VPN feature recognition and software detection method based on function call

Abstract

A function call-based VPN feature recognition and software detection method processes files containing function call graphs, extracts function calls involving network operations, and constructs a function call graph of network-related API calls. The function call graph is converted into documents, call sequences, and feature vectors, and graph embedding is performed using Node2Vec to generate an embedding vector for each graph. During the feature extraction phase, VPN software and standard software data are fused using multiple features, trained using a random forest classifier, and predicted on test data using a voting classifier. The model's performance is then evaluated using metrics such as accuracy, recall, and false positive rate. This method demonstrates high accuracy and recall in distinguishing VPN software from standard software, effectively improving the ability to identify software containing VPN mechanisms and making it suitable for applications in the field of network security.

Description

Technical Field

[0001] The present invention relates to a technology in the field of information security, in particular to a method for identifying characteristics of a virtual private network (VPN) and detecting software based on function calls. Background Art

[0002] With the increasing threat of network security threats, VPN technology is widely used to protect user privacy and data security. Applications often use VPN technology to establish confidential channels for data transmission. Identifying whether an application uses VPN technology to establish channels helps security analysts automatically and comprehensively understand the VPN usage of applications without accessing source code, allowing for further analysis and characterization of application behavior. Existing VPN detection methods typically rely on network traffic analysis or specific protocol identification. These methods require real-time monitoring of the network environment and may be affected by encrypted traffic, limiting detection accuracy and real-time performance. Summary of the Invention

[0003] In response to the above-mentioned shortcomings of the existing technology, the present invention proposes a VPN feature recognition and software detection method based on function calls. The method reflects software behavior through the function call graph and introduces multiple features (including document features, sequence features, one-hot features and graph embedding features) to comprehensively describe software characteristics, thereby forming a comprehensive feature vector. This method achieves higher detection accuracy in distinguishing VPN software from ordinary software, takes into account the combined advantages of feature extraction and classifiers, and significantly improves the accuracy and robustness of classification.

[0004] The present invention is achieved through the following technical solutions:

[0005] The present invention relates to a VPN feature recognition and software detection method based on function call, comprising:

[0006] S1. Extract the network-related API of the program to be tested, that is, the function name that performs network operations to preliminarily screen out the program parts related to network behavior.

[0007] The network operations include: establishing a network connection, sending and receiving data, and other operations.

[0008] The network-related API includes functions such as socket, connect, send, recv, and bind.

[0009] The step S1 specifically includes:

[0010] S11. API list definition: Define a list of common network operation APIs, including socket, htons, ntohs, connect, bind, listen, accept, send, recv, close, etc. Each API represents a network operation;

[0011] S12. Function name filtering: By comparing each function name extracted from the program to be tested with the API list in step S11, functions containing network APIs are screened out, and these functions are marked as network-related functions. These functions serve as key nodes for extracting network-related function call subgraphs in subsequent steps to effectively exclude functions not related to network operations, reducing unnecessary data processing and analysis overhead.

[0012] S2. Build a function call graph for the entire binary program to describe the calling relationships between functions within the program. Nodes not related to network operations are further filtered based on the extracted function names to obtain a subgraph for network behavior. Specifically, it includes:

[0013] S21. Function call graph construction: Through a customized static analysis tool script, all functions and their call relationships are parsed from the binary program under test to build the initial function call graph.

[0014] The nodes in the function call graph refer to each independent function in the program, including metadata such as function name, parameter type, return type, etc., and are divided into two categories: local functions and external functions: local functions are functions defined in the current program, the scope of these functions is limited to the local area, and they are used to implement specific functional logic; external functions refer to functions from other modules or libraries, such as system calls or functions in dynamic link libraries; the edges between nodes refer to the direct and indirect calling relationships between functions.

[0015] The indirect calling relationship includes calling implemented through pointers or jump instructions.

[0016] S22. Subgraph extraction: Based on the function names extracted in step S1, subgraphs related to these functions are extracted from the initial function call graph. Specifically, all nodes containing network-related functions are filtered out from the original graph, and these nodes and their directly connected edges are retained to form a subgraph specifically for network behavior, i.e., a simplified call graph. This simplified call graph contains all paths and call relationships that may involve network operations.

[0017] S3. Extract multiple features that can describe the behavior and characteristics of the program under test from the simplified call graph for subsequent classification model training, including document features, sequence features, and graph embedding features. Specifically,

[0018] S31, document feature extraction: connect the function node names in the simplified call graph in order to form a text sequence, and obtain document features that reflect the order and logical relationship of function calls;

[0019] S32. Sequence feature extraction: Analyze the function call edges in the simplified call graph, arrange all edges in order of appearance, convert these edge sequences into feature vectors, and obtain sequence features that reflect the dynamic process of function calls in the program under test;

[0020] S33, graph embedding feature extraction: embed the simplified call graph into a high-dimensional vector space to represent the overall structure of the graph, so that the nodes and edges are converted into feature vectors of fixed dimensions, and obtain graph embedding features that retain the global structural information of the function call graph;

[0021] The embedding is implemented using technologies such as Node2Vec and GraphSAGE.

[0022] S4. Using multiple machine learning models to learn the multiple features obtained in step S3, the program to be tested is classified, thereby detecting VPN software. Specifically, the following steps are performed:

[0023] S41. Construction of feature vector: The document features, sequence features and graph embedding features extracted in step S3 are combined and fused to form a multi-dimensional feature vector.

[0024] The fusion preferably assigns different weights to different types of features to reflect their importance in the classification task.

[0025] S42. Classification model training: Use the fused feature vector as a sample to train the classification model.

[0026] The classification model preferably adopts a random forest classifier in combination with ensemble learning technology, and effectively improves the generalization ability of the model by adaptively adjusting the hyperparameters, i.e., the number of trees in the random forest, and using a cross-validation method.

[0027] S43. Combine multiple individually trained classification models to build an integrated classifier: Train the classification models based on document features, sequence features, and graph embedding features separately, and then vote or weighted average their prediction results to form an integrated classification model.

[0028] S5. Analyze the newly input binary program online: Extract the feature vector of the new program and input it into the classification model to determine whether the program belongs to the VPN software category. The corresponding classification result is output and potential similarity attacks or software cloning phenomena are detected based on similarity. Specifically, the following are performed:

[0029] S51, feature vector generation: Repeat the process in step S3 to extract document features, sequence features and graph embedding features from the program, and combine these features to form a feature vector. This feature vector will be used in the subsequent classification prediction step.

[0030] Represents the behavioral patterns and structural characteristics of the new program;

[0031] S52. Classification prediction: The generated feature vector is input into a pre-trained ensemble classification model. The model determines whether the program is VPN software based on the various dimensions of the input feature vector and outputs a classification result. The classification result may include a probability distribution of multiple labels or a direct binary classification result (e.g., "is VPN software" or "is not VPN software") to help users understand the nature of the program.

[0032] S53. By calculating the feature vector distance or similarity score between the program to be analyzed and the samples in the existing data set, the similarity between the new program and the existing program can be evaluated to identify possible cloned software or variant programs, providing technical support for software security detection and infringement investigation.

[0033] The present invention relates to a system for implementing the above-mentioned method, comprising: a graph preprocessing unit, a graph feature extraction unit, and a model training and evaluation unit, wherein: the graph preprocessing unit constructs a binary function graph for each function of the binary code to be compared as the basis for function feature extraction; the graph feature extraction unit learns multiple features and forms a comprehensive feature vector based on the obtained function call subgraph; the model training and evaluation unit trains through multiple classifiers, makes classification decisions through a voting mechanism, and determines whether there is software with a VPN mechanism.

[0034] Technical Effects

[0035] The present invention performs VPN feature recognition and software detection based on function call relationships, reflects software behavior through function call graphs, introduces multiple features (including document features, sequence features, one-hot features, and graph embedding features) to comprehensively describe software characteristics, thereby forming a comprehensive feature vector, and trains through multiple classifiers, and makes classification decisions through a voting mechanism. The present invention calculates the confusion matrix and its derived indicators (such as TPR, FPR, accuracy, and balanced accuracy) for a large amount of software data to evaluate the performance of the classification model. The performance of the system in the test showed that the recall rate (TPR) was 1.000, the false alarm rate (FPR) was 0.005, the overall accuracy (Accuracy) was 0.995, and the balanced accuracy (Balanced Accuracy) reached 0.998, indicating that the system has a high degree of accuracy and reliability in detecting software containing VPN mechanisms. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0037] like Figure 1 As shown, this embodiment relates to a VPN feature identification and software detection method based on function calls. By analyzing and extracting features of all network-related functions in a binary file, a function call graph is constructed and feature vectors are generated for classification and evaluation. Specifically, the method includes:

[0038] Step 1: Data preprocessing and function call graph construction, specifically including:

[0039] S11. Use the IDA Pro static analysis tool to parse all functions and their call relationships from the binary program file and construct an initial function call graph. This graph contains all function nodes in the program and the call edges between functions, and is saved in JSON format.

[0040] S12. Traverse all .json files in the regular software and VPN software folders and extract function call graph data from each file, including function names and the call relationships between functions. Use a list of network-related APIs (such as connect, send, recv, etc.) to filter functions involving network operations. Based on these functions, construct a function call graph containing only network-related API calls.

[0041] S12. Save the filtered and constructed function call graph in .json format again for subsequent feature extraction and model training. Each saved file includes network-related nodes and the edges between them, as well as the function names corresponding to these nodes.

[0042] Step 2: Based on the binary function call graph constructed in step 1, learn and extract different feature representations, including:

[0043] S21. Load the saved function call graph file and treat each function node in the graph as a separate text document, with the function name as the document content. These documents will be further converted into feature representations, such as TF-IDF feature vectors, for subsequent classification tasks.

[0044] S22. Convert the function call graph to a call sequence format, representing each edge in the graph as a sequence of function calls. These sequences are used to generate feature representations, such as the sequence feature vectors generated by CountVectorizer.

[0045] S23. Use the Node2Vec algorithm to embed the function call graph, generating an embedding vector for each function node. Then, by averaging the embedding vectors of all nodes, we generate an embedding representation of the entire function call graph. This embedding representation enhances the model's understanding of the graph structure.

[0046] S24. Convert each function call graph into a one-hot encoded feature vector. Generate a corresponding one-hot encoding for each API by checking whether the function name is included in the list of network-related APIs. Finally, combine the TF-IDF feature vector, the call sequence feature vector, the graph embedding vector, and the one-hot encoded feature vector to form a complete feature vector representation.

[0047] Step 3: Training and evaluating the classification model based on the extracted features, including:

[0048] S31. Divide the feature vector matrix generated in step 2 into a training set and a test set, and use a random forest classifier to independently train and evaluate each feature vector.

[0049] S32. Build an ensemble voting classifier that combines TF-IDF features, call sequence features, and graph embedding features. Train on the training set and make predictions on the test set. By integrating the classification results of different features, the overall performance of the model is improved.

[0050] S33. Evaluate the classification results of the test set, calculate the model's accuracy, recall rate, false positive rate and other indicators, record the names of all incorrectly classified files, and save this information in a log file for subsequent analysis and model improvement.

[0051] After specific experiments, the implementation was completed on a Linux server running Ubuntu 22.04.2, which is equipped with an Intel Xeon Platinum 8362CPU@2.80GHz, 251GB RAM and an NVIDIA RTX3090 GPU.

[0052] Regarding hyperparameter settings, the Node2Vec model was used to embed graph nodes during embedding generation. The node embedding dimension was set to 64, the random walk length was 30, the number of walks was 200, and the model window size was 10. For feature extraction, TF-IDF, call sequence count vectors, and one-hot encoded feature vectors were used, and each of these three feature types was trained independently. The final classification model used an ensemble learning approach, with the number of base trees in the random forest classifier set to 100.

[0053] Effect evaluation

[0054] Regarding the selection of data sets, due to the limited availability of VPN software itself, this paper selected 48 regular VPN software obtained from GitHub and 6802 common software obtained from Softpedia as data sets. During the training process, the training set and test set were split in a ratio of 7:3.

[0055] Table 1 shows the evaluation results of the model on the dataset.

[0056]

[0057] The results show that the proposed method achieved a 100% TPR (Recall Rate), indicating that it correctly identified all VPN software samples with no missed detections. The FPR (False Positive Rate) was 0.005, indicating that the model's misidentification rate for general software was very low and almost negligible. The accuracy was 0.995, indicating that the model achieved very high overall classification accuracy, correctly classifying the vast majority of samples. The balanced accuracy was 0.998, further demonstrating that the model performed well across both positive and negative classifications, demonstrating excellent recognition of both VPN and general software.

[0058] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principles and purpose of the present invention. The scope of protection of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. All implementation schemes within its scope shall be subject to the constraints of the present invention.

Claims

1. A VPN feature identification and software detection method based on function call, characterized in that: include: S1. Extract the network operation API of the program to be tested to preliminarily screen out the program parts related to network behavior; S2. Build a function call graph for the entire binary program to describe the calling relationships between functions within the program. Nodes not related to network operations are further filtered based on the extracted function names to obtain a simplified call graph for network behavior. S3. Extract multiple features that can describe the behavior and characteristics of the program under test from the simplified call graph for subsequent classification model training, including document features, sequence features, and graph embedding features; S4. Using multiple machine learning models to learn the multiple features obtained in step S3, the program to be tested is classified, thereby detecting VPN software. S5. Analyze the newly input binary program in the online stage: By extracting the feature vector of the new program and inputting it into the classification model, it is determined whether the program belongs to the VPN software category, and the corresponding classification results are output. Potential similarity attacks or software cloning phenomena are detected based on similarity.

2. The VPN feature identification and software detection method based on function call according to claim 1 is characterized in that: The network operations include: establishing a network connection, sending and receiving data; The network-related APIs include: socket, connect, send, recv, and bind.

3. The VPN feature identification and software detection method based on function call according to claim 1 is characterized in that: The step S1 specifically includes: S11. API list definition: Define a list of common network operation APIs, including socket, htons, ntohs, connect, bind, listen, accept, send, recv, close. Each API represents a network operation. S12. Function name filtering: By comparing each function name extracted from the program to be tested with the API list in step S11, functions containing network operation APIs are screened out, and these functions are marked as network-related functions. These functions serve as key nodes for extracting network-related function call subgraphs in subsequent steps to effectively exclude functions not related to network operations, reducing unnecessary data processing and analysis overhead.

4. The VPN feature identification and software detection method based on function call according to claim 1 is characterized in that: The step S2 specifically includes: S21. Function call graph construction: Use static analysis tools to parse all functions and their call relationships from the binary program under test and construct the initial function call graph; S22. Subgraph extraction: Based on the function names extracted in step S1, subgraphs related to these functions are extracted from the initial function call graph. Specifically, all nodes containing network-related functions are filtered out from the original graph, and these nodes and their directly connected edges are retained to form a simplified call graph specifically for network behavior. This simplified call graph contains all paths and call relationships that may involve network operations.

5. The VPN feature identification and software detection method based on function call according to claim 1 is characterized in that: The step S3 specifically includes: S31, document feature extraction: connect the function node names in the simplified call graph in order to form a text sequence, and obtain document features that reflect the order and logical relationship of function calls; S32. Sequence feature extraction: Analyze the function call edges in the simplified call graph, arrange all edges in order of appearance, convert these edge sequences into feature vectors, and obtain sequence features that reflect the dynamic process of function calls in the program under test; S33. Graph embedding feature extraction: The simplified call graph is embedded in a high-dimensional vector space to represent the overall structure of the graph, so that the nodes and edges are converted into feature vectors of fixed dimensions, and the graph embedding features that retain the global structural information of the function call graph are obtained.

6. The VPN feature identification and software detection method based on function call according to claim 1 is characterized in that: The step S4 specifically includes: S41, constructing a feature vector: fusing the document features, sequence features, and graph embedding features extracted in step S3 to form a multi-dimensional feature vector; S42, classification model training: Use the fused feature vector as a sample to train the classification model; S43. Combine multiple individually trained classification models to build an integrated classifier: Train the classification models based on document features, sequence features, and graph embedding features separately, and then vote or weighted average their prediction results to form an integrated classification model.

7. The VPN feature identification and software detection method based on function call according to claim 1 is characterized in that: The step S5 specifically includes: S51, feature vector generation: Repeat the process in step S3 to extract document features, sequence features, and graph embedding features from the program, and combine these features to form a feature vector. This feature vector will be used in the subsequent classification prediction step and represents the behavioral pattern and structural characteristics of the new program; S52. Classification prediction: The generated feature vector is input into a pre-trained ensemble classification model. The model determines whether the program is VPN software based on the various dimensions of the input feature vector and outputs a classification result. The classification result may include a probability distribution of multiple labels or a direct binary classification result to help users understand the nature of the program. S53. Similarity analysis: In addition to classification, similarity analysis between programs can also be performed based on the output results of the classification model. By calculating the feature vector distance or similarity score between the program to be analyzed and the samples in the existing data set, the similarity between the new program and the existing program can be evaluated. This similarity analysis not only helps to detect potential similarity attacks, but also can identify possible cloned software or variant programs, providing technical support for software security testing and infringement investigations.

8. A VPN feature identification and software detection system based on function calls that implements the method according to any one of claims 1 to 7, characterized in that: include: A graph preprocessing unit, a graph feature extraction unit and a model training and evaluation unit, wherein: the graph preprocessing unit constructs a binary function graph for each function of the binary code to be compared as a basis for function feature extraction; The graph feature extraction unit learns multiple features and forms a comprehensive feature vector based on the obtained function call subgraph; the model training and evaluation unit trains multiple classifiers and makes classification decisions through a voting mechanism to determine whether there is software with a VPN mechanism.

Images