity score between the program to be analyzed and the samples in the existing data set, the similarity between the new program and the existing program can be evaluated to identify possible cloned software or variant programs, providing technical support for software security detection and infringement investigation.

[0032] The present invention relates to a system for implementing the above method, comprising: a graph preprocessing unit, a graph feature extraction unit and a model training and evaluation unit, wherein: the graph preprocessing unit constructs a binary function graph for each function of the binary code to be compared as the basis for function feature extraction; the graph feature extraction unit learns multiple features and forms a comprehensive feature vector based on the obtained function call subgraph; the model training and evaluation unit is trained by multiple classifiers, and classification decisions are made by a voting mechanism to determine whether there is software with a VPN mechanism. Technical Effects

[0033] The present invention performs VPN feature recognition and software detection based on function call relationships, reflects software behavior through function call graphs, introduces multiple features (including document features, sequence features, One-Hot features, and graph embedding features) to comprehensively describe software characteristics, thereby forming a comprehensive feature vector, and trains through multiple classifiers, and makes classification decisions through a voting mechanism. The present invention calculates the confusion matrix and its derived indicators (such as TPR, FPR, accuracy, and balanced accuracy) for a large amount of software data to evaluate the performance of the classification model. The performance of the system in the test shows that the recall rate (TPR) is 1.000, the false alarm rate (FPR) is 0.005, the overall accuracy (Accuracy) is 0.995, and the balanced accuracy (Balanced Accuracy) reaches 0.998, indicating that the system has a high degree of accuracy and reliability in detecting software containing VPN mechanisms. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1It is a flow chart of the present invention. DETAILED DESCRIPTION

[0035] like Figure 1 As shown, this embodiment involves a VPN feature recognition and software detection method based on function calls, which analyzes and extracts the features of all network-related functions in a binary file, constructs a function call graph and generates a feature vector for classification and evaluation, specifically including:

[0036] Step 1: Data preprocessing and function call graph construction, including:

[0037] S11. Use IDA Pro static analysis tool to parse all functions and their calling relationships from binary program files and build the initial function call graph. This graph contains all function nodes in the program and the calling edges between functions, and is saved in the format of a json file.

[0038] S12. Traverse all .json files in the folders of the common software and VPN software, and extract the function call graph data from each file, including the function name and the calling relationship between functions. Use the network-related API list (such as connect, send, recv, etc.) to filter the functions involved in network operations, and build a function call graph containing only network-related API calls based on these functions.

[0039] S12, the filtered and constructed function call graph is saved again in .json format for subsequent feature extraction and model training. Each saved file includes network-related nodes and the edges between them, as well as the function names corresponding to these nodes.

[0040] Step 2: Based on the binary function call graph constructed in step 1, learn and extract different feature representations, including:

[0041] S21, load the saved function call graph file, and treat each function node in the graph as an independent text document, with the function name as the document content. These documents will be further converted into feature representations, such as TF-IDF feature vectors, for subsequent classification tasks.

[0042] S22, convert the function call graph into a call sequence format, representing each edge in the graph as a sequence pair of function calls. These sequences are used to generate feature representations, such as the sequence feature vectors generated by CountVectorizer.

[0043] S23. Use the Node2Vec algorithm to embed the function call graph, generate an embedding vector for each function node, and average the embedding vectors of all nodes to generate an embedding representation of the entire function call graph. The embedding representation is used to enhance the model's understanding of the graph structure.

[0044] S24, convert each function call graph into a one-hot encoded feature vector. Generate a corresponding one-hot encoding for each API by checking whether the function name is included in the list of network-related APIs. Finally, combine the TF-IDF feature vector, the call sequence feature vector, the graph embedding vector, and the one-hot encoded feature vector to form a complete feature vector representation.

[0045] Step 3: Training and evaluating the classification model based on the extracted features, including:

[0046] S31. Divide the feature vector matrix generated in step 2 into a training set and a test set, and use a random forest classifier to independently train and evaluate each feature vector.

[0047] S32. Build an integrated voting classifier that integrates TF-IDF features, call sequence features, and graph embedding features, trains the training set, and predicts in the test set. By integrating the classification results of different features, the overall performance of the model is improved.

[0048] S33. Evaluate the classification results of the test set, calculate the model's accuracy, recall, false positive rate and other indicators, record the names of all incorrectly classified files, and save this information in a log file for subsequent analysis and model improvement.

[0049] After specific experiments, the implementation was completed on a Linux server using Ubuntu 22.04.2, which is equipped with an Intel Xeon Platinum 8362CPU@2.80GHz, 251GB RAM and an NVIDIA RTX3090 GPU.

[0050] Regarding the setting of hyperparameters, in the embedding generation process, the Node2Vec model is used to embed the graph nodes, where the node embedding dimension is set to 64, the length of the random walk is 30, the number of walks is 200, and the model window size is 10. In terms of feature extraction, TF-IDF, call sequence count vectors, and One-Hot encoding feature vectors are used, and these three types of features are trained independently. The final classification model uses an ensemble learning method, in which the number of base trees of the random forest classifier is set to 100. Effect evaluation

[0051] Regarding the selection of data sets, since VPN software itself is limited, the present invention selects 48 regular VPN software obtained from github and 6802 common software obtained from Softpedia as data sets. During the training process, the training set and the test set are split according to a ratio of 7:3.

[0052] Table 1 shows the evaluation results of the model on the dataset.

[0053] The results show that the TPR (recall rate) of the present invention reaches 100%, indicating that it can completely and correctly identify all VPN software samples without missing any. The FPR (false positive rate) is 0.005, indicating that the model's misidentification rate for ordinary software is very low and almost negligible. The accuracy rate is 0.995, indicating that the overall classification accuracy of the model is very high and can correctly classify the vast majority of samples. The balanced accuracy rate is 0.998, further indicating that the model has a balanced classification performance on positive and negative samples, and its recognition ability for both VPN software and ordinary software is very outstanding.

[0054] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principle and purpose of the present invention. The protection scope of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. Each implementation scheme within its scope shall be subject to the constraints of the present invention.

Claims

1. A VPN feature recognition and software detection method based on function call, characterized in that: include: S1. Extract the network-related API of the program to be tested, that is, the function name that performs network operations to preliminarily screen out the program parts related to network behavior; S2. Build a function call graph of the entire binary program to describe the calling relationship between functions within the program, and then further filter out nodes unrelated to network operations based on the extracted function names to obtain a subgraph for network behavior; S3. Extract multiple features that can describe the behavior and characteristics of the program under test from the simplified call graph for subsequent classification model training, including document features, sequence features, and graph embedding features; S4, using multiple machine learning models to learn multiple features obtained in step S3, classifying the program to be tested, thereby detecting VPN software; S5. In the online phase, the newly input binary program is analyzed: by extracting the feature vector of the new program and inputting it into the classification model, it is determined whether the program belongs to the VPN software category, and the corresponding classification results are output. Based on the similarity, potential similarity attacks or software cloning phenomena are detected.

2. The VPN feature identification and software detection method based on function call according to claim 1 is characterized in that: The network operations include: establishing a network connection, sending and receiving data; The network-related APIs include: socket, connect, send, recv, and bind.

3. The VPN feature identification and software detection method based on function call according to claim 1 is characterized in that: The step S1 specifically includes: S11. API list definition: define a list of common network operation APIs, including socket, htons, ntohs, connect, bind, listen, accept, send, recv, close, etc. Each API represents a network operation; S12, function name filtering: by comparing each function name extracted from the program to be tested with the API list in step S11, filter out the functions containing network APIs, and mark these functions as network-related functions, which serve as key nodes for extracting network-related function call subgraphs in subsequent steps to effectively exclude functions that are not related to network operations, thereby reducing unnecessary data processing and analysis overhead.

4. The VPN feature identification and software detection method based on function call according to claim 1 is characterized in that: The step S2 specifically includes: S21. Function call graph construction: Use static analysis tools to parse all functions and their call relationships from the binary program to be tested, and construct the initial function call graph; S22, subgraph extraction: according to the function names extracted in step S1, extract the subgraphs related to these functions from the initial function call graph, specifically: filter out all nodes containing network-related functions from the original graph, retain these nodes and their directly connected edges, and form a subgraph specifically for network behavior, i.e., a simplified call graph, which contains all paths and call relationships that may involve network operations.

5. The VPN feature identification and software detection method based on function call according to claim 1 is characterized in that: The step S3 specifically includes: S31, document feature extraction: connecting the names of the function nodes in the simplified call graph in order into a text sequence to obtain document features that reflect the order and logical relationship of the function calls; S32, sequence feature extraction: analyze the function call edges in the simplified call graph, arrange all edges in order of appearance, convert these edge sequences into feature vectors, and obtain sequence features that reflect the dynamic process of function calls in the program under test; S33, graph embedding feature extraction: embed the simplified call graph into a high-dimensional vector space to represent the overall structure of the graph, so that the nodes and edges are converted into feature vectors of fixed dimensions, and obtain the graph embedding features that retain the global structural information of the function call graph.

6. The VPN feature identification and software detection method based on function call according to claim 1 is characterized in that: The step S4 specifically includes: S41, constructing a feature vector: combining and fusing the document features, sequence features and graph embedding features extracted in step S3 to form a multi-dimensional feature vector; S42, classification model training: use the fused feature vector as a sample to train the classification model; S43. Combine multiple individually trained classification models to build an integrated classifier: Train the classification models based on document features, sequence features, and graph embedding features separately, and then vote or weighted average their prediction results to form an integrated classification model.

7. The VPN feature identification and software detection method based on function call according to claim 1 is characterized in that: The step S5 specifically includes: S51, feature vector generation: repeat the process in step S3, extract document features, sequence features and graph embedding features from the program, and combine these features to form a feature vector. This feature vector will be used in the subsequent classification prediction step and represents the behavior pattern and structural characteristics of the new program. S52, classification prediction: the generated feature vector is input into a pre-trained integrated classification model. The model determines whether the program is VPN software based on the dimensional information of the input feature vector and outputs a classification result. The classification result may include a probability distribution of multiple labels or a direct binary classification result (such as "is VPN software" or "is not VPN software") to help users understand the nature of the program. S53. Similarity analysis: In addition to classification, similarity analysis between programs can also be performed based on the output results of the classification model. By calculating the feature vector distance or similarity score between the program to be analyzed and the samples in the existing data set, the similarity between the new program and the existing program can be evaluated. This similarity analysis not only helps to detect potential similarity attacks, but also can identify possible cloned software or variant programs, providing technical support for software security testing and infringement investigations.

8. A VPN feature recognition and software detection system based on function call for implementing any of the methods described in claims 1-7, characterized in that: include: A graph preprocessing unit, a graph feature extraction unit and a model training and evaluation unit, wherein: the graph preprocessing unit constructs a binary function graph for each function of the binary code to be compared as a basis for function feature extraction; The graph feature extraction unit learns multiple features and forms a comprehensive feature vector based on the obtained function call subgraph; the model training and evaluation unit is trained through multiple classifiers, and makes classification decisions through a voting mechanism to determine whether there is software with a VPN mechanism.

Images